Re: [heycam/webidl] Define the `[CrossOriginIsolated]` extended attribute. (#883)

> I think my suggestion still allows inversion: `[Context=Insecure]` or such.

That's fair. I think the inversion is clearer as distinct attributes, but it certainly works as `[Context=UnsafelyExposedToNetworkAttackers]` or something similar. I can certainly live with that spelling.

That said, let's go back to your suggestion that:

> ... we can have only one check: whether descendants have `[Context]` or not.

This works for secure transport and cross-origin isolation, as the latter implies the former. Injection mitigation is currently orthogonal, evaluating whether a CSP is present, not whether the context is securely delivered. Perhaps we'd say that any contextual exposure would require secure contexts?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/heycam/webidl/pull/883#issuecomment-627999924