Normally, content security policies are sent in the response headers by the server to the client browser telling it what is and is not acceptable to load on the site. Is there a way to do this in reverse, so that you write a content security policy for your browser, for each site, and then it only loads the resources that are allowed by you on that particular site? This would be possible if you wrote your own browser, but I am wondering if any of the current major browsers have this ability built in yet, without having to create or install a plugin.

  • 3
    No - and this would be borderline unusable in practice w/o knowledge about how the site works. – Tobi Nary Nov 14 '17 at 18:18
  • 2
    Built in - no. But this is more-or-less the idea behind NoScript, which has been around for years. – paj28 Nov 14 '17 at 19:25

No browsers that I know of has this built in.

It would surely be possible to build such a plugin but it wouldn't really be useable. Why? Setting a CSP just for one site can be a pain in the a** even when it is done by the people maintaining it. Even if you know your site well, it is not trivial to know exactly what domains things are loaded from. Make one mistake, and boom, you break something in a far off corner that you might not even notice.

Now imagine that you have to do this for all sites without even knowing how they are built. Will Stack Overflow break if I disable inline JavaScript? I have absolutely no idea. And more importantly, it would take forever to figure out. Now multiply that by thousands to cover all the sites you visit.

I am sure there are creative ways that the user experience could be smoothed out, but in the end this would just be a usability nightmare.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.