Re: Beacon and CSP

Hi,


> I'd talked with Mario about this at some point in the past, and suggested
> `form-action` for both <a ping> and Beacon. I'd be fine with `connect-src`
> as well.
>
> Generally, I agree that both ought to be goverened by CSP. Beacon much
> moreso than <a ping>.
>
>
form-action seems like another reasonable suggestion since beacon can
essentially do a form POST (except subject to CORS). I think it adds too
much complexity to try and do something like use a different directive
based on the type of data being sent.

thanks for the thoughts, Mike !

ian