We've seen some recent attacks on CSP which rely on the ability to exfiltrate nonce data via various mechanisms that can grab data from content attributes. CSS selectors are the best example. To mitigate these attacks, we'll hide the attribute from these side-channels, and only expose the value to script.
Documentation
Status in Chromium
Blink>SecurityFeature>ContentSecurityPolicy
In development
(tracking bug)
Consensus & Standardization
After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.
- No signal
- No signal
- No signals
Owner
Last updated on 2021-12-20