HTTP Security headers you should be using

Re:HTTP Security headers you should be using by j_baker on Thursday January 23, 2014 @06:39PM (#7112298)

Content-Security-Policy is a tricky one. For starters, enabling CSP if you're using Angular causes a 30% slowdown[1]. Secondly, a lot of performance optimizations can be gained by inlining JavaScript. The latter one can be circumvented using SPDY server push, but that isn't widely used yet.

[1] http://docs.angularjs.org/api/ng.directive:ngCsp

[ Parent | on HN ]

Re:HTTP Security headers you should be using by scott_karana on Friday January 24, 2014 @02:11PM (#7116881)

Wow. There are more implications than I would have guessed with CSP. Thanks for pointing that out!

[ Parent | on HN ]