Comment by maxwellg

For extra security, an intermediary can set Content Security Policy (CSP) headers that instruct browsers to only connect to certain domains. CSP headers aren't a total solution, but they're a good tool in the toolkit for redundancy against exfiltration.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...