W3C home > Mailing lists > Public > public-webappsec@w3.org > February 2015

Re: CSP: Drop IP-matching? (was Re: [CSP] URI/IRI normalization and comparison)

From: Anne van Kesteren <annevk@annevk.nl>
Date: Thu, 5 Feb 2015 23:42:42 +0100
Message-ID: <CADnb78gAGoAO7sOfRA+pR++y_Uu9Q3JVX4soH3qxgv21X5_-Xg@mail.gmail.com>
To: Martin Thomson <martin.thomson@gmail.com>
Cc: Mike West <mkwst@google.com>, WebAppSec WG <public-webappsec@w3.org>, "Oda, Terri" <terri.oda@intel.com>
On Thu, Feb 5, 2015 at 10:27 PM, Martin Thomson
<martin.thomson@gmail.com> wrote:
> On Feb 5, 2015 6:30 PM, "Mike West" <mkwst@google.com> wrote:
>> I'm just thinking of normal websites that load data from servers via IP
>> addresses rather than named hosts. I don't think that's something we
>> particularly want to encourage, but neither is it something that I'd be
>> surprised to see substantial numbers of sites doing today.
> Those won't be serving over https.

Why not? CA/B's BR only forbid private IP addresses per some date. I
don't think there's anything said or done about public IP addresses.

Received on Thursday, 5 February 2015 22:43:06 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:46 UTC