35
edits
Security/CSP/CSRFModule: Difference between revisions
Jump to navigation
Jump to search
→anti-csrf
| Line 37: | Line 37: | ||
<li>When the user agent submits any HTTP request in context of the document with enabled CSP <tt>anti-csrf</tt> directive, where such request is classified as one of: | <li>When the user agent submits any HTTP request in context of the document with enabled CSP <tt>anti-csrf</tt> directive, where such request is classified as one of: | ||
<ol style="list-style-type:lower-alpha"> | <ol style="list-style-type:lower-alpha"> | ||
<li>external resource load (e.g., <tt>img src</tt>, <tt>link href</tt>, <tt>script src</tt>, <tt>iframe src</tt>, etc.),</li> | <li>external resource load (e.g., <tt><img src=…></tt>, <tt><link href=…></tt>, <tt><script src=…></tt>, <tt><iframe src=…></tt>, etc.),</li> | ||
<li>link activation,</li> | <li>link activation,</li> | ||
<li>form action,</li> | <li>form action,</li> | ||