canmove, Confirmed users
1,537
edits
Security/CSP/Spec: Difference between revisions
Jump to navigation
Jump to search
m
→script-src
m (→options) |
m (→script-src) |
||
| Line 230: | Line 230: | ||
* Scripts from non-approved sources will not be requested or loaded. | * Scripts from non-approved sources will not be requested or loaded. | ||
* If script-src is not explicitly specified, script requests are subject to the allow directive. | * If script-src is not explicitly specified, script requests are subject to the allow directive. | ||
* Sites may opt-out of the [[Security/CSP/Spec#No_inline_scripts_will_execute|"No inline script"]] restriction by adding the <tt>'inline'</tt> | * Sites may opt-out of the [[Security/CSP/Spec#No_inline_scripts_will_execute|"No inline script"]] restriction by adding the <tt>'inline-script'</tt> token to the <tt>options</tt> directive | ||
* Sites may opt-out of the [[Security/CSP/Spec#Code_will_not_be_created_from_strings|"No code from strings"]] restriction by adding the <tt>'eval'</tt> | * Sites may opt-out of the [[Security/CSP/Spec#Code_will_not_be_created_from_strings|"No code from strings"]] restriction by adding the <tt>'eval-script'</tt> token to the <tt>options</tt> directive | ||
===object-src=== | ===object-src=== | ||