Verify the CSP header

[gjedeer]

Another thing which the add-on has to check is the CSP header. Because if it does not validate it too, JS could just be added as inline-code. And the add-on has to make sure that all script tags have an integrity attribute (could be done with PrivateBin/PrivateBin#82 if implemented).

[rugk]

I'd say we split this issue. This here for the CSP header detection and I'll create a new one for the forced integrity attribute verification.

[rugk]

What must be verified:

• that script-src is given and it only allows 'self'
• OR (less restrictive) that script-src must not include any unsafe-* value

All other things are as I see it optional security enhancements by the web admin and should not jeopardize the JS security.