Checkout
Complete your purchase
🚨 Skimmer active. Both connections are carried. The beacon to
evil-cyber-hacker.com is delivered exactly like the real order, because
nothing has been told which destinations are acceptable.
💡 Open DevTools → Network tab before pressing the button to watch which requests leave the browser.
What the allowlist did
The list is just response-origin: this page may talk to itself and nothing else.
The order matches and is carried as normal. The beacon to evil-cyber-hacker.com
matches nothing, so the browser refuses to open the connection and sends a Connection Allowlist
report naming the destination it refused.
A CSP connect-src 'self' would give you the same outcome here. The next three
demos cover the cases where it would not.