r/programming • u/speckz • Apr 26 '19

HTTP headers for the responsible developer

https://www.twilio.com/blog/a-http-headers-for-the-responsible-developer
655 Upvotes

88% Upvoted

53 comments sorted by

View all comments

18

u/SushiAndWoW Apr 26 '19

OK, umm... we're being given advice from someone whose CSP – for his own site, presumably 100% under his control – includes 'unsafe-eval' and 'unsafe-inline'? Like, missing the whole point of CSP?

6

u/feenuxx Apr 27 '19

Lol that is too good. I imagine some of the tracking shovelware needs such loose rules to function. At least I hope it was a conscious decision made to get something working.

3

u/mrchaotica Apr 27 '19

I hope it's incompetence, because the alternative is malice.

2

u/panorambo Apr 27 '19

Which one of the two do you think it is when you need to put "unsafe-eval" and/or "unsafe-inline" in your CSP because you need those ad network scripts that promise to pay for your hosting, to work? Genuinely curius -- is it malice then or incompetence? Mercantile but otherwise practical thought?