zlacker

>>pimter+(OP)
I think this is less invasive though. The Google proposal runs before content loaded into the DOM. Which means it can be used to do things like programmatically detect and block code injection like ad blockers.

PATs are purely a server side thing. They don't give this kind of control. And don't perform a signature over the content

>>arianv+M3
PATs give exactly the same control. You could trivially require a PAT on the first page load, before the browser gets to receive any of the content. And header-based protocol can always be converted to a JS-driven protocol just by having the requests be issued from JS.

Content-binding is a necessity for the actual intended use case of these protocols (abuse prevention), but useless for the thing people are afraid of (DRM for the web).