If anything makes sense now, it's obj-src and script-src * + nonces
-
-
... at least if you believe that these kinds of bypasses are a big enough threat for your app - which they sometimes may be
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
You realize a polyfill for nonce propagation is easier than upgrading jQuery?
-
You can use a polyfill instead of 's-d' if you want to serve the JS on all pages and also do UA sniffing. Many people can't
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.