canmove, Confirmed users
1,537
edits
Security/CSP/Specification: Difference between revisions
Jump to navigation
Jump to search
→Handling Parse Errors
| Line 443: | Line 443: | ||
==Handling Parse Errors== | ==Handling Parse Errors== | ||
A number of different problems may be encountered while parsing the CSP policy. | A number of different problems may be encountered while parsing the CSP policy. | ||
These parse errors are not <em>policy violations</em>, and any error messages caused by parse errors are separate from the violation report sites may elect to receive when their site's <em>policies are violated</em>, via the report-uri directive. | These parse errors are not <em>policy violations</em>, and any error messages caused by parse errors are separate from the violation report sites may elect to receive when their site's <em>policies are violated</em>, via the report-uri directive. | ||
User Agents SHOULD report parse errors locally in the user agent's error console. | |||
;Unrecognized | ;Unrecognized Directive: If an unrecognized directive (name not recognized) is encountered by a User Agent, the directive and its value are skipped (up to a semicolon or end of header, whichever is first) and the User Agent SHOULD report a warning message to the Error Console stating the unrecognized directive name. | ||
; | ;Unrecognized <tt>options</tt> token: If an unrecognized token is present in the <tt>options</tt> directive value, the User Agent MUST ignore it and SHOULD report a warning message to the Error Console stating the unrecognized token. | ||
; | ;Missing "allow": If the "allow" directive is not present, the User Agent SHOULD report a warning message to the Error Console and MUST assume the directive value "allow none" for the policy. The User Agent MUST enforce the rest of the policy as written (assuming no other policy errors are encountered). | ||
; | ;Directive Syntax Error: When any known directive contains a value that violates [[Security/CSP/Spec#Policy_Language_and_Syntax|CSP syntax]], the User Agent SHOULD report a warning message stating the invalid syntax to the Error Console AND MUST "fail closed" by enforcing the most secure policy, "allow none" for the protected document. | ||
; | ;No Recognized Directives: If no recognized directives are present in the stated policy, the User Agent SHOULD report a warning message to the Error Console stating "invalid policy" AND MUST enforce the policy "allow none" on the protected document. | ||
;Other Parsing Errors: Any other parsing errors not covered here SHOULD cause the User Agent to enforce the policy "allow 'none'". If such a case should arise, the User Agent SHOULD report a descriptive error to the Error Console describing the problem. | |||
=Non-Normative Client-Side Considerations= | =Non-Normative Client-Side Considerations= | ||