slightlyoff / crisp Goto Github PK

Many folks need this and it should be accessible to humans.

Paypal, HSBC, and other bank/banking sites use a limited number of tightly controlled domains for their SSL-served traffic. It'd be great to either have lists of origins per secured domain or a more generic learning system that enables user's behaviors on domains to create a list of "trusted" origins that are whitelisted in a generated CSP rule (until/unless the rule is over-ridden).

Build a profiler that can run on a per-page/site basis to tell you what resources of what types are needed to enable the current page's behavior (and nothing more).

Data sources for this might include:

• DOM queries for inline scripts/styles
• resource-timing API

...what can we do for web sockets? Anything?