Re: Proposal to remove the 'frame-action' directive from CSP 1.1

>
> I'd also note that combining `form-action` with the proposal for more
> granular (directory level) sources would make the directive more effective
> than the paper presupposes. Authors would have the ability to lock a page
> down to submitting forms to specific recipients on their own origin, which
> would be a fairly powerful defense.
>

I'm not sure if I understood this correctly, wouldn't "all" forms be
whitelisted? Assume youtube.com has a comment section that can be used to
exfiltrate data. This comment section has to on the whitelist if
youtube.comwants users to post comments at all.


-- 
-Eric