Re: Worker Threads and Site Security Policy | Two Possible New Items for Standardization

On 2008-06-25 13:09:43 -0700, Arun Ranganathan wrote:

> 2. Mitigation of XSS (Cross Site Scripting) and CSRF (Cross Site
> Request Forgery) Vulnerabilities.  The idea is to provide a
> mechanism (possibly via HTTP headers, but not necessarily limited
> to HTTP headers) to stipulate a *strict* mode for script
> inclusion via "script src=" and prevention of inline scripts
> altogether.  See Site Security Policy [5].  We encourage 
> discussion about this topic via email.  Will other members of the
> WG engage with Mozilla on this, via additional work items covered
> by the charter of this WG?

Without speaking to the scope question, I think this is an
interesting area of work.  I wonder how it might dovetail with
ideas such as Google's Caja, and more general policy-enabling of
in-browser method invocation models, and would be curious to hear
your views on that.

Regards,
-- 
Thomas Roessler, W3C  <tlr@w3.org>