- 🇬🇧United Kingdom the_g_bomb
Updated URL for the relevant blog post:
https://david-gilbertson.medium.com/im-harvesting-credit-card-numbers-an...
I think it may no longer be available on hackernoon even though it still shows up in the search results
As detailed in this blog post, failing to set the form-action CSP directive can lead to data being sent to unauthorizeddomains.
If some rogue JS executes on a page with a form, that JS could be used to change the form's action attribute to evil.com, for example.
Adding the ability to set the form-action CSP directive would prevent form submission in this scenario.
Active
1.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Updated URL for the relevant blog post:
https://david-gilbertson.medium.com/im-harvesting-credit-card-numbers-an...
I think it may no longer be available on hackernoon even though it still shows up in the search results