- From: Sid Stamm <sid@mozilla.com>
- Date: Fri, 1 May 2015 08:22:20 -0400
- To: Anne van Kesteren <annevk@annevk.nl>
- Cc: Mike West <mkwst@google.com>, Jochen Eisinger <eisinger@google.com>, WebAppSec WG <public-webappsec@w3.org>
This all sounds to me like a good direction. 1. Align referrer policy with CSP propagation and reuse 2. make sure about:blank inherits. How do we best capture this in the spec? Would it make sense to actually call out that it's inherited with *any* inherited script security context, or address about:blank specifically? -Sid On Thu, Apr 30, 2015 at 4:45 AM, Anne van Kesteren <annevk@annevk.nl> wrote: > On Tue, Apr 28, 2015 at 4:35 PM, Mike West <mkwst@google.com> wrote: >> I think that logic would have to carry across to new documents created via >> `window.open`. Until that context navigates, it's fairly indistinguishable >> from the context that created it. > > Note that > > <a href=http://example.com/ target=_blank> > > is fairly indistinguishable from that case and we should inherit there > too. Because indeed, an about:blank context is created for which no > meaningful policy is set. So it better match the one from its creator > otherwise you have a way out. > > > -- > https://annevankesteren.nl/
Received on Friday, 1 May 2015 12:22:50 UTC