Should CSP violations be treated as deployment failures?
Our production CSP reports have become frequent enough that I'm no longer treating them as purely security notifications. Adding an analytics script, payment widget, or third-party SDK can…
Content-Security-Policy
Why don’t browsers enforce safer security defaults by now?
I've been reviewing CSRF and CSP and noticed that many web security protections are still opt-in. They often exist to patch weaknesses or unsafe assumptions built into older…
Why don’t browsers enforce safer defaults more aggressively?
I've been reviewing CSRF and Content Security Policy guidance and noticed that many important protections are still opt-in. Often, newer security features are added to patch weaknesses in…
Why am I getting Cloudflare CSP errors and a 403 when opening my pixel-art site?
I'm suddenly unable to access a pixel-art website I've used for years. The page returns a 403 Forbidden error saying the account has been blocked. Browser logs also…