canmove, Confirmed users
1,537
edits
Security/CSP/Specification: Difference between revisions
Jump to navigation
Jump to search
m
→Directives
m (MUST NOT!) |
m (→Directives) |
||
| Line 48: | Line 48: | ||
** <tt>inline-script</tt> enables inline scripts and <tt>javascript:</tt> URIs | ** <tt>inline-script</tt> enables inline scripts and <tt>javascript:</tt> URIs | ||
** <tt>eval-script</tt> enables the <tt>eval()</tt> functionality of scripts interpreted by the browser, and allows code to be created from strings in uses of the <tt>new Function()</tt> constructor, <tt>setTimeout</tt> and <tt>setInterval</tt> | ** <tt>eval-script</tt> enables the <tt>eval()</tt> functionality of scripts interpreted by the browser, and allows code to be created from strings in uses of the <tt>new Function()</tt> constructor, <tt>setTimeout</tt> and <tt>setInterval</tt> | ||
* User Agents | * User Agents MUST ignore any tokens not recognized by CSP, and SHOULD post a non-fatal warning to the error console. | ||
;img-src: | ;img-src: | ||