Re: Including the Javascript stack trace in the ContentSecurityPolicy report from Boris Zbarsky on 2013-08-02 (public-webappsec@w3.org from August 2013)

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Fri, 02 Aug 2013 10:09:49 -0400
To: public-webappsec@w3.org
Message-ID: <51FBBDAD.8000508@mit.edu>

On 8/2/13 9:29 AM, Henry Wong wrote:
> Is there a particular
> reason not to include the stack trace other than that it might not
> always be relevant?

It's a significant burden on implementations to do it, especially 
without killing performance.  Because loads are async, any operation 
that might start a load has to eagerly save the stack trace just in case 
the load will later fail a CSP check...

-Boris

Received on Friday, 2 August 2013 15:25:12 UTC