RE: CSP 1.0: relaxing mandated enforcing and monitoring to avoid

But couldn't the server still treat the absence of a request as a trigger
of CSP.

Erlend
------------------------------
From: Fred Andrews
Sent: 14.09.2012 17:12
To: Erlend Oftedal; Adam Barth
Cc: public-webappsec@w3.org
Subject: RE: CSP 1.0: relaxing mandated enforcing and monitoring to avoid



> From: eoftedal@gmail.com
> Date: Thu, 13 Sep 2012 22:12:44 -0700
> To: fredandw@live.com; w3c@adambarth.com
> CC: public-webappsec@w3.org
> Subject: RE: CSP 1.0: relaxing mandated enforcing and monitoring to avoid
...
> But is there really a way of removing the possibility of detecting if
> CSP is implemented? The website could always just have the browser
> visit some pages with CSP enabled and see which requests come through.

Yes, if the reporting is opt-in and violations are reported to the user and
cause
the embedded widget to halt.   Servers would not be able to probe using the
report-only
return channel, and content that tried to trip its own restrictions to
probe the clients
implementation could be detected by the client and alert the user or be
inhibited.

cheers
Fred