News for hackers. Stuff that matters.

A comment on Ask HN: Is there a version of HTML that bans JavaScript?.

Re:Ask HN: Is there a version of HTML that bans JavaScript? by moviuro on Monday September 23, 2019 @08:06AM (#21048079)
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

  Content-Security-Policy: default-src 'none';
[ Parent | on HN ]
Re:Ask HN: Is there a version of HTML that bans JavaScript? by zoobab on Tuesday September 24, 2019 @05:01AM (#21057920)
Not like this?:

Content-Security-Policy: script-src 'none';

[ Parent | on HN ]
Re:Ask HN: Is there a version of HTML that bans JavaScript? by moviuro on Tuesday September 24, 2019 @08:17AM (#21059202)
Probably yours, yes. On my own blog, I use:

  default-src 'self'; base-uri 'self'; style-src 'unsafe-inline' 'self'
[ Parent | on HN ]