Re: [whatwg/fetch] The CSP hooks for `<script src='...' nonce='...'>` are broken. (#269)

> That is great, but if a page uses capability tokens, an attacker can use them to leak information (even if the capability doesn't match the response of that server)

Yes. Nonces reduce CSP's effectiveness as a defense against exfiltration. Happily(?) it's already pretty bad at that, and preventing XSS is a significantly more valuable goal. Especially since executing odd script is a precondition for exfiltration.

> Basically, you created a hole in CSP.

As the thread explains, whitelisting doesn't work for any sufficiently wild origin (`googleapis.com`, `google.com`. We're replacing a hole in CSP with a significantly smaller hole, which happens to be shaped in such a way that it makes deployment in general simpler. *shrug* I'm excited about it.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/269#issuecomment-205307970