Re: Fetching contexts from Boris Zbarsky on 2013-06-20 (public-webappsec@w3.org from June 2013)

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Thu, 20 Jun 2013 10:17:54 -0400
To: Anne van Kesteren <annevk@annevk.nl>
CC: Gordon Hemsley <me@gphemsley.org>, Adam Barth <w3c@adambarth.com>, WebAppSec WG <public-webappsec@w3.org>
Message-ID: <51C30F12.3030101@mit.edu>

On 6/20/13 3:27 AM, Anne van Kesteren wrote:
> It seems XMLHttpRequest is connect-src.

OK.

> Workers are covered by script-src.

Is that actually specified somewhere?

> HTML component imports are covered by script-src (for
> now).

Likewise.

-Boris

Received on Thursday, 20 June 2013 14:18:32 UTC