Reining in the web with content security policy
Defeating script injection attacks with browser-enforced embedded policies