Yeah, that's why it should be same origin. The attacker can't do anything new if it's locked to same origin. Greetz -- Eduardo On Sun, Feb 13, 2011 at 9:53 PM, gaz Heyes <gazheyes@gmail.com> wrote: > On 13 February 2011 12:23, sird@rckc.at <sird@rckc.at> wrote: > >> I don't think an attribute called policy is the best solution, but I think >> something in that direction (being able to specify a CSP from an iframe) >> would solve that problem. >> > > Nope defo not an attribute policy, an attacker could use this to their > advantage >
Received on Sunday, 13 February 2011 21:55:45 UTC