Re: CSP and PostMessage?

On 19 December 2011 06:01, Daniel Veditz <dveditz@mozilla.com> wrote:

> On 12/15/11 3:05 PM, Devdatta Akhawe wrote:
> > Has a post-message-src directive being considered? From the
> > introduction in the specification:
>
> I don't recall any discussions about it. Since postMessage() can
> already be used safely I'm not feeling a burning need for it, but
> maybe you can convince us.
>

There is no way to prevent an outgoing request, you can check the incoming
request and ensure it was from the domain you intended but an attacker
controlled postMessage request can be sent to any external domain so I
think it would be useful to have control over it in CSP.