Re: [spec-reviews] Strawman spec review for upgrade insecure requests (#54)

> +navigational requests will be upgraded if they are in the "upgrade insecure
> +navigations set" for a context.
> +
> +### CLARIFICATION: Violation Reports for Inherited Policy
> +
> +As mentioned in 6.2, there is a security issue if a document is able to get
> +violation reports for cross-origin nested documents (iframes, etc.) which
> +inherit upgrade policy. So if a nested document does not specify its reporting
> +endpoint, do all reports from the nested document get blocked?
> +
> +### IDEA: Cache/Pin Successful Upgrades
> +
> +Thinking about the broader goal of encrypting the web, it would be nice if
> +user agents could remember which subresources have been successfully upgraded
> +through this mechanism. That way, on a page that has not set the CSP header,
> +the known-upgradeable subresources could be upgraded anyway.

I'm hopeful that we can address this via http://w3c.github.io/webappsec/specs/csp-pinning/.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/spec-reviews/pull/54/files#r29022744