Talk:Security/CSP/Spec: Difference between revisions
Jump to navigation
Jump to search
(Created page with 'Is there an appropriate forum to discuss this? If so, please post a link. If not, is more misuse of the user-agent header the best way to go, or does handling a certain file t...') |
(Comment on Trailer headers.) |
||
| Line 1: | Line 1: | ||
Allowing the X-Content-Security-Policy header "anywhere" in the response clearly isn't correct-- it must be somewhere in the response *headers*. More importantly, it might be worth explicitly specifying that the header should/must appear in the initial headers and specifically not in TRAILER headers, because otherwise the entire page must be buffered to ensure that the policy is retrieved before the user interacts with the page. | |||
Is there an appropriate forum to discuss this? | Is there an appropriate forum to discuss this? | ||
If so, please post a link. If not, is more misuse | If so, please post a link. If not, is more misuse | ||
Revision as of 16:34, 24 June 2009
Allowing the X-Content-Security-Policy header "anywhere" in the response clearly isn't correct-- it must be somewhere in the response *headers*. More importantly, it might be worth explicitly specifying that the header should/must appear in the initial headers and specifically not in TRAILER headers, because otherwise the entire page must be buffered to ensure that the policy is retrieved before the user interacts with the page.
Is there an appropriate forum to discuss this? If so, please post a link. If not, is more misuse of the user-agent header the best way to go, or does handling a certain file type, a policy file, fall squarely in the realm of the Accept header?