News for hackers. Stuff that matters.

A comment on HTTP Security headers you should be using. Parent comment

Re:HTTP Security headers you should be using by falcolas on Thursday January 23, 2014 @12:11PM (#7109436)
The inline restriction burned us as well when we tried to implement this.

The solution is, of course, to do everything in separate script files, but it's not a trivial migration effort.

[ Parent | on HN ]
Re:HTTP Security headers you should be using by UnoriginalGuy on Thursday January 23, 2014 @01:51PM (#7110229)
I definitely see it as being the biggest roadblock for most sites. The report-only mode is useful for getting a work list of what needs fixing.

Plus long term moving inline JS to separate files must improve maintainability, version control, and also means your caching might work more effectively. So there is a little gain for the pain (aside from just the content policy).

[ Parent | on HN ]