Re: [w3ctag/design-reviews] Incubation: Connection Allowlists (Issue #1173)

mikewest left a comment (w3ctag/design-reviews#1173)

> 1. This is great!! Thanks for working on this!

🥳 

> 2. I'm assuming the feature is supposed to work in workers, and its HTML integration suffers from [WorkerGlobalScope policies not fully converted to policy containers whatwg/html#11316](https://github.com/whatwg/html/issues/11316), so it's not necessarily well-defined.

The assumption is that we'll do the same thing for workers that CSP does; each worker will have its own policy, and local-scheme workers will inherit from their creation context. So, yes. It depends on Policy Container working, and if it isn't wired up, we should add some wires.

> 3. For dns-prefetch leaks, it seems like this should also integrate with https://html.spec.whatwg.org/#link-type-dns-prefetch. Similarly, there's https://html.spec.whatwg.org/#link-type-preconnect

Both of those end up routing through Fetch (Step 4 of https://html.spec.whatwg.org/multipage/links.html#link-type-dns-prefetch and step 8 of https://html.spec.whatwg.org/multipage/links.html#preconnect), so I think the integration is already well-defined. There are absolutely bits of the platform that aren't defined through Fetch (WebRTC as a standout example), and we'll certainly need to update the spec and implementation as we run into them. I haven't done that work yet, mostly hoping that folks can provide feedback on the mechanism in itself, assuming that we do reasonable integrations along the way.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1173#issuecomment-3810408555
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1173/3810408555@github.com>