2

In HTTP protocol, there is so called Content Security Policy (CSP) that (among other things) allows the creator of a site to disallow browsers to put the site framed inside another site. All mainstream browsers abide this "command" of the creator of a site.

Is bypassing CSP (it can be done through a specifically crafted proxy server that removes or changes CSP) illegal (in the US and in Europe)? Note that changing HTTP headers by proxies is a common practice.

I have an argument that it is legal: If I put another site inside my frame (plus buttons like Forward/Backward), then I just create a new WWW browser (running inside another browser) and creating browsers is not disallowed. Is this a valid argument?

porton
  • 267
  • 2
  • 8

1 Answers1

3

No. CSP is a suggestion to browsers to implement some security checks. Bypassing CSP is no more illegal than using a browser that doesn't support it.

520
  • 344
  • 1
  • 4