From 5146ce5c2a73cfeb49bd38c46f17aa198a2bd44a Mon Sep 17 00:00:00 2001 From: guilhermeramosht Date: Thu, 3 Aug 2023 09:09:12 -0300 Subject: [PATCH] fix(typo): fixing typo in unsafe-inline.html --- www/unsafe-inline.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/unsafe-inline.html b/www/unsafe-inline.html index 4367e6a..23422c6 100644 --- a/www/unsafe-inline.html +++ b/www/unsafe-inline.html @@ -19,7 +19,7 @@

Warning

When someone requests that URL the bad-stuff.js will execute.

We can prevent our app from loading JS from bad-guy.example.com using CSP. If we have the following policy:

script-src: 'self'
-

Now becuase we specified 'self' in the script-src directive we can only load JS from the same origin as our app, the request to load a script from bad-guy.example.com will be blocked by CSP!

+

Now because we specified 'self' in the script-src directive we can only load JS from the same origin as our app, the request to load a script from bad-guy.example.com will be blocked by CSP!

CSP will also prevent inline scripts from loading, so if you have some legit JavaScript on your site, like this: 

<script>
 	doSomething();