Re: On the Insecurity of Whitelists and the Future of CSP

On 9/8/16 6:10 AM, Mike West wrote:
> What syntax issue do we need to discuss? If there are remaining syntax
> questions, we should resolve them quickly, as Chrome is shipping what's
> currently in the spec, and Google sites are beginning to rely on the
> currently specified behavior. :)

I'm uncomfortable with the multilayered "ignore this if that" within a
single directive; it will be especially confusing to developers to have
an ignored whitelist of sites. It would be clearer, and more flexible in
the future if we need to add options or restrictions on
'strict-dynamic', to have a separate directive which overrides
'script-src' in UAs that understand it (as script-src itself overrides
default-src).

Because we may want other dynamic types in the future, and to help
indicate what it's overriding, we would want to rename it to
'dynamic-script' or something.

-Dan Veditz

Received on Thursday, 8 September 2016 15:50:57 UTC