type__error’s Twitter Archive—№ 9,384

One way of protecting yourself from things like this is to send a Content-Security-Policy header with every response. This controls what scripts are allowed to execute on your page. Conveniently I have a blog post: localghost.dev/2020/05/defending-yourself-against-cross-site-scripting-attacks-with-content-security-policy/ zofrex/1319286955314614275