wtf( )unctionsystem design, drawn
← all problemsBrowser SecurityHard

A policy that allows a bypass

The page ships a content policy listing every host it loads scripts from — its own domain, a CDN, an analytics vendor, a tag manager. It took a week to compile and it blocks nothing.

One of those allowlisted hosts serves an endpoint that will execute whatever a caller asks it to. The policy permits that host, so an injection loads a script from it and the browser is satisfied.

Replace the basis on which a script is trusted.
Components — tap one, then tap a slot on the diagram
!An injected script loaded from an allowlisted host and the policy permitted it.

Outside every boundary: Your page, Your own scripts, Allowlisted host (serves a callable endpoint; FAILED: usable as a bypass), an empty slot for the what makes a script trusted Connections: Your page controls what makes a script trusted — trust rule (step 1) what makes a script trusted calls Your own scripts — carries the value (step 2) what makes a script trusted must NOT reach Allowlisted host — no value, no execution

Your page
Your own scripts
Allowlisted hostserves a callable endpointusable as a bypass