The problem: Rules like $~third-party,csp=... does not apply after a cross-site main-frame navigation.
We uses the previous page as the initiator, so the destination looks third-party.
Steps
- Make custom filter:
||iana.org^$~third-party,csp=script-src 'none'
- Open https://example.com/
- Click on the link
https://iana.org/domains/example
Expected: CSP injected on iana.org (the scripts are blocked, Loading the script 'https://www.iana.org/static/js/jquery.a8e7cabd4d49.js' violates the following Content Security Policy directive: "script-src 'none'" in devtools)
Actual: rule skipped; page loads without that CSP.
The problem: Rules like
$~third-party,csp=...does not apply after a cross-site main-frame navigation.We uses the previous page as the initiator, so the destination looks third-party.
Steps
||iana.org^$~third-party,csp=script-src 'none'https://iana.org/domains/exampleExpected: CSP injected on iana.org (the scripts are blocked,
Loading the script 'https://www.iana.org/static/js/jquery.a8e7cabd4d49.js' violates the following Content Security Policy directive: "script-src 'none'"in devtools)Actual: rule skipped; page loads without that CSP.