- From: Anne van Kesteren <annevk@annevk.nl>
- Date: Thu, 30 Jul 2015 12:11:36 +0200
- To: Mike West <mkwst@google.com>
- Cc: Brian Smith <brian@briansmith.org>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Wendy Seltzer <wseltzer@w3.org>, Dan Veditz <dveditz@mozilla.com>, Brad Hill <hillbrad@gmail.com>
On Thu, Jul 30, 2015 at 12:01 PM, Mike West <mkwst@google.com> wrote: > That said, it doesn't seem to me that the property we're looking for > actually conflicts with "destination context". Aren't they the same thing? > That is, they both seem to say "Go execute Fetch. Oh, and by the way, we > intend to use the response in this particular way." Well, except the idea with "destination context" was that we'd only use it for prioritization and `Accept` header initialization. Not security checks. Since otherwise I could fetch something in a document and bypass connect-src by saying it's for an "image" and then feed the response to a <script>. Or some such. -- https://annevankesteren.nl/
Received on Thursday, 30 July 2015 10:12:05 UTC