Re: Remove paths from CSP?

On Wed, Feb 12, 2014 at 8:02 AM, Sigbjørn Vik <sigbjorn@opera.com> wrote:

> That should be fairly easy. Even if blocked, call onload, and return the
>  image dimensions to the page. That is all a page can detect anyway.
>

An issue to consider with this approach is a CSRF attack vector. For
example if I have Content-Security-Policy: img-src 'images.example.com';
and the attacker injects the following:

<img src="
https://api.example.com/perform/some/csrf-vulerable/action/delete/all/things"
/>

CSP would have prevented it, but if you load blocked resources the CSRF
attack would still be successful.

--
Pete Freitag
http://content-security-policy.com/ - CSP Quick Reference