Re: CSP: Drop IP-matching? (was Re: [CSP] URI/IRI normalization and comparison) from Brian Smith on 2015-02-05 (public-webappsec@w3.org from February 2015)

From: Brian Smith <brian@briansmith.org>
Date: Thu, 5 Feb 2015 14:13:57 -0800
To: Martin Thomson <martin.thomson@gmail.com>
Cc: Mike West <mkwst@google.com>, Anne van Kesteren <annevk@annevk.nl>, WebAppSec WG <public-webappsec@w3.org>, "Oda, Terri" <terri.oda@intel.com>
Message-ID: <CAFewVt72NCKZdmzWQ=XMitWOam3-AuantT4BZhCFKkhKnyzv3g@mail.gmail.com>

I suggest that you drop IP addresses completely from the syntax for
CSP 2, and open an issue to address this in CSP 3. Implementations can
continue to accept the IP address form if they want, to gather data.
This would expedite the process of finishing CSP 2.

Cheers,
Brian

Received on Thursday, 5 February 2015 22:14:24 UTC