Anubis continues to expose new ways people configure webservers

One of the most annoying parts of writing web applications is that in general: you can't trust browsers. But, you have to trust browsers at some level because that's how users interact with your software. As browsers get more capable with APIs like WebUSB, Built-in AI, or other absurd things; administrators want to be able to turn off the features that their web applications don't use. This is the crux of why Content-Security-Policies (CSPs) exist. MaraNormally we avoid acronyms when writing posts like this, but for the purpose of this article when you see "CSP", think "Content-Security-Policy". In general, a CSP disables all browser features and then selectively enables the features the website actually needs. For example (stolen from the Anubis docs): default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; base-uri 'none'; form-action 'self'; This disables all browser…