W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2015

Re: CSP2: Drop 'unsafe-redirect'.

From: Anne van Kesteren <annevk@annevk.nl>
Date: Thu, 2 Jul 2015 13:00:02 +0200
Message-ID: <CADnb78g95-k0E1CyHY1Xh_x4-i4OjrOowMSD=w_nZziOZCyrfQ@mail.gmail.com>
To: Mike West <mkwst@google.com>
Cc: Brian Smith <brian@briansmith.org>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Wendy Seltzer <wseltzer@w3.org>, Brad Hill <hillbrad@gmail.com>, Dan Veditz <dveditz@mozilla.com>
On Thu, Jul 2, 2015 at 12:24 PM, Mike West <mkwst@google.com> wrote:
> Actually, you know what: you're right. I forgot that we changed this
> behavior as well: the report ought to contain the initially requested URL,
> rather than the URL on which the request finally landed (see
> http://www.w3.org/TR/CSP2/#violation-report-blocked-uri). I know Chrome
> doesn't do this yet, but it ought to. I should also have listed it in the
> breaking changes section of the spec. I'll add that now.

Great, I think that means we maintain all invariants
https://fetch.spec.whatwg.org/#atomic-http-redirect-handling cares

Received on Thursday, 2 July 2015 11:00:28 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:49 UTC