[integrity]: Origin confusion attacks.

(following Devdatta's good example of splitting off threads)

Ben pointed out that caching might cause problems for CSP, given that the
origin of a resource is important when determining whether it ought be
allowed access. More generally, this sort of attack is pointed out in
section 6.2 of the spec. I've expanded that text in [1] to make the attack
he outlines more clear.

I don't have a good mitigation idea off the top of my head, but I agree
it's something we should worry about.


Mike West <mkwst@google.com>
Google+: https://mkw.st/+, Twitter: @mikewest, Cell: +49 162 10 255 91

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)

Received on Thursday, 9 January 2014 08:15:45 UTC