Re: CSP sandboxing and workers

On Mon, Jun 2, 2014 at 9:04 AM, Brad Hill <hillbrad@gmail.com> wrote:

> A wider point of possible confusion here - we need to make sure
> developers understand they can't use CSP to enforce restrictions like
> sandboxing on a script file.  (I've had very smart people ask me about
> this in the past - the model of what is a "resource" from the
> browser's internals is not immediately obvious to everyone.)
> (...)
> Among "JavaScript global environment", "document environment",
> "dedicated worker environment", "shared worker
> environment", and "worker environment", where does CSP state live and
> what loads get to influence it?  Maybe a table would be helpful.


+1 to the idea of a table.

While I haven't directly gotten that question, I could definitely see it
coming up, and I know I have had similar confused questions about same
origin that seem to be answered most clearly with a table.