On Sun, Feb 1, 2015 at 8:55 PM, Daniel Veditz <dveditz@mozilla.com> wrote: > I prefer #2a and #2 would be OK as an interim. I like the consistency of > #1 but worry it will be too inflexible for complex sites; sites can emulate > that effect by adding another site-wide CSP header as traffic goes through > their load-balancer or similar front-end server. > > I don't like the way #3 puts the override power in the hands of the > possibly-injected content. #3a solves that problem but in the end is > equivalent to a wordier #2a. > Ok, it sounds like we're running up on consensus to run with #2 for the moment, and to seriously consider adding a "no-override" directive to allow folks to shoot themselves in the foot in the pursuit of greater security in the future. Thanks! -mike -- Mike West <mkwst@google.com>, @mikewest Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany, Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg, Geschäftsführer: Graham Law, Christine Elizabeth Flores (Sorry; I'm legally required to add this exciting detail to emails. Bleh.)
Received on Monday, 2 February 2015 10:05:28 UTC