[w3ctag/design-reviews] W3C TAG: Review different cross-domain import mechanisms and their security models (#446)

During #TC39 73 I’ve learned about ES Modules Attributes being proposed to address security concerns when importing JSON modules: [ES Module Attributes](https://github.com/littledan/proposal-module-attributes/). Filing this design issue for the TAG to more broadly consider various web-based cross-domain import mechanisms like [HTML Modules (334)](https://github.com/w3ctag/design-reviews/issues/334), [CSS Modules (405)](https://github.com/w3ctag/design-reviews/issues/405), and ES Modules. Specifically I request the TAG analyze and provide clarity on the exact security model or models and hopefully some degree of consistency and explicit architectural design across these mechanisms.

See the following related issues and efforts:

  * [webcomponents: HTML, CSS, and JSON modules shouldn't solely rely on MIME type to change parsing behavior #839](https://github.com/w3c/webcomponents/issues/839)
  * [Dynamic Import Host Adjustment presentation Dec 2019](https://docs.google.com/presentation/d/e/2PACX-1vQHJ-7kiplN7pzQD-GXv9icz-ySJnoMVVfGbI74oDKaeSAMdgZ3aySOR-80JGMt4Lb5oCgJ-e-BeEet/pub?start=false&loop=false) ([Explainer](https://github.com/tc39/dynamic-import-host-adjustment))



From a web author, developer, publisher perspective, a more consistent and understandable security model across these would help with easier understanding and better chance of conveying author intent. Thanks for your consideration!

(Originally published at: https://tantek.com/2019/339/b1/cross-domain-import-mechanisms-security)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/446