Don't recommend "Deny by default" when prefetch-src is experimental

mozilla / http-observatory

Mozilla HTTP Observatory

https://observatory.mozilla.org/

Mozilla Public License 2.0

1.85k stars 168 forks source link

Open carlin-q-scott opened 2 years ago

carlin-q-scott commented 2 years ago

The following recommendation has to be ignored if a site prefetches resources:

Deny by default, using default-src 'none'

I can specify my prefetch-src for Chrome, but Firefox doesn't support that directive, so it falls back to default-src.