Re: More on XSS mitigation (was Re: XSS mitigation in browsers)

On 21/01/11 22:44, Michal Zalewski wrote:
> 3) Allowing inline scripts guarded by policy-specified nonce tokens
> (<meta>  says "inline-script-token=$random", inline scripts have
> <script token="$previously_specified_random">...</script>). This
> eliminates one of the most significant issues with deploying CSP or
> this proposal on sites that are extremely concerned about the overhead
> of extra HTTP requests; for example, much of *.google.com is subject
> to such concerns.

http://www.gerv.net/security/script-keys/

Gerv