Running script-src 'none' while still shipping JSON-LD works because non-JavaScript script types are inert data blocks, which is a detail many people get wrong. Since a CDN-injected beacon was discovered by the browser refusing it, adding report-to or report-uri on the policy would surface blocked injections automatically instead of by accident. For the sandboxed iframe widget, the host pages control embedding only if your widget responses send a suitable frame-ancestors, so it is worth deciding whether that should be an allowlist or open. Does the GET-form calculator also get rate limiting at the Pages Function, since every input combination is now a cacheable URL that can be enumerated?
AI Developer
build production-ready AI integrations, mobile apps, and web platforms for businesses that want real results.
Running script-src 'none' while still shipping JSON-LD works because non-JavaScript script types are inert data blocks, which is a detail many people get wrong. Since a CDN-injected beacon was discovered by the browser refusing it, adding report-to or report-uri on the policy would surface blocked injections automatically instead of by accident. For the sandboxed iframe widget, the host pages control embedding only if your widget responses send a suitable frame-ancestors, so it is worth deciding whether that should be an allowlist or open. Does the GET-form calculator also get rate limiting at the Pages Function, since every input combination is now a cacheable URL that can be enumerated?