public-webappsec@w3.org from February 2013 by date

Thursday, 28 February 2013

Re: CORS: Requirement for HTTP 200 response on preflight is not web-compatible and doesn't seem to be interoperably implemented Odin Hørthe Omdal
Re: CORS: Requirement for HTTP 200 response on preflight is not web-compatible and doesn't seem to be interoperably implemented Boris Zbarsky
Re: CORS: Requirement for HTTP 200 response on preflight is not web-compatible and doesn't seem to be interoperably implemented Bjoern Hoehrmann
Re: CORS: Requirement for HTTP 200 response on preflight is not web-compatible and doesn't seem to be interoperably implemented Boris Zbarsky
Re: CORS: Requirement for HTTP 200 response on preflight is not web-compatible and doesn't seem to be interoperably implemented Odin Hørthe Omdal
Re: CORS: Requirement for HTTP 200 response on preflight is not web-compatible and doesn't seem to be interoperably implemented Odin Hørthe Omdal
CORS: Requirement for HTTP 200 response on preflight is not web-compatible and doesn't seem to be interoperably implemented Boris Zbarsky
Re: Restricting <base> URLS via CSP Devdatta Akhawe
Re: Restricting <base> URLS via CSP Alex Russell
Re: Restricting <base> URLS via CSP Devdatta Akhawe

Wednesday, 27 February 2013

Tuesday, 26 February 2013

Re: Action-92: Propose spec text to resolve ISSUE-32 Bjoern Hoehrmann
ISSUE-44: Same-origin policy identity query via script-hash. issue is you do a third party inline script with a known script-hash. if it succeeds, you know that the target was as expected, even though you can't read it Web Application Security Working Group Issue Tracker
Action-92: Propose spec text to resolve ISSUE-32 Daniel Veditz
[webappsec] March 12 teleconference CANCELLED due to conflict with IETF Hill, Brad
[webappsec] minutes available Hill, Brad
RE: Feedback on UI Safety draft Hill, Brad
RE: Agenda for Feb 26 Call Hill, Brad
Feedback on UI Safety draft David Ross
Agenda for Feb 26 Call Eric Rescorla

Sunday, 24 February 2013

FTC v HTC America Ben Wilson

Friday, 22 February 2013

RE: [webappsec] UI Security, allow-from values David Ross

Tuesday, 19 February 2013

Call for Exclusions (Update): User Interface Safety Directives for Content Security Policy Ian Jacobs
[CORS] list max-age as algorithm parameter Pellerin, Clement

Saturday, 16 February 2013

Re: CSP script hashes Bryan McQuade

Friday, 15 February 2013

RE: Why no fragment part in CSP-report document-uri? Hill, Brad
[Bug 21013] New: Credentials and HTTP authentication bugzilla@jessica.w3.org
[Bug 21012] New: Add more text on Vary bugzilla@jessica.w3.org

Thursday, 14 February 2013

[CORS] typos Pellerin, Clement
Re: Do we need Connectors between javascript and security software at personal device? Daniel Veditz
Do we need Connectors between javascript and security software at personal device? Mountie Lee

Wednesday, 13 February 2013

Proposal for script-hash directive in CSP 1.1 Nicholas Green
Re: Why no fragment part in CSP-report document-uri? John Wilander
Why no fragment part in CSP-report document-uri? John Wilander
RE: CSP script hashes Hill, Brad
W3C account Nicholas Green
Re: CSP script hashes Bryan McQuade
[webappsec] WG satisfaction survey Hill, Brad

Tuesday, 12 February 2013

Re: No scheme in policy: Errors for either scheme Daniel Veditz
Re: No scheme in policy: Errors for either scheme Neil Matatall
RE: CSP script hashes =JeffH
Re: No scheme in policy: Errors for either scheme Adam Barth
Re: No scheme in policy: Errors for either scheme Neil Matatall
No scheme in policy: Errors for either scheme Neil Matatall
Re: ISSUE-32: Do we specify that path-specificity applies only to hierarchical URI schemes? Adam Barth
Re: ISSUE-38: Discuss no-mixed-content directive Neil Matatall
[webappsec] UI Security, allow-from values Hill, Brad
Re: ISSUE-38: Discuss no-mixed-content directive Daniel Veditz
Re: CSP script hashes Eric Chen
RE: CSP script hashes Hill, Brad
Re: CSP script hashes Nicholas Green
[webappsec] Agenda for 12-Feb-2013 WebAppSec Teleconference Hill, Brad
Re: CSP script hashes Bryan McQuade
Re: CSP script hashes Jacob Hoffman-Andrews
Re: CSP script hashes Ian Melven
Re: CSP script hashes Bryan McQuade
Re: CSP script hashes Jacob Hoffman-Andrews
Re: CSP script hashes Bryan McQuade
Re: CSP script hashes Jacob Hoffman-Andrews
Re: CSP script hashes Yoav Weiss
Re: CSP script hashes Mountie Lee
RE: CSP script hashes Hill, Brad
Re: CSP script hashes Mountie Lee
Re: CSP script hashes Bryan McQuade

Monday, 11 February 2013

Sunday, 10 February 2013

Help needed (or not?) (was ISSUE-27: Implementation concern on how to enforce display-time : should we provide more advice on how to do this efficiently?) Giorgio Maone

Friday, 8 February 2013

CSP and inline styles Ian Melven

Tuesday, 5 February 2013

Re: Blank blocked-uris Neil Matatall
RE: ISSUE-38: Discuss no-mixed-content directive Neil Matatall
Re: Blank blocked-uris Mike West
Blank blocked-uris Neil Matatall

Saturday, 2 February 2013

Re: [webappsec] Handling custom elements in CSP Adam Barth

Friday, 1 February 2013

Re: CSP script hashes Yoav Weiss
Re: CSP script hashes Eric Chen
Re: CSP script hashes Nicholas Green
Re: CSP script hashes Eric Chen
Re: CSP script hashes Nicholas Green
Re: CSP script hashes Eric Chen
CSP script hashes Nicholas Green
webappsec-ISSUE-43 (Custom Elements in CSP 1.1): How are custom elements handled in CSP 1.1? [CSP 1.1] Web Application Security Working Group Issue Tracker
webappsec-ISSUE-42 (CSS Nonce): Script-nonce allows inline script, similar treatment for inline css? Web Application Security Working Group Issue Tracker
[webappsec] Handling custom elements in CSP Hill, Brad

Last message date: Thursday, 28 February 2013 21:19:02 UTC