public-webappsec@w3.org from June 2014 by subject

"Mixed Content" draft up for review - HSTS interworking

"Mixed Content" draft up for review - HSTS primary purpose

"Mixed Content" draft up for review.

[blink-dev] Proposal: Prefer secure origins for powerful new web platform features

[blink-dev] Re: Proposal: Prefer secure origins for powerful new web platform features

[Bug 26061] New: Improve consistency with CSP 1.1 w.r.t. add-on/extension semantics.

[CSP] Additional report field: report-only: "true|false"

[CSP] enforcement on non text-html resources

[integrity] The noncanonical-src attribute

[MIX] blob URLs

[MIX] Checking parent/top (Re: "Mixed Content" draft up for review.)

[MIX] Comments on draft Mixed Content spec

[MIX] localhost should not be trusted

[MIX]: "Assumed"/"Proven" Terminology.

[MIX]: "Assumed"/"Proven" Terminology. (Re: [MIX]: Expand scope beyond TLS/non-TLS)

[MIX]: 'allow-from' header? (Re: "Mixed Content" draft up for review.)

[MIX]: Can we distinguish between images loader via `<picture>`/`srcset` and `<img>`?

[MIX]: Expand scope beyond TLS/non-TLS (Re: "Mixed Content" draft up for review.)

[MIX]: Move specifics to a non-normative section/document? (Re: "Mixed Content" draft up for review.)

[webappsec] Help build the CSP test suite at Test the Web Forward Portland, August 3

[webappsec] Teleconference Agenda: 04-Jun-2014

[webappsec] WebAppSec WG Teleconference Agenda 18-June-2014

Agenda, 5 June 2014 SVG WG / WebAppSec WG telcon

Call for Exclusions (Update): Subresource Integrity

CfC to publish a LCWD of CSP 1.1

CfC to publish FPWD of Mixed Content.

CORS and null

CSP sandboxing and workers

CSP wildcard host matching

CSP, Fetch, and frame-ancestors

CSP: 'no-external-navigation'?

CSP: Block redirects by default?

CSP: Problems with referrer and reflected-xss

Discuss SVG and CSP for the June 5 SVG teleconference

Header Policy Vs. Meta tag policy

Isolated Web Components for a more secure web

ISSUE-61: Should we mark referrer and reflected-xss as at risk in csp 1.1 lcwd?

Naming things: CSP 1.1 -> CSP level 2?

PFWG comments on User Interface Security Directives for Content Security Policy

Proposal: Prefer secure origins for powerful new web platform features

Reducing reporting noise

Regrets ( [webappsec] WebAppSec WG Teleconference Agenda 18-June-2014 )

Remove paths from CSP?

Standardize referrer policy

webappsec-ISSUE-62: is reflected-xss at risk?

Last message date: Monday, 30 June 2014 23:11:37 UTC