Re: Remove paths from CSP?

On Mon, May 26, 2014 at 5:13 PM, Mike West <mkwst@google.com> wrote:
> 1.  The current candidate recommendation (http://w3c.org/TR/CSP) makes it
>     possible to read the origin of a cross-origin redirect's target (e.g.
>     `google.com` to `accounts.google.com`) by examining violation reports.

Still following along from the sidelines, are we violating
http://fetch.spec.whatwg.org/#atomic-http-redirect-handling here?


-- 
http://annevankesteren.nl/

Received on Monday, 26 May 2014 18:01:59 UTC