public-webappsec@w3.org from October 2013 by subject

'referrer' directive strawman.

[Bug 23653] New: Advice on CORS and caches

[Bug 23654] New: Point out that Access-Control-Allow-Origin:* is safe for servers not behind a firewall

[CORS] Clarifying the term "user credentials"

[webappsec] Agenda for 8-Oct-2013 Teleconference

[webappsec] Handling unsafe UI events

[webappsec] ISSUE-53: UISecurity input-protection heuristic for composited rendering

[webappsec] new editor's draft of UISecurity

[webappsec] New SVG examples for UISecurity obstruction check

[webappsec] POLL: Getting CSP 1.1 to LCWD

[webappsec] Reminder: please send your preferences

[webappsec] UISecurity input protection: same origin or same document?

[Workers] CSP and SharedWorkers

Actual Poll vote (was: Reminder: please send your preferences (was: POLL: Getting CSP 1.1 to LCWD))

Actual vote and regrets (was Re: [webappsec] POLL: Getting CSP 1.1 to LCWD)

Agenda for October 22, 2013 Teleconference

Are CSP directives case insensitive?

Behavior when default-src is missing from a CSP

Content-Security-Policy: referrer always

CSP and cookie header management

CSP script hashes, inline and src'd

ERRATA CORRIGE Actual vote and regrets (was Re: [webappsec] POLL: Getting CSP 1.1 to LCWD)

FYI: RFC 7034 on HTTP Header Field X-Frame-Options

proposal: move frame-options directive out of UI safety spec into CSP 1.1

Reminder: Recharter out for review through Oct. 21

RFC 7034 on HTTP Header Field X-Frame-Options

Scripts from Strings: Where is the line?

Updated script hash proposal (non spec text)

webappsec-ISSUE-55 (input-protection and seamless iframes): How to handle seamless flag for input-protection policies? [UI Security]

Last message date: Thursday, 31 October 2013 18:19:42 UTC