Workers inheriting CSP

Hi folks

The CSP draft currently doesn't mention anything about CSP being
inherited by workers. In particular, a worker's XMLHttpRequest should
be subject to the original document's connect-src (or default-src as
the case may be). Else, it is trivial to bypass connect-src.


Received on Sunday, 27 November 2011 20:51:28 UTC