9
edits
Talk:Security/CSP/Spec: Difference between revisions
Jump to navigation
Jump to search
added concerns from reading the spec.
No edit summary |
(added concerns from reading the spec.) |
||
| Line 1: | Line 1: | ||
Is there an appropriate forum to discuss this? | Is there an appropriate forum to discuss this? | ||
If so, please post a link. If not, is more misuse | If so, please post a link. If not, is more misuse | ||
| Line 7: | Line 5: | ||
squarely in the realm of the Accept header? | squarely in the realm of the Accept header? | ||
"No inline JavaScript will execute" should probably be generalized to "No inline script will execute" as there are a number of different script-protocol handlers in different browsers, and most browsers have the ability to host script other than JavaScript. | "No inline JavaScript will execute" should probably be generalized to "No inline script will execute" as there are a number of different script-protocol handlers in different browsers, and most browsers have the ability to host script other than JavaScript. -EricLaw | ||
Allowing the X-Content-Security-Policy header "anywhere" in the response clearly isn't correct-- it must be somewhere in the response *headers*. More importantly, it might be worth explicitly specifying that the header should/must appear in the initial headers and specifically not in TRAILER headers, because otherwise the entire page must be buffered to ensure that the policy is retrieved before the user interacts with the page. -EricLaw | |||
Currently "JavaScript Uris" are restricted by both the "inline" and "eval" rules. This makes it unclear as to which I must allow to permit JavaScript URIs. -EricLaw | |||
Rather than using the term "host" and "source" would it be more accurate to replace all instances with "HTML5 Origin"? This term has a defined meaning and would remove ambiguity in cases (like report-uri) which are currently defined as both "same host" and "same source". -EricLaw | |||
What MIME-type is used when sending the Report XML? -EricLaw | |||
Should the HTTP header syntax allow a "Final" directive to force ignoring META tag declarations? -EricLaw | |||
Shouldn't "object-src" allow restrictions on what TYPES of objects are allowed, rather than just which hosts are allowed? -EricLaw | |||
Should there be a "font-src" restriction? -EricLaw | |||
The Host Expression List should describe exactly what types of wildcarding are permitted. For instance, can a * represent more than one DNS label? Can * appear in the middle or end of a string? -EricLaw | |||
"self" is defined as the scheme/host/port (origin) in the prose, but the flowchart defines it as document.domain. Which is it? -EricLaw | |||