Expired90% confidenceEventTime unknown
Simon Willison released an experimental tool called CSP Allow-list Experiment, demonstrating running application code in a CSP-protected sandboxed iframe and implementing dynamic domain authorization.
1
Sources
90%
Confidence
Medium-term (~90 days)
Relevance
6/1/2026
First Seen
Valid until: 8/30/2026(expired)
Sources
Related Entities
Related Claims
UnverifiedThe experiment transforms CSP from a silently blocking background mechanism into a user-perceptible and user-participatory security decision process, applicable to scenarios such as online code editors, plugin extension systems, and web security teaching tools.69% similarUnverifiedCSP Level 2引入了nonce（一次性随机令牌）和hash（脚本内容哈希）机制，允许开发者在不依赖域名白名单的情况下精确授权特定内联脚本的执行67% similarUnverifiedCSP Level 3引入了strict-dynamic指令，使得被信任脚本动态加载的子脚本也能自动获得执行权限65% similarUnverified防范意外代码执行的工程实现包括将生成代码放入隔离沙箱运行，如Docker配合seccomp安全配置文件通过系统调用白名单约束容器内进程能力63% similarUnverifiedDSPy, developed by the Stanford NLP group, abstracts the entire LLM pipeline into a modular program where each module declares input and output signatures, and the framework is responsible for automatically generating, evaluating, and optimizing prompts.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/27060API
curl https://kongchang.com/api/v1/knowledge/claims/27060MCP
get_claim(id=27060)