Before I copy/paste a bunch of text to stub out a 'style-nonce' directive for CSP 1.1, I'd like to run something by you lovely folks that I think we've talked about once or twice on the calls. It seems like it could reduce repetition and confusion if we fold nonces or hashes into the existing directives as another type of source expression. As a strawman, how would you feel about rewriting 'script-nonce ABCDEFG' as 'script-src nonce:ABCDEFG'? This would make an "or" relationship with 'script-src' clear on the one hand, and make room for something like 'script-src sha1:...' on the other. I think it would simplify the structure in a nice way, and seems more comprehensible and reusable in general. I'm sure others of you will have ideas about syntax (perhaps it's a bad idea to replicate scheme-like structures... maybe '#' would be a better separator, since it's sometimes read as "hash" anyway), but I'm hoping the general idea is reasonable. -- Mike West <mkwst@google.com>, Developer Advocate Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany Google+: https://mkw.st/+, Twitter: @mikewest, Cell: +49 162 10 255 91
Received on Monday, 18 March 2013 16:05:12 UTC