Comment Comment by pixdamix CSP mitigates the risks of XSS attacks.If you look at : https://cspvalidator.org/#url=https://github.com you'll see that the CSP policy directive defines the origins from which images can be loaded 'self' data: assets-cdn.github.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com ; Previously, images could have been loaded from additional domains (gravatar) and could have been used to leak CSRF tokens. parent pixdamix 9 years ago
If you look at : https://cspvalidator.org/#url=https://github.com you'll see that the CSP policy directive defines the origins from which images can be loaded
Previously, images could have been loaded from additional domains (gravatar) and could have been used to leak CSRF tokens.