Hiding JSON-formatted data in the DOM with CSP enabled · Mathias Bynens

If Content Security Policy is enabled for protection against cross-site scripting attacks (i.e. the unsafe-inline option is not set), the use of inline <script>s is not allowed. In that case, how can we pass server-generated data to the front-end without negatively affecting load time and run-time performance? Introduction A common way to pass server-generated JSON-formatted data to the client so

[efcl]

CSPが有効なときに、サーバが生成したデータをどうやってJavaScriptに渡すか