credentials: 'include'Access-Control-Allow-Credentials и Access-Control-Allow-Origin
document.querySelectorAll('link').forEach((e => t(e)))
function t(e){"text/css"!=e.type&&"stylesheet"!=e.rel||!e.href||new URL(e.href,document.baseURI).origin==location.origin&&fetch(e.getAttribute("href")).then((async t=>{const i=await t.text();let n=Pt.transpileStyleSheet(i,!0);if(n=Pt.transpileStyleSheet(i,!1),n!=i){const t=new Blob([n],{type:"text/css"}),i=URL.createObjectURL(t);e.setAttribute("href",i)}}))}security.ssl.enable_ocsp_stapling
@-moz-document url-prefix("chrome://devtools/content/") {
:root {
--theme-body-font-size: 13px !important;
--theme-code-font-size: 13px !important;
--theme-code-line-height: 1.2 !important;
--monospace-font-family: 'Hack', monospace !important;
}
}
Why aren't physically-local attacks in Chrome's threat model?
[...]
We consider these attacks outside Chrome's threat model, because there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your computer as you, or who can run software with the privileges of your operating system user account.