CSP, Fetch, and frame-ancestors from Anne van Kesteren on 2014-04-24 (public-webappsec@w3.org from April 2014)

From: Anne van Kesteren <annevk@annevk.nl>
Date: Thu, 24 Apr 2014 17:32:22 +0200
To: WebAppSec WG <public-webappsec@w3.org>
Message-ID: <CADnb78hvUGoBy0fJfeOST3Bw=h9TF8SikwsbA8jm+83FreSS3A@mail.gmail.com>

It's not entirely clear to me how we should model this directive.
http://fetch.spec.whatwg.org/#concept-fetch has a placeholder hook for
CSP now. And as I mentioned before I added request contexts and a link
back to the global environment. Do we also need a pointer to the API
responsible for the fetch? We might need it for priorities in HTTP/2.0
I believe... But maybe there's a better way for this directive?


-- 
http://annevankesteren.nl/

Received on Thursday, 24 April 2014 15:32:49 UTC