Re: [CSP] feedback report-uri directive and report-only header

Related question. Is there a limit to how many report-uris in a CSP policy
will be considered valid? If there is not, should there be?

Seems that without any upper limit we may be leaving the door open for
shenanigans.


On Thu, Aug 21, 2014 at 9:44 AM, Hill, Brad <bhill@paypal.com> wrote:

>  Stefan,
>
>
>
> 1. Both relative paths or fully-qualified URLs with a scheme, host and
> port are allowed for report-uri.
>
> 2. In the future we expect that there may be alternate methods to announce
> violations other than report-uri, such as a DOM API.  In the meantime, if
> you can’t enforce that there’s a valid listener at a uri, it doesn’t gain
> much to enforce that a uri is present.
>
>
>
> -Brad
>
>
>
> *From:* Stefan Ossendorf [mailto:stefan.ossendorf@outlook.de]
> *Sent:* Thursday, August 21, 2014 9:36 AM
> *To:* public-webappsec@w3.org
> *Subject:* [CSP] feedback report-uri directive and report-only header
>
>
>
> Hello,
>
>
>
> I have two questions:
>
>
>
> 1. report-uri directive
>
> According to
> https://w3c.github.io/webappsec/specs/content-security-policy/#set-of-report-uris
>
> Quote: “The set of report URIs is the value of the report-uri directive,
> each resolved relative to the protected resource’s URI.”
>
> Does relative means really relative or just “resolve the uri”?
>
>
>
> 2. report-only-header
>
> Why is no report-uri directive enforced within a report-only-header?
>
>
>
> Thanks
>
> -Stefan
>



-- 
Caleb
571-228-8011