Re: [whatwg/fetch] Add the "speculationrules" destination (PR #1841)

@annevk commented on this pull request.



>     <td>"<code>report</code>"
-   <td rowspan=2>&mdash;
+   <td rowspan=3>&mdash;

I don't think that the usage of `<script>` necessarily implies `script-src`. `script-src` makes sense when the result is script execution, but if we were to use `<script>` for JSON modules or some such it shouldn't use `script-src` but the same thing that the "`json`" destination devolves into. I think the same kind of rationale applies here, which I suspect means `connect-src` in the end.

I know some at Google don't care about the exfiltration angle of CSP, but I don't think we have ever reached agreement on giving up on it, so until we get there I think new fetch contexts should play by the same rules as existing ones.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1841#discussion_r2375524849
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1841/review/3262517132@github.com>