I'm considering changing the grading criteria on @securityheaders to allow an A+ grade with a CSP that contains unsafe-inline in the style-src directive. What are your thoughts?
This is largely because I've not seen any significant threats posed by inline styles, and, even popular frameworks like Angular require unsafe-inline in the style-src directive: angular.io/guide/security…
I'm tempted to allow the A+ because I don't want it to be unreasonable to achieve the best possible grade. I want the A+ to be the best that site operators can reasonably do to protect themselves and their visitors.
I always respect the great amount of knowledge within the community though, so have your say with a vote and drop a comment below either way! 😎
I had an itch so I wrote a blog post 💪
scotthelme.co.uk/can-you-get-pw…
scotthelme.co.uk/can-you-get-pw…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
