- From: Anne van Kesteren <annevk@annevk.nl>
- Date: Mon, 26 May 2014 20:01:30 +0200
- To: Mike West <mkwst@google.com>
- Cc: Sigbjørn Vik <sigbjorn@opera.com>, Daniel Veditz <dveditz@mozilla.com>, Joel Weinberger <jww@chromium.org>, "Oda, Terri" <terri.oda@intel.com>, Michal Zalewski <lcamtuf@coredump.cx>, Egor Homakov <homakov@gmail.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, "Eduardo' Vela" <evn@google.com>
On Mon, May 26, 2014 at 5:13 PM, Mike West <mkwst@google.com> wrote: > 1. The current candidate recommendation (http://w3c.org/TR/CSP) makes it > possible to read the origin of a cross-origin redirect's target (e.g. > `google.com` to `accounts.google.com`) by examining violation reports. Still following along from the sidelines, are we violating http://fetch.spec.whatwg.org/#atomic-http-redirect-handling here? -- http://annevankesteren.nl/
Received on Monday, 26 May 2014 18:01:59 UTC