gethttpsforfree
gethttpsforfree copied to clipboard
Add CSP
Fixes #80
Strangely enough, an CSRF attack can be done solely with CSS, even with plugins/javascript disabled: https://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html
So all this patch does is remove inline styles, adds the CSP tag and adjusts the JS accordingly.
Sidenote: HKPK (reference in the issue) is being deprecated by Chrome, so it's probably better not to use it.
Rather than moving the css to an external file, I'd rather use the style-src 'sha256-<digest>'
CSP.