Re: CSP 1.1 referrer + meta >= <meta name="referrer"> ?

Le 30/01/2014 16:56, Mike West a écrit :
> On Thu, Jan 30, 2014 at 7:18 AM, David Bruant <bruant.d@gmail.com 
> <mailto:bruant.d@gmail.com>> wrote:
>
>     Le 30/01/2014 16:08, Mike West a écrit :
>
>         The note about conflicting policies remains important,
>         however, for two reasons(...)
>
>     I was speaking of the note currently at "3.2.5.13.1 Processing
>     multiple referrer policies" (because it's uniquely dependent on
>     the existence of <meta name="referrer"> I think). I agree with you
>     that the other parts relating to conflicting policies are important.
>
>
> Hrm. I think that's necessary to define what happens if two CSP 
> headers conflict (e.g. the first sets "referrer always" and the second 
> sets "referrer origin").
oh yes. You're right, my mistake.

> Would adding "or in multiple 'Content-Security-Policy' headers" to the 
> parenthetical in that section be helpful?
Things are good as they are (as far as I'm concerned at least). Sorry 
for the noise.

David