canmove, Confirmed users
1,537
edits
Security/CSP/Spec: Difference between revisions
→options
| Line 216: | Line 216: | ||
* The value of this directive is a space-separated list of LDH tokens, each specifying a feature to enable or disable: | * The value of this directive is a space-separated list of LDH tokens, each specifying a feature to enable or disable: | ||
** <tt>inline-script</tt> enables inline scripts and <tt>javascript:</tt> URIs | ** <tt>inline-script</tt> enables inline scripts and <tt>javascript:</tt> URIs | ||
** <tt>eval-script</tt> enables the <tt>eval()</tt> functionality of scripts interpreted by the browser, and allows code to be created from strings in uses of <tt>setTimeout</tt> and <tt>setInterval</tt> | ** <tt>eval-script</tt> enables the <tt>eval()</tt> functionality of scripts interpreted by the browser, and allows code to be created from strings in uses of the <tt>new Function()</tt> constructor, <tt>setTimeout</tt> and <tt>setInterval</tt> | ||
* Any tokens not recognized by CSP are ''ignored'', and a non-fatal warning is posted to the error console. | * Any tokens not recognized by CSP are ''ignored'', and a non-fatal warning is posted to the error console. | ||