public-webappsec@w3.org from September 2012 by subject

[CSP] Extensions and user script? (Some feedback)

[webappsec] "certificates differ" text in CORS

[webappsec] Agenda for today's WebAppSec WG call

[webappsec] Call for Consensus: Content Security Policy 1.0 to Candidate Recommendation

[webappsec] Major update to UI Safety

Agenda for September 25 Call

Call for Consensus: Content Security Policy 1.0 to Candidate Recommendation

CfC: FPWD of UI Safety Directives for CSP

CORS test status

CSP 1.0 browser compliance testing

CSP 1.0: relaxing mandated enforcing and monitoring to avoid

CSP 1.0: relaxing mandated enforcing and monitoring to avoid probing and to avoid content being written to depend on CSP.

CSP 1.1: Paths in source list definitions.

CSP connect-src and browser plugins

CSP Sandbox directive and meta tag - CSP 1.1

Feedback on the Content Security Policy 1.0

Interaction of CSP and IRIs

ISSUE-6 comments addressed

New clickjacking research published

Regrets 9/25

Regrets for today's call.

script-tag with html template-content

some further Comments on Content Security Policy 1.0 Editor's Draft

test

UI Safety - input protection obstruction check challenges

unsafe-inline for style-src

Web Crypto WG - Web Crypto API going to FPWD

webappsec-ISSUE-16 (CSP informs client, cannot restrict it): Editorial: CSP cannot dictate client behavior, only inform it

webappsec-ISSUE-17 (Extension compat): CSP should take into account extensions which modify content

webappsec-ISSUE-18 (CSP as risk assessment score): Use CSP to report app risk and compatibility with user specified restrictions

webappsec-ISSUE-19 (Interaction of CSP and IRIs): How are non-ASCII characters handled in CSP

Last message date: Saturday, 29 September 2012 04:06:06 UTC