Re: [CSP2] Large CSP headers

I did not know that used to be there but policy-uri directive is very close
to what I would have recommend.
costs some latency on first access but may be worth it to save the
bandwidth on every request

On Mon, Dec 30, 2019 at 11:04 AM Daniel Veditz <dveditz@mozilla.com> wrote:

> On Mon, Dec 30, 2019 at 7:53 AM Aaron Goldman <goldmanaaron@gmail.com>
> wrote:
>
>> Is it time to seriously consider adding includes to the csp spec
>> Large headers that could be chached if they where included from a URL are
>> becoming a common problem
>>
>
> re-adding it, you mean?
> https://www.w3.org/TR/2011/WD-CSP-20111129/#policy-uri  (Firefox even had
> an implementation but we didn't see much interest in using it at the time.)
>
> The Origin Policy proposal has always had CSP redundancy as one of the
> problems that could be solved. Early days for that spec, though.
> https://github.com/WICG/origin-policy
>
> -Dan Veditz
>
>