Beacon and CSP

Hi,

i was wondering if those on the list have opinions on the interaction
between the recently proposed
W3C Beacon spec (
https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/Beacon/Overview.html) and
CSP

The navigator.sendBeacon API makes a same-origin or cross-origin (with the
requisite CORS check) POST request
asynchronously. It can send arbitrary data in the form of
an ArrayBufferView, Blob, DOMString, or FormData
(possibly subject to encoding/conversion).

Should this POST request be possibly restricted by CSP and if so which
directive would apply ? I would
propose "yes, CSP should apply, using connect-src" as a strawman. I know
others may disagree, see
https://bugzilla.mozilla.org/show_bug.cgi?id=936340#c17 for some examples :)

thank you for your thoughts and consideration.

ian

Received on Wednesday, 15 January 2014 18:17:06 UTC