[z3c0]

> Unfortunately NoScript has a limitation that you can't tell it to "only TRUST javascript from example.com when I'm visiting example.com"

I was under the impression that the custom option allowed this. Am I misunderstanding the point of this option?

[zodzedzi]

I see "Custom" allowing you to choose which elements (frame, fonts, etc.) to allow/block for the domain you're configuring.

But it doesn't offer the ability to say "apply these settings to the domain example.com only when I'm visiting example.com, and not when I'm visiting anotherexample.com which happens to load JS from example.com".

[z3c0]

Maybe I'm still misunderstanding, but when configuring the domain in the custom settings, it does allow you to limit the custom rules to only the site you're currently on, via the "Enable these capabilities when top page matches" dropdown. The default is "ANY SITE".

[zodzedzi]

I don't see any of these options in my plugin. I have NoScript 10, and it looks like there is a NoScript 11 out there; is that what you have? Maybe the feature was introduced in 11 and I'm missing that update; checking their changelog now...

Edit: Correction - I do have NoScript 11; but don't see those options.

[z3c0]

I think you nailed it - I am indeed on 11. So good news! It looks like NoScript is attentive to user needs.

Edit: seeing your edit - the plot thickens. I'm on 11.4.4 - any difference there?

[zodzedzi]

I had 11.2.11.

And you're right, according to their changelog [1], they added it in 11.3.

>> v 11.3rc1 + Contextual policies (different capabilities for the same origin, depending on the top-level domain) configurable in the CUSTOM panel (thanks NLnet for financial support)

Woohoo!

Thanks for following up and making me look, I now have a better setup!

[1] https://noscript.net/changelog/

[z3c0]

Glad I could help! I would hate for someone to miss out on what has so far been my favorite feature of NoScript.