Re: webRTC and Content Security Policy connect-src

I think that this is something that should be solved by listing allowed
identity providers in CSP. If remote session description was validated by
one of the listed identity providers, then browser is allowed to start
setting up the connection. Without identity webrtc is a wide open barn door
which will allow malicious JavaScript to create a side channel regardless
of what you do.

Regards,
_____________
Roman Shpount