Web Application Security Working Group - Activity in 2015
No matches.
TR publications
-
2 documents published.
-
Content Security Policy: Cookie Controls published as a First Public Working Draft. History of Content Security Policy: Cookie Controls
-
Content Security Policy: Embedded Enforcement published as a First Public Working Draft. History of Content Security Policy: Embedded Enforcement
-
Participants
-
1 participant joined.
-
Xueyuan Jia (W3C) joined.
-
GitHub
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Allow referrerpolicy attribute on <link> w3c/webappsec-referrer-policy#15, by @igrigorik.
-
-
1 issue received 1 new comment.
-
1 pull request merged.
-
Replace referrer directive with Referrer-Policy header w3c/webappsec-referrer-policy#14.
-
-
1 pull request received 10 new comments.
-
Replace referrer directive with Referrer-Policy header w3c/webappsec-referrer-policy#14 (10 comments by @annevk, @estark37, @jeisinger, @jonathanKingston, @mikewest, @mozfreddyb)
-
w3c/webappsec-subresource-integrity
-
4 issues opened.
-
Add an SRI control as either a CSP directive or a new header w3c/webappsec-subresource-integrity#23, by @joelweinberger.
-
Consider shared caching w3c/webappsec-subresource-integrity#22, by @joelweinberger.
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21, by @shekyan.
-
Consider integrity check violation reporting w3c/webappsec-subresource-integrity#20, by @shekyan.
-
-
2 issues received 3 new comments.
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (2 comments by @annevk, @shekyan)
-
Add an SRI control as either a CSP directive or a new header w3c/webappsec-subresource-integrity#23 (1 comment by @jonathanKingston)
-
w3c/webappsec
-
3 issues received 20 new comments.
-
[SRI] Support signatures/asymm key w3c/webappsec#449 (16 comments by @hillbrad, @kojiromike, @Lennie, @mikesir87, @sbp)
-
CSP: Provide a way to restrict domain of document.cookie w3c/webappsec#432 (3 comments by @Haravikk, @mikewest)
-
-
1 pull request received 2 new comments.
-
Explore automatic publication with Travis & Echidna w3c/webappsec#459 (2 comments by @tabatkins, @tripu)
-
w3c/webappsec-secure-contexts
-
1 issue closed.
-
The "This version" link at the top of the spec is broken w3c/webappsec-secure-contexts#11.
-
-
1 issue reopened.
-
Remove the risk of `document.domain`. w3c/webappsec-secure-contexts#10, by @annevk.
-
-
4 issues received 7 new comments.
-
Remove the risk of `document.domain`. w3c/webappsec-secure-contexts#10 (4 comments by @annevk, @mikewest)
-
Behavior of accessing properties in non-secure contexts w3c/webappsec-secure-contexts#8 (1 comment by @mikewest)
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9 (1 comment by @mikewest)
-
The "This version" link at the top of the spec is broken w3c/webappsec-secure-contexts#11 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Fix non-secure schemes from https to http w3c/webappsec-secure-contexts#12, by @hashedhyphen.
-
w3c/permissions
-
2 issues opened.
-
Options for "double-keying" permissions w3c/permissions#55, by @martinthomson.
-
Faking permissions w3c/permissions#54, by @KOLANICH.
-
-
1 issue received 12 new comments.
-
Options for "double-keying" permissions w3c/permissions#55 (12 comments by @alvestrand, @martinthomson, @mounirlamouri)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Clarify the fetch integration points w3c/webappsec-mixed-content#2, by @wseltzer.
-
w3c/webappsec-csp
-
8 issues opened.
-
[embedded] Is the `csp` attribute policy applied recursively? w3c/webappsec-csp#50, by @yoavweiss.
-
Embedded: consider other contexts other than iframe w3c/webappsec-csp#49, by @shekyan.
-
Copy/paste http://www.w3.org/TR/CSP2/#frame-ancestors-and-frame-options w3c/webappsec-csp#48, by @mikewest.
-
Note that the `source-file` could leak data. w3c/webappsec-csp#47, by @mikewest.
-
Copy/paste the "paths and redirects" justification from CSP2. w3c/webappsec-csp#46, by @mikewest.
-
Further granularity of unsafe-inline styles w3c/webappsec-csp#45, by @jonathanKingston.
-
Clarify what is the threat model for embedded enforcement w3c/webappsec-csp#44, by @shekyan.
-
Note the importance of the Fetch integration in /cookies/ w3c/webappsec-csp#43, by @mikewest.
-
-
1 issue received 3 new comments.
-
Embedded: consider other contexts other than iframe w3c/webappsec-csp#49 (3 comments by @mikewest, @shekyan)
-
w3c/webappsec-suborigins
-
5 issues opened.
-
Do suborigins work with META tag w3c/webappsec-suborigins#10, by @mitar.
-
Are suborigins case sensitive or not? w3c/webappsec-suborigins#9, by @mitar.
-
Allow . in the suborigin w3c/webappsec-suborigins#8, by @mitar.
-
Origins in the spec have trailing / w3c/webappsec-suborigins#7, by @mitar.
-
Why having both serialized origins and finerorigin/suborigin w3c/webappsec-suborigins#6, by @mitar.
-
-
4 issues received 5 new comments.
-
1 pull request opened.
-
Add Dev as editor w3c/webappsec-suborigins#5, by @joelweinberger.
-
-
1 pull request merged.
-
Add Dev as editor w3c/webappsec-suborigins#5.
-
-
1 pull request received 2 new comments.
w3c/webappsec-uisecurity
-
1 issue opened.
-
Typo: "Visiblity" w3c/webappsec-uisecurity#5, by @noncombatant.
-
-
1 issue received 6 new comments.
-
4 pull requests opened.
-
Dan is contibuting as a member via White Ops now w3c/webappsec-uisecurity#4, by @wseltzer.
-
Polish 002 w3c/webappsec-uisecurity#3, by @hillbrad.
-
polish - rename unsafe to isUnsafe for consistency with isTrusted, de… w3c/webappsec-uisecurity#2, by @hillbrad.
-
-
4 pull requests merged.
-
Dan is contibuting as a member via White Ops now w3c/webappsec-uisecurity#4.
-
Polish 002 w3c/webappsec-uisecurity#3.
-
polish - rename unsafe to isUnsafe for consistency with isTrusted, de… w3c/webappsec-uisecurity#2.
-
new spec! w3c/webappsec-uisecurity#1.
-
w3c/webcrypto
-
2 pull requests opened.
-
Address DER/BER encoding editorial note w3c/webcrypto#11, by @jimsch.
-
Switch to RFC 6090 for reference w3c/webcrypto#10, by @jimsch.
-
-
4 pull requests received 18 new comments.
TR publications
-
1 document published.
-
Subresource Integrity published as a Candidate Recommendation Snapshot. History of Subresource Integrity
-
Participants
-
1 organization joined.
-
PayPal joined.
-
-
1 organization left.
-
International Webmasters Association (IWA) left.
-
GitHub
w3c/webcrypto
-
9 pull requests opened.
-
Editorial Notes merged into main text w3c/webcrypto#9, by @hhalpin.
-
Check for a wrap of the counter w3c/webcrypto#8, by @jimsch.
-
Fix #147: Descriptions are all non-normative w3c/webcrypto#7, by @jimsch.
-
Update to point to to finished RFC documents w3c/webcrypto#6, by @jimsch.
-
Remove CMAC, CFB from the IANA section w3c/webcrypto#5, by @jimsch.
-
Copy Edit and Spell Check w3c/webcrypto#4, by @jimsch.
-
Copy Edit changes w3c/webcrypto#3, by @jimsch.
-
Fix WebIDL typo w3c/webcrypto#2, by @dontcallmedom.
-
Correct text for public key and jwk w3c/webcrypto#1, by @jimsch.
-
-
5 pull requests merged.
-
Update to point to to finished RFC documents w3c/webcrypto#6.
-
Remove CMAC, CFB from the IANA section w3c/webcrypto#5.
-
Copy Edit and Spell Check w3c/webcrypto#4.
-
Correct text for public key and jwk w3c/webcrypto#1.
-
Fix WebIDL typo w3c/webcrypto#2.
-
-
2 pull requests closed.
-
Check for a wrap of the counter w3c/webcrypto#8.
-
Copy Edit changes w3c/webcrypto#3.
-
-
1 pull request reopened.
-
Editorial Notes merged into main text w3c/webcrypto#9, by @hhalpin.
-
-
4 pull requests received 8 new comments.
w3c/webappsec-csp
-
7 issues opened.
-
Create a mechanism to disable `document.cookie` and `document.domain`. w3c/webappsec-csp#42, by @mikewest.
-
Consider enforcing default port if expression matches only scheme-source grammar w3c/webappsec-csp#41, by @shekyan.
-
Please clarify which text encoding should be used to compute the hash value of inline script/style w3c/webappsec-csp#40, by @duanyao.
-
Null references in specification w3c/webappsec-csp#39, by @shekyan.
-
Expand base64-value grammar w3c/webappsec-csp#37, by @shekyan.
-
URL and semicolon clarity w3c/webappsec-csp#36, by @Nick-Levinson.
-
Consider enforcing default-src if not explicit w3c/webappsec-csp#35, by @shekyan.
-
-
4 issues closed.
-
Matching schemeless expressions w3c/webappsec-csp#34.
-
Expand base64-value grammar w3c/webappsec-csp#37.
-
URL and semicolon clarity w3c/webappsec-csp#36.
-
Ignoring Meta CSP if <script> tag appears before Meta CSP w3c/webappsec-csp#27.
-
-
7 issues received 19 new comments.
-
URL and semicolon clarity w3c/webappsec-csp#36 (10 comments by @hillbrad, @michaelficarra, @Nick-Levinson)
-
CSP: make available a reliable method for obtaining a reference to the global object w3c/webappsec-csp#2 (1 comment by @michaelficarra)
-
Ignoring Meta CSP if <script> tag appears before Meta CSP w3c/webappsec-csp#27 (1 comment by @ckerschb)
-
-
1 pull request opened.
-
Fixes numbering in 6.1.10.3 w3c/webappsec-csp#38, by @shekyan.
-
-
1 pull request merged.
-
Fixes numbering in 6.1.10.3 w3c/webappsec-csp#38.
-
-
1 pull request closed.
-
Changes to patch introduced by #25 w3c/webappsec-csp#33.
-
-
1 pull request received 1 new comment.
w3c/webappsec-referrer-policy
-
4 issues opened.
-
Consider using a dedicated header instead of CSP for referrer policy delivery w3c/webappsec-referrer-policy#6, by @jeisinger.
-
Define how CSS interacts with spec for the sake of defining how referrers should be handled w3c/webappsec-referrer-policy#5, by @jeisinger.
-
Consider being less draconian in conflict resolution w3c/webappsec-referrer-policy#4, by @jeisinger.
-
Define referrerPolicy IDL attribute w3c/webappsec-referrer-policy#3, by @annevk.
-
-
2 issues closed.
-
Define referrerPolicy IDL attribute w3c/webappsec-referrer-policy#3.
-
Consider being less draconian in conflict resolution w3c/webappsec-referrer-policy#4.
-
-
1 issue reopened.
-
Consider being less draconian in conflict resolution w3c/webappsec-referrer-policy#4, by @estark37.
-
-
3 issues received 16 new comments.
-
Consider being less draconian in conflict resolution w3c/webappsec-referrer-policy#4 (9 comments by @devd, @estark37, @jeisinger, @mikewest)
-
Define referrerPolicy IDL attribute w3c/webappsec-referrer-policy#3 (6 comments by @annevk, @hsivonen, @jeisinger, @sc0ttbeardsley)
-
Consider using a dedicated header instead of CSP for referrer policy delivery w3c/webappsec-referrer-policy#6 (1 comment by @mikewest)
-
-
8 pull requests opened.
-
Replace referrer directive with Referrer-Policy header w3c/webappsec-referrer-policy#14, by @estark37.
-
Add security considerations section w3c/webappsec-referrer-policy#13, by @jeisinger.
-
Configure correct repository for bikeshed w3c/webappsec-referrer-policy#12, by @jeisinger.
-
Modify referrer algorithm to use referrerpolicy attribute if present w3c/webappsec-referrer-policy#11, by @estark37.
-
Specify that an empty token is No Referrer w3c/webappsec-referrer-policy#10, by @estark37.
-
Fix example for how to use policies potentially unsupported by some clients w3c/webappsec-referrer-policy#9, by @jeisinger.
-
Define Element interface extensions w3c/webappsec-referrer-policy#8, by @jeisinger.
-
Treat unknown referrer policy values as null w3c/webappsec-referrer-policy#7, by @estark37.
-
-
7 pull requests merged.
-
Add security considerations section w3c/webappsec-referrer-policy#13.
-
Configure correct repository for bikeshed w3c/webappsec-referrer-policy#12.
-
Specify that an empty token is No Referrer w3c/webappsec-referrer-policy#10.
-
Modify referrer algorithm to use referrerpolicy attribute if present w3c/webappsec-referrer-policy#11.
-
Define Element interface extensions w3c/webappsec-referrer-policy#8.
-
Fix example for how to use policies potentially unsupported by some clients w3c/webappsec-referrer-policy#9.
-
Treat unknown referrer policy values as null w3c/webappsec-referrer-policy#7.
-
-
8 pull requests received 53 new comments.
-
Treat unknown referrer policy values as null w3c/webappsec-referrer-policy#7 (14 comments by @estark37, @jeisinger, @mikewest, @wseltzer)
-
Replace referrer directive with Referrer-Policy header w3c/webappsec-referrer-policy#14 (12 comments by @annevk, @briansmith, @estark37, @jeisinger, @mikewest)
-
Define Element interface extensions w3c/webappsec-referrer-policy#8 (12 comments by @annevk, @jeisinger)
-
Modify referrer algorithm to use referrerpolicy attribute if present w3c/webappsec-referrer-policy#11 (5 comments by @estark37, @jeisinger)
-
Fix example for how to use policies potentially unsupported by some clients w3c/webappsec-referrer-policy#9 (3 comments by @estark37, @jeisinger, @wseltzer)
-
Specify that an empty token is No Referrer w3c/webappsec-referrer-policy#10 (2 comments by @jeisinger, @mikewest)
-
Rename attribute delivery from referrer to referrerpolicy w3c/webappsec-referrer-policy#1 (2 comments by @annevk, @franziskuskiefer)
-
w3c/webappsec-credential-management
w3c/webappsec-suborigins
-
4 pull requests opened.
-
Another set of abstract improvements w3c/webappsec-suborigins#4, by @joelweinberger.
-
Improve abstract w3c/webappsec-suborigins#3, by @joelweinberger.
-
Update repository info w3c/webappsec-suborigins#2, by @joelweinberger.
-
Merging initial spec into W3C repo. w3c/webappsec-suborigins#1, by @joelweinberger.
-
-
4 pull requests merged.
-
Another set of abstract improvements w3c/webappsec-suborigins#4.
-
Improve abstract w3c/webappsec-suborigins#3.
-
Update repository info w3c/webappsec-suborigins#2.
-
Merging initial spec into W3C repo. w3c/webappsec-suborigins#1.
-
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
Minor spelling and formatting from timeless w3c/webappsec-subresource-integrity#18, by @joelweinberger.
-
IDL attributes not defined properly w3c/webappsec-subresource-integrity#17, by @annevk.
-
-
2 issues closed.
-
Minor spelling and formatting from timeless w3c/webappsec-subresource-integrity#18.
-
IDL attributes not defined properly w3c/webappsec-subresource-integrity#17.
-
-
3 issues received 6 new comments.
-
IDL attributes not defined properly w3c/webappsec-subresource-integrity#17 (4 comments by @annevk, @freddyb, @joelweinberger)
-
Minor spelling and formatting from timeless w3c/webappsec-subresource-integrity#18 (1 comment by @joelweinberger)
-
-
4 pull requests opened.
-
Formatting and spelling corrections w3c/webappsec-subresource-integrity#19, by @joelweinberger.
-
Address 3 minor pre-CR issues w3c/webappsec-subresource-integrity#16, by @joelweinberger.
-
Change some normative references to non-normative w3c/webappsec-subresource-integrity#15, by @joelweinberger.
-
Update index.html w3c/webappsec-subresource-integrity#14, by @joelweinberger.
-
-
4 pull requests merged.
-
Formatting and spelling corrections w3c/webappsec-subresource-integrity#19.
-
Address 3 minor pre-CR issues w3c/webappsec-subresource-integrity#16.
-
Change some normative references to non-normative w3c/webappsec-subresource-integrity#15.
-
Update index.html w3c/webappsec-subresource-integrity#14.
-
-
1 pull request received 4 new comments.
-
Change some normative references to non-normative w3c/webappsec-subresource-integrity#15 (4 comments by @devd, @hillbrad, @joelweinberger)
-
w3c/webappsec
-
1 issue received 1 new comment.
-
1 pull request opened.
-
uisecurity bikeshed w3c/webappsec#507, by @hillbrad.
-
-
1 pull request merged.
-
uisecurity bikeshed w3c/webappsec#507.
-
-
2 pull requests received 3 new comments.
w3c/webappsec-secure-contexts
-
1 issue opened.
-
The "This version" link at the top of the spec is broken w3c/webappsec-secure-contexts#11, by @jwatt.
-
-
2 issues closed.
-
Reconsider popups as secure contexts. w3c/webappsec-secure-contexts#6.
-
Consider changing the link for 'origin' w3c/webappsec-secure-contexts#1.
-
-
3 issues received 7 new comments.
-
Reconsider popups as secure contexts. w3c/webappsec-secure-contexts#6 (4 comments by @mikewest, @travisleithead)
-
<iframe sandbox srcdoc="foo"> on a secure page should be secure w3c/webappsec-secure-contexts#5 (2 comments by @bzbarsky, @jwatt)
-
w3c/webappsec-cowl
-
7 issues opened.
-
Change label format in headers w3c/webappsec-cowl#40, by @deian.
-
Make sure COWL's request header doesn't reintroduce referrer leaks w3c/webappsec-cowl#39, by @deian.
-
Don't use origins for app-specific principals w3c/webappsec-cowl#38, by @deian.
-
Specify how COWL deals with push w3c/webappsec-cowl#37, by @deian.
-
Specify how COWL integrates with ServiceWorkers w3c/webappsec-cowl#36, by @deian.
-
Parsing headers should fail close w3c/webappsec-cowl#35, by @deian.
-
Don't allow over-tainting a top-level context w3c/webappsec-cowl#34, by @deian.
-
w3c/permissions
-
1 issue opened.
-
Add "wakeLock" to enum PermissionName w3c/permissions#53, by @jimmywarting.
-
-
1 issue received 1 new comment.
TR publications
-
4 documents published.
-
Mixed Content published as a Candidate Recommendation Snapshot. History of Mixed Content
-
Upgrade Insecure Requests published as a Candidate Recommendation Snapshot. History of Upgrade Insecure Requests
-
Subresource Integrity published as a Working Draft. History of Subresource Integrity
-
Confinement with Origin Web Labels published as a First Public Working Draft. History of Confinement with Origin Web Labels
-
Participants
-
1 organization joined.
-
Copper Horse Solutions Ltd joined.
-
GitHub
w3c/webappsec-csp
-
31 issues opened.
-
Matching schemeless expressions w3c/webappsec-csp#34, by @shekyan.
-
Consider applying both `child-src` and `script-src` to workers. w3c/webappsec-csp#31, by @mikewest.
-
CSP 401 Issue w3c/webappsec-csp#29, by @kepengli.
-
Identify requirements for other documents defining new directives w3c/webappsec-csp#28, by @hillbrad.
-
Ignoring Meta CSP if <script> tag appears before Meta CSP w3c/webappsec-csp#27, by @ckerschb.
-
block-all-mixed-content for report-only w3c/webappsec-csp#26, by @ejcx.
-
Allow https: loads for http: restrictions w3c/webappsec-csp#25, by @ckerschb.
-
Setting policy when origins are not known ahead of time w3c/webappsec-csp#24, by @sandinmyjoints.
-
Add something like `'secure-contexts'` to `frame-ancestors`'s source list. w3c/webappsec-csp#23, by @mikewest.
-
"calling Function as a constructor" is too specific. w3c/webappsec-csp#21, by @mikewest.
-
CSP: form-nonce directive w3c/webappsec-csp#20, by @mikewest.
-
CSP: Deal with local schemes in new browsing contexts? w3c/webappsec-csp#19, by @mikewest.
-
CSP: Evaluate a JSON syntax. w3c/webappsec-csp#18, by @mikewest.
-
CSP: Consider allowing `frame-ancestors` to work for subresource loads. w3c/webappsec-csp#17, by @mikewest.
-
CSP: Define 'nonce' processing hooks for HTML. w3c/webappsec-csp#16, by @mikewest.
-
Nonce attribute for Web Worker w3c/webappsec-csp#15, by @mikewest.
-
CSP: Provide source of violation in SecurityPolicyViolationEvents w3c/webappsec-csp#14, by @mikewest.
-
Inline event handlers not whitelisted by hashes? w3c/webappsec-csp#13, by @mikewest.
-
CSP: Consider an opt-in cascade model. w3c/webappsec-csp#12, by @mikewest.
-
CSP section 4.2.2 step 2 performs case sensitive test for url scheme w3c/webappsec-csp#11, by @mikewest.
-
CSP section 4.2.2 step 8 restricts loopback allowance to 127.0.0.1 w3c/webappsec-csp#10, by @mikewest.
-
CSP2: copy/paste bug in `default-src` definition. w3c/webappsec-csp#9, by @mikewest.
-
CSP: form-action and redirects w3c/webappsec-csp#8, by @mikewest.
-
CSP: connect-src 'self' and websockets w3c/webappsec-csp#7, by @mikewest.
-
[CSP] specify handling of malformed content-security-policy HTTP header w3c/webappsec-csp#6, by @mikewest.
-
CSP: clarify whitespace characters w3c/webappsec-csp#5, by @mikewest.
-
CSP: Identify enforced or report only policy in JSON w3c/webappsec-csp#4, by @mikewest.
-
CSP: Function called via [[Construct]] is the same as Function called via [[Call]] w3c/webappsec-csp#3, by @mikewest.
-
CSP: make available a reliable method for obtaining a reference to the global object w3c/webappsec-csp#2, by @mikewest.
-
CSP: ECMA-262 does not define "operator eval" w3c/webappsec-csp#1, by @mikewest.
-
-
8 issues closed.
-
Allow https: loads for http: restrictions w3c/webappsec-csp#25.
-
CSP: ECMA-262 does not define "operator eval" w3c/webappsec-csp#1.
-
CSP: Function called via [[Construct]] is the same as Function called via [[Call]] w3c/webappsec-csp#3.
-
CSP: Define 'nonce' processing hooks for HTML. w3c/webappsec-csp#16.
-
CSP: Deal with local schemes in new browsing contexts? w3c/webappsec-csp#19.
-
"calling Function as a constructor" is too specific. w3c/webappsec-csp#21.
-
CSP2: copy/paste bug in `default-src` definition. w3c/webappsec-csp#9.
-
-
25 issues received 78 new comments.
-
Ignoring Meta CSP if <script> tag appears before Meta CSP w3c/webappsec-csp#27 (7 comments by @bzbarsky, @ckerschb, @michael-oneill, @mikewest)
-
Inline event handlers not whitelisted by hashes? w3c/webappsec-csp#13 (7 comments by @joelweinberger, @mikewest)
-
CSP2: copy/paste bug in `default-src` definition. w3c/webappsec-csp#9 (7 comments by @michaelficarra, @mikewest)
-
CSP: Consider allowing `frame-ancestors` to work for subresource loads. w3c/webappsec-csp#17 (6 comments by @briansmith, @mikewest)
-
'unsafe-inline', 'unsafe-eval', nonce-source, hash-source are no-op for most of the source-list directives w3c/webappsec-csp#22 (5 comments by @mikewest, @shekyan)
-
CSP: make available a reliable method for obtaining a reference to the global object w3c/webappsec-csp#2 (4 comments by @michaelficarra, @mikewest)
-
CSP: connect-src 'self' and websockets w3c/webappsec-csp#7 (3 comments by @klings, @mikewest, @zdexter)
-
CSP section 4.2.2 step 8 restricts loopback allowance to 127.0.0.1 w3c/webappsec-csp#10 (3 comments by @mikewest)
-
[CSP] specify handling of malformed content-security-policy HTTP header w3c/webappsec-csp#6 (3 comments by @mikewest)
-
"calling Function as a constructor" is too specific. w3c/webappsec-csp#21 (2 comments by @michaelficarra, @mikewest)
-
CSP: Deal with local schemes in new browsing contexts? w3c/webappsec-csp#19 (2 comments by @mikewest)
-
CSP section 4.2.2 step 2 performs case sensitive test for url scheme w3c/webappsec-csp#11 (2 comments by @mikewest)
-
Setting policy when origins are not known ahead of time w3c/webappsec-csp#24 (1 comment by @sandinmyjoints)
-
CSP: Function called via [[Construct]] is the same as Function called via [[Call]] w3c/webappsec-csp#3 (1 comment by @mikewest)
-
CSP: Provide source of violation in SecurityPolicyViolationEvents w3c/webappsec-csp#14 (1 comment by @mikewest)
-
3 pull requests opened.
-
Changes to patch introduced by #25 w3c/webappsec-csp#33, by @shekyan.
-
Add 'self' to ancestor-source grammar w3c/webappsec-csp#32, by @shekyan.
-
Update index.html w3c/webappsec-csp#30, by @shekyan.
-
-
1 pull request merged.
-
Add 'self' to ancestor-source grammar w3c/webappsec-csp#32.
-
-
1 pull request closed.
-
Update index.html w3c/webappsec-csp#30.
-
-
2 pull requests received 6 new comments.
w3c/webappsec-secure-contexts
-
9 issues opened.
-
Remove the risk of `document.domain`. w3c/webappsec-secure-contexts#10, by @mikewest.
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9, by @hillbrad.
-
Behavior of accessing properties in non-secure contexts w3c/webappsec-secure-contexts#8, by @jungkees.
-
Reconsider popups as secure contexts. w3c/webappsec-secure-contexts#6, by @mikewest.
-
<iframe sandbox srcdoc="foo"> on a secure page should be secure w3c/webappsec-secure-contexts#5, by @bzbarsky.
-
"Is origin potentially trustworthy" algorithm assumes origins have scheme and host components w3c/webappsec-secure-contexts#4, by @bzbarsky.
-
Consider linking to just the WHATWG version of HTML5 or just the W3C version w3c/webappsec-secure-contexts#3, by @jwatt.
-
Specification does not justify its necessity for existence w3c/webappsec-secure-contexts#2, by @IanKemp.
-
Consider changing the link for 'origin' w3c/webappsec-secure-contexts#1, by @jwatt.
-
-
1 issue closed.
-
Consider linking to just the WHATWG version of HTML5 or just the W3C version w3c/webappsec-secure-contexts#3.
-
-
8 issues received 34 new comments.
-
<iframe sandbox srcdoc="foo"> on a secure page should be secure w3c/webappsec-secure-contexts#5 (16 comments by @annevk, @bzbarsky, @mikewest)
-
Reconsider popups as secure contexts. w3c/webappsec-secure-contexts#6 (5 comments by @martinthomson, @mikewest, @travisleithead)
-
"Is origin potentially trustworthy" algorithm assumes origins have scheme and host components w3c/webappsec-secure-contexts#4 (4 comments by @bzbarsky, @mikewest)
-
Consider changing the link for 'origin' w3c/webappsec-secure-contexts#1 (3 comments by @annevk, @jwatt, @mikewest)
-
Remove the risk of `document.domain`. w3c/webappsec-secure-contexts#10 (2 comments by @annevk, @bholley)
-
Specification does not justify its necessity for existence w3c/webappsec-secure-contexts#2 (2 comments by @jwatt)
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9 (1 comment by @hillbrad)
-
Consider linking to just the WHATWG version of HTML5 or just the W3C version w3c/webappsec-secure-contexts#3 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Fix typo in ED URL w3c/webappsec-secure-contexts#7, by @molnarg.
-
-
1 pull request merged.
-
Fix typo in ED URL w3c/webappsec-secure-contexts#7.
-
-
1 pull request received 1 new comment.
w3c/webappsec-subresource-integrity
-
5 issues opened.
-
Convert to Bikeshed w3c/webappsec-subresource-integrity#12, by @joelweinberger.
-
SHA-3/Keccak w3c/webappsec-subresource-integrity#11, by @smarts.
-
Respond to @timeless comments w3c/webappsec-subresource-integrity#6, by @devd.
-
Review the stability of all referenced documents w3c/webappsec-subresource-integrity#3, by @fmarier.
-
Use HTML5 spaces instead of RFC5234 WSP w3c/webappsec-subresource-integrity#1, by @fmarier.
-
-
3 issues closed.
-
Review the stability of all referenced documents w3c/webappsec-subresource-integrity#3.
-
Use HTML5 spaces instead of RFC5234 WSP w3c/webappsec-subresource-integrity#1.
-
Respond to @timeless comments w3c/webappsec-subresource-integrity#6.
-
-
4 issues received 15 new comments.
-
Review the stability of all referenced documents w3c/webappsec-subresource-integrity#3 (11 comments by @devd, @hillbrad, @joelweinberger)
-
Use HTML5 spaces instead of RFC5234 WSP w3c/webappsec-subresource-integrity#1 (1 comment by @joelweinberger)
-
-
8 pull requests opened.
-
Remove potentially secure origin w3c/webappsec-subresource-integrity#13, by @fmarier.
-
Redefine WSP as White_Space characters from the HTML 5 spec. w3c/webappsec-subresource-integrity#10, by @joelweinberger.
-
Address comments from timeless w3c/webappsec-subresource-integrity#9, by @joelweinberger.
-
Correction to "is eligible" note on cors response type w3c/webappsec-subresource-integrity#8, by @joelweinberger.
-
Simplify the openssl command line w3c/webappsec-subresource-integrity#7, by @fmarier.
-
Notes and examples markup fixes w3c/webappsec-subresource-integrity#5, by @fmarier.
-
Lean on the Fetch spec to simplify isEligible() w3c/webappsec-subresource-integrity#4, by @fmarier.
-
Update link for list of changes? w3c/webappsec-subresource-integrity#2, by @AFBarstow.
-
-
7 pull requests merged.
-
Remove potentially secure origin w3c/webappsec-subresource-integrity#13.
-
Simplify the openssl command line w3c/webappsec-subresource-integrity#7.
-
Redefine WSP as White_Space characters from the HTML 5 spec. w3c/webappsec-subresource-integrity#10.
-
Address comments from timeless w3c/webappsec-subresource-integrity#9.
-
Notes and examples markup fixes w3c/webappsec-subresource-integrity#5.
-
Correction to "is eligible" note on cors response type w3c/webappsec-subresource-integrity#8.
-
Lean on the Fetch spec to simplify isEligible() w3c/webappsec-subresource-integrity#4.
-
-
1 pull request closed.
-
Update link for list of changes? w3c/webappsec-subresource-integrity#2.
-
-
8 pull requests received 45 new comments.
-
Lean on the Fetch spec to simplify isEligible() w3c/webappsec-subresource-integrity#4 (17 comments by @annevk, @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
Correction to "is eligible" note on cors response type w3c/webappsec-subresource-integrity#8 (13 comments by @annevk, @devd, @fmarier, @joelweinberger)
-
Address comments from timeless w3c/webappsec-subresource-integrity#9 (4 comments by @devd, @joelweinberger)
-
Update link for list of changes? w3c/webappsec-subresource-integrity#2 (4 comments by @AFBarstow, @fmarier)
-
Remove potentially secure origin w3c/webappsec-subresource-integrity#13 (3 comments by @fmarier, @joelweinberger, @mikewest)
-
Redefine WSP as White_Space characters from the HTML 5 spec. w3c/webappsec-subresource-integrity#10 (2 comments by @devd, @joelweinberger)
-
Simplify the openssl command line w3c/webappsec-subresource-integrity#7 (1 comment by @joelweinberger)
-
Notes and examples markup fixes w3c/webappsec-subresource-integrity#5 (1 comment by @joelweinberger)
-
w3c/webappsec-credential-management
-
9 issues opened.
-
CREDENTIAL: Add `toURLSearchParams` w3c/webappsec-credential-management#9, by @mikewest.
-
CREDENTIAL: Credential scope should not be limited to login w3c/webappsec-credential-management#8, by @mikewest.
-
CREDENTIAL: Use a generic matching algorithm that would work for custom Credentials types w3c/webappsec-credential-management#7, by @mikewest.
-
CREDENTIAL: Apply hash functions before POSTing passwords? w3c/webappsec-credential-management#6, by @mikewest.
-
CREDENTIAL: Give clear implementation advice. w3c/webappsec-credential-management#5, by @mikewest.
-
CREDENTIAL: Generic matching algorithm w3c/webappsec-credential-management#4, by @mikewest.
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec-credential-management#3, by @mikewest.
-
CREDENTIAL: requestAutocomplete can already provide local credentials w3c/webappsec-credential-management#2, by @mikewest.
-
CREDENTIAL: could we make it easier to extend? w3c/webappsec-credential-management#1, by @mikewest.
-
-
8 issues received 58 new comments.
-
CREDENTIAL: Use a generic matching algorithm that would work for custom Credentials types w3c/webappsec-credential-management#7 (16 comments by @mikewest)
-
CREDENTIAL: Apply hash functions before POSTing passwords? w3c/webappsec-credential-management#6 (9 comments by @mikewest)
-
CREDENTIAL: Generic matching algorithm w3c/webappsec-credential-management#4 (9 comments by @mikewest)
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec-credential-management#3 (9 comments by @mikewest)
-
CREDENTIAL: requestAutocomplete can already provide local credentials w3c/webappsec-credential-management#2 (8 comments by @mikewest)
-
CREDENTIAL: could we make it easier to extend? w3c/webappsec-credential-management#1 (3 comments by @jonathanKingston, @mikewest)
-
CREDENTIAL: Credential scope should not be limited to login w3c/webappsec-credential-management#8 (3 comments by @mikewest)
-
CREDENTIAL: Give clear implementation advice. w3c/webappsec-credential-management#5 (1 comment by @mikewest)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Should reference definitions in "Secure Contexts" spec w3c/webappsec-mixed-content#1, by @dveditz.
-
-
1 issue closed.
-
Should reference definitions in "Secure Contexts" spec w3c/webappsec-mixed-content#1.
-
-
1 issue received 2 new comments.
-
Should reference definitions in "Secure Contexts" spec w3c/webappsec-mixed-content#1 (2 comments by @mikewest)
-
w3c/webappsec
-
12 issues opened.
-
[SRI] Shared Cache through `sharedcache` attribute w3c/webappsec#504, by @brillout.
-
CSP: ECMA-262 does not define "operator eval" w3c/webappsec#503, by @shekyan.
-
CSP: ECMA-262 doesn w3c/webappsec#502, by @shekyan.
-
CSP: Identify enforced or report only policy in JSON w3c/webappsec#499, by @ScottHelme.
-
CSP: clarify whitespace characters w3c/webappsec#498, by @michaelficarra.
-
SRI: Integrity enforcement on downloads w3c/webappsec#497, by @jfbastien.
-
[CSP] specify handling of malformed content-security-policy HTTP header w3c/webappsec#495, by @shekyan.
-
SRI: media fragments w3c/webappsec#493, by @uecker.
-
30 issues closed.
-
SRI: Consider converting to Bikeshed. w3c/webappsec#141.
-
CREDENTIAL: Apply hash functions before POSTing passwords? w3c/webappsec#288.
-
CREDENTIAL: Give clear implementation advice. w3c/webappsec#290.
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec#380.
-
CREDENTIAL: requestAutocomplete can already provide local credentials w3c/webappsec#445.
-
CREDENTIAL: could we make it easier to extend? w3c/webappsec#490.
-
CSP: form-nonce directive w3c/webappsec#448.
-
CSP: Deal with local schemes in new browsing contexts? w3c/webappsec#451.
-
CSP: Evaluate a JSON syntax. w3c/webappsec#457.
-
CSP: Consider allowing `frame-ancestors` to work for subresource loads. w3c/webappsec#458.
-
CSP: Define 'nonce' processing hooks for HTML. w3c/webappsec#463.
-
Nonce attribute for Web Worker w3c/webappsec#464.
-
CSP: Provide source of violation in SecurityPolicyViolationEvents w3c/webappsec#467.
-
Inline event handlers not whitelisted by hashes? w3c/webappsec#468.
-
CSP: Consider an opt-in cascade model. w3c/webappsec#474.
-
CSP section 4.2.2 step 2 performs case sensitive test for url scheme w3c/webappsec#475.
-
CSP section 4.2.2 step 8 restricts loopback allowance to 127.0.0.1 w3c/webappsec#476.
-
CSP2: copy/paste bug in `default-src` definition. w3c/webappsec#481.
-
CSP: form-action and redirects w3c/webappsec#482.
-
CSP: connect-src 'self' and websockets w3c/webappsec#489.
-
[CSP] specify handling of malformed content-security-policy HTTP header w3c/webappsec#495.
-
CSP: clarify whitespace characters w3c/webappsec#498.
-
CSP: Identify enforced or report only policy in JSON w3c/webappsec#499.
-
CSP: ECMA-262 does not define "operator eval" w3c/webappsec#503.
-
CSP: ECMA-262 doesn w3c/webappsec#502.
-
SRI: add a note about data: and blob: URLs w3c/webappsec#487.
-
-
1 issue reopened.
-
[CSP] Server is not a valid conforming class of product w3c/webappsec#25, by @mikewest.
-
-
34 issues received 69 new comments.
-
SRI: Integrity enforcement on downloads w3c/webappsec#497 (10 comments by @briansmith, @jfbastien, @joelweinberger, @mozfreddyb)
-
SRI: Consider converting to Bikeshed. w3c/webappsec#141 (6 comments by @joelweinberger, @mozfreddyb, @tabatkins)
-
SRI: Fine grained "require integrity" option w3c/webappsec#16 (4 comments by @devd, @dveditz, @jonathanKingston)
-
[CSP] specify handling of malformed content-security-policy HTTP header w3c/webappsec#495 (4 comments by @joelweinberger, @michaelficarra, @mikewest)
-
CSP: make available a reliable method for obtaining a reference to the global object w3c/webappsec#501 (4 comments by @hillbrad, @michaelficarra, @mikewest)
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139 (4 comments by @jeisinger, @mikewest)
-
CSP: Identify enforced or report only policy in JSON w3c/webappsec#499 (2 comments by @hillbrad, @mikewest)
-
[CSP] `keyword-source` rule's 'self' definition should allow for websocket connections to the same origin w3c/webappsec#506 (1 comment by @zdexter)
-
CREDENTIAL: Use a generic matching algorithm that would work for custom Credentials types w3c/webappsec#274 (1 comment by @mikewest)
-
CREDENTIAL: Apply hash functions before POSTing passwords? w3c/webappsec#288 (1 comment by @mikewest)
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec#380 (1 comment by @mikewest)
-
CREDENTIAL: requestAutocomplete can already provide local credentials w3c/webappsec#445 (1 comment by @mikewest)
-
CSP: Consider allowing `frame-ancestors` to work for subresource loads. w3c/webappsec#458 (1 comment by @mikewest)
-
CSP: Provide source of violation in SecurityPolicyViolationEvents w3c/webappsec#467 (1 comment by @mikewest)
-
CSP section 4.2.2 step 2 performs case sensitive test for url scheme w3c/webappsec#475 (1 comment by @mikewest)
-
CSP section 4.2.2 step 8 restricts loopback allowance to 127.0.0.1 w3c/webappsec#476 (1 comment by @mikewest)
-
CSP: Function called via [[Construct]] is the same as Function called via [[Call]] w3c/webappsec#500 (1 comment by @mikewest)
-
-
2 pull requests opened.
-
Update URLs in README file w3c/webappsec#496, by @deian.
-
COWL: Fix typo w3c/webappsec#494, by @lawnsea.
-
-
2 pull requests merged.
-
Update URLs in README file w3c/webappsec#496.
-
SRI: Add response tainting to the eligibility algorithm (fixes #487) w3c/webappsec#492.
-
-
4 pull requests closed.
-
SRI: Add section Security Considerations: Behavior of chameleon resources w3c/webappsec#302.
-
CREDENTIAL: Generic matching algorithm w3c/webappsec#292.
-
COWL: Fix typo w3c/webappsec#494.
-
-
7 pull requests received 25 new comments.
-
SRI: Add response tainting to the eligibility algorithm (fixes #487) w3c/webappsec#492 (11 comments by @annevk, @devd, @fmarier, @mozfreddyb)
-
Explore automatic publication with Travis & Echidna w3c/webappsec#459 (4 comments by @plehegar, @tabatkins)
-
rename 'referrer' attribute to 'referrerpolicy', make rel=noreferrer take priority w3c/webappsec#435 (3 comments by @franziskuskiefer, @sc0ttbeardsley)
-
SRI: Add section Security Considerations: Behavior of chameleon resources w3c/webappsec#302 (1 comment by @fmarier)
-
w3c/webappsec-referrer-policy
-
2 pull requests opened.
-
make rel=noreferrer take priority over referrerpolicy attribute w3c/webappsec-referrer-policy#2, by @sc0ttbeardsley.
-
Rename attribute delivery from referrer to referrerpolicy w3c/webappsec-referrer-policy#1, by @sc0ttbeardsley.
-
-
2 pull requests merged.
-
make rel=noreferrer take priority over referrerpolicy attribute w3c/webappsec-referrer-policy#2.
-
Rename attribute delivery from referrer to referrerpolicy w3c/webappsec-referrer-policy#1.
-
-
2 pull requests received 10 new comments.
-
Rename attribute delivery from referrer to referrerpolicy w3c/webappsec-referrer-policy#1 (5 comments by @annevk, @franziskuskiefer, @jeisinger, @sc0ttbeardsley)
-
make rel=noreferrer take priority over referrerpolicy attribute w3c/webappsec-referrer-policy#2 (5 comments by @annevk, @franziskuskiefer, @jeisinger, @sc0ttbeardsley)
-
w3c/permissions
-
4 issues opened.
-
Privacy concern with being able to discern that a permission is granted w3c/permissions#52, by @hillbrad.
-
This could replace the Quota Management API? w3c/permissions#51, by @jimmywarting.
-
Add "pointerlock" to enum PermissionName w3c/permissions#50, by @jimmywarting.
-
Add UX considerations section w3c/permissions#49, by @mounirlamouri.
-
-
1 issue received 1 new comment.
-
Privacy concern with being able to discern that a permission is granted w3c/permissions#52 (1 comment by @npdoty)
-
w3c/webappsec-cowl
-
9 issues opened.
-
Disallow communication via obvious covert channels w3c/webappsec-cowl#33, by @deian.
-
Should a LabeledObject's protected object be cloned as well? w3c/webappsec-cowl#29, by @lawnsea.
-
HTTP Header Field sections w3c/webappsec-cowl#24, by @dret.
-
How should a server interpret multiple Sec-COWL headers? w3c/webappsec-cowl#19, by @lawnsea.
-
Sec-COWL request header possibly incompatible with RFC 2616 w3c/webappsec-cowl#18, by @lawnsea.
-
What does it mean to add a label set to another label set? w3c/webappsec-cowl#10, by @lawnsea.
-
Admin access? w3c/webappsec-cowl#8, by @deian.
-
Missing article or subject verb agreement bug w3c/webappsec-cowl#6, by @lawnsea.
-
Update published issues link w3c/webappsec-cowl#3, by @lawnsea.
-
-
8 issues closed.
-
Should a LabeledObject's protected object be cloned as well? w3c/webappsec-cowl#29.
-
HTTP Header Field sections w3c/webappsec-cowl#24.
-
Sec-COWL request header possibly incompatible with RFC 2616 w3c/webappsec-cowl#18.
-
How should a server interpret multiple Sec-COWL headers? w3c/webappsec-cowl#19.
-
What does it mean to add a label set to another label set? w3c/webappsec-cowl#10.
-
Admin access? w3c/webappsec-cowl#8.
-
Missing article or subject verb agreement bug w3c/webappsec-cowl#6.
-
Update published issues link w3c/webappsec-cowl#3.
-
-
8 issues received 16 new comments.
-
How should a server interpret multiple Sec-COWL headers? w3c/webappsec-cowl#19 (3 comments by @deian, @lawnsea)
-
Should a LabeledObject's protected object be cloned as well? w3c/webappsec-cowl#29 (2 comments by @deian, @lawnsea)
-
Sec-COWL request header possibly incompatible with RFC 2616 w3c/webappsec-cowl#18 (2 comments by @deian, @lawnsea)
-
What does it mean to add a label set to another label set? w3c/webappsec-cowl#10 (2 comments by @deian, @lawnsea)
-
-
24 pull requests opened.
-
#29 protected object of LabeledObject should be cloned w3c/webappsec-cowl#32, by @deian.
-
Swap out-of-order words w3c/webappsec-cowl#31, by @lawnsea.
-
proposal to address #24 w3c/webappsec-cowl#25, by @dret.
-
Improve flow w3c/webappsec-cowl#23, by @lawnsea.
-
Remove ambiguity w3c/webappsec-cowl#22, by @lawnsea.
-
Prepare for FPWD w3c/webappsec-cowl#20, by @deian.
-
Add missing article w3c/webappsec-cowl#17, by @lawnsea.
-
Fix subject verb agreement and simplify sentence w3c/webappsec-cowl#16, by @lawnsea.
-
Fix plurality w3c/webappsec-cowl#15, by @lawnsea.
-
Remove dupe word w3c/webappsec-cowl#14, by @lawnsea.
-
Fix verb agreement w3c/webappsec-cowl#13, by @lawnsea.
-
Remove extra word w3c/webappsec-cowl#12, by @lawnsea.
-
Add missing word w3c/webappsec-cowl#11, by @lawnsea.
-
add link to published version + travis ico w3c/webappsec-cowl#9, by @deian.
-
Fix missing subject w3c/webappsec-cowl#5, by @lawnsea.
-
Reorder phrase and format API method as code w3c/webappsec-cowl#4, by @lawnsea.
-
Fix awkward phrase w3c/webappsec-cowl#2, by @lawnsea.
-
-
23 pull requests merged.
-
#29 protected object of LabeledObject should be cloned w3c/webappsec-cowl#32.
-
Swap out-of-order words w3c/webappsec-cowl#31.
-
Fix typo w3c/webappsec-cowl#30.
-
Fix typo w3c/webappsec-cowl#28.
-
Fix typo w3c/webappsec-cowl#27.
-
Fix typo w3c/webappsec-cowl#26.
-
proposal to address #24 w3c/webappsec-cowl#25.
-
Improve flow w3c/webappsec-cowl#23.
-
Remove ambiguity w3c/webappsec-cowl#22.
-
Fix typos w3c/webappsec-cowl#21.
-
Prepare for FPWD w3c/webappsec-cowl#20.
-
Add missing article w3c/webappsec-cowl#17.
-
Fix subject verb agreement and simplify sentence w3c/webappsec-cowl#16.
-
Fix plurality w3c/webappsec-cowl#15.
-
Remove dupe word w3c/webappsec-cowl#14.
-
Fix verb agreement w3c/webappsec-cowl#13.
-
Remove extra word w3c/webappsec-cowl#12.
-
Add missing word w3c/webappsec-cowl#11.
-
add link to published version + travis ico w3c/webappsec-cowl#9.
-
Reorder phrase and format API method as code w3c/webappsec-cowl#4.
-
Fix missing subject w3c/webappsec-cowl#5.
-
Fix awkward phrase w3c/webappsec-cowl#2.
-
Fix typo w3c/webappsec-cowl#1.
-
-
1 pull request closed.
-
Fix typo w3c/webappsec-cowl#7.
-
-
2 pull requests received 3 new comments.
w3c/webappsec-upgrade-insecure-requests
-
1 pull request opened.
-
Make the refs to CSP all to the CSP2 CR w3c/webappsec-upgrade-insecure-requests#1, by @wseltzer.
-
-
1 pull request merged.
-
Make the refs to CSP all to the CSP2 CR w3c/webappsec-upgrade-insecure-requests#1.
-
-
1 pull request received 1 new comment.
-
Make the refs to CSP all to the CSP2 CR w3c/webappsec-upgrade-insecure-requests#1 (1 comment by @mikewest)
-
TR publications
-
1 document published.
-
Subresource Integrity published as a Working Draft. History of Subresource Integrity
-
Participants
-
2 organizations joined.
-
Viacom inc. joined.
-
WIZVERA Co., Ltd. joined.
-
GitHub
w3c/webappsec
-
19 issues opened.
-
CREDENTIAL: could we make it easier to extend? w3c/webappsec#490, by @jonathanKingston.
-
CSP: connect-src 'self' and websockets w3c/webappsec#489, by @klings.
-
SRI: add a note about data: and blob: URLs w3c/webappsec#487, by @fmarier.
-
SRI: needs integration with whatwg/html w3c/webappsec#486, by @annevk.
-
CSP: form-action and redirects w3c/webappsec#482, by @ptoomey3.
-
CSP2: copy/paste bug in `default-src` definition. w3c/webappsec#481, by @mikewest.
-
Add test cases for jar: scheme w3c/webappsec#479, by @hillbrad.
-
SECURE: Consider expanding definition of "potentially trustworthy". w3c/webappsec#478, by @mikewest.
-
SRI: upgrade examples to sha384? w3c/webappsec#477, by @fmarier.
-
CSP section 4.2.2 step 8 restricts loopback allowance to 127.0.0.1 w3c/webappsec#476, by @michaelficarra.
-
CSP section 4.2.2 step 2 performs case sensitive test for url scheme w3c/webappsec#475, by @michaelficarra.
-
CSP: Consider an opt-in cascade model. w3c/webappsec#474, by @mikewest.
-
CSP: Tests references in implementation report aren't in the repo. w3c/webappsec#473, by @mikewest.
-
UPGRADE: wrong redirect status code in example. w3c/webappsec#472, by @ylafon.
-
Referrer policy and Ping-From/Ping-To headers w3c/webappsec#469, by @annevk.
-
Inline event handlers not whitelisted by hashes? w3c/webappsec#468, by @kravietz.
-
CSP: Provide source of violation in SecurityPolicyViolationEvents w3c/webappsec#467, by @lweichselbaum.
-
MIX: Drop 'Request::context' and 'Request::frame type'. w3c/webappsec#465, by @mikewest.
-
Nonce attribute for Web Worker w3c/webappsec#464, by @I-Shamrai.
-
-
20 issues closed.
-
SRI: explain CORS requirement clearly w3c/webappsec#418.
-
SRI: stable references to Fetch w3c/webappsec#428.
-
SRI: upgrade examples to sha384? w3c/webappsec#477.
-
open source license w3c/webappsec#425.
-
SRI: Clarify how to handle non-eligible and invalid metadata w3c/webappsec#317.
-
Fix broken links throughout spec w3c/webappsec#440.
-
SRI: explore the idea of removing the CORS requirement w3c/webappsec#338.
-
SECURE: determining if settings is secure in SharedWorker w3c/webappsec#406.
-
CSP: Tests references in implementation report aren't in the repo. w3c/webappsec#473.
-
SECURE: Consider expanding definition of "potentially trustworthy". w3c/webappsec#478.
-
UPGRADE: wrong redirect status code in example. w3c/webappsec#472.
-
SECURE: DOM-exposed property? w3c/webappsec#263.
-
POWER: Privileged Contexts -> Secure Contexts w3c/webappsec#264.
-
CREDENTIAL: Add a privacy concern regarding editing credential metadata. w3c/webappsec#381.
-
MIX: Drop 'Request::context' and 'Request::frame type'. w3c/webappsec#465.
-
CREDENTIAL: Clean up language around 'lowest common ancestor'. w3c/webappsec#289.
-
CREDENTIAL: Define structured clones. w3c/webappsec#287.
-
CREDENTIAL: Chooser Leakage w3c/webappsec#246.
-
CREDENTIAL: Introduce a new request context? w3c/webappsec#231.
-
CREDENTIAL: use fetch() w3c/webappsec#241.
-
-
28 issues received 114 new comments.
-
SECURE: determining if settings is secure in SharedWorker w3c/webappsec#406 (16 comments by @annevk, @dbaron, @diracdeltas, @mikewest, @slightlyoff, @wanderview)
-
CSP: Consider an opt-in cascade model. w3c/webappsec#474 (11 comments by @briansmith, @deian, @hillbrad, @jonathanKingston, @mikewest)
-
SRI: upgrade examples to sha384? w3c/webappsec#477 (10 comments by @devd, @fmarier, @joelweinberger, @jonathanKingston, @mozfreddyb)
-
Inline event handlers not whitelisted by hashes? w3c/webappsec#468 (6 comments by @hillbrad, @kravietz, @mikewest)
-
Referrer policy and Ping-From/Ping-To headers w3c/webappsec#469 (5 comments by @annevk, @jeisinger, @mikewest)
-
CSP2: copy/paste bug in `default-src` definition. w3c/webappsec#481 (3 comments by @hillbrad, @mikewest)
-
CSP section 4.2.2 step 8 restricts loopback allowance to 127.0.0.1 w3c/webappsec#476 (3 comments by @hillbrad, @michaelficarra, @mikewest)
-
[SRI] Support signatures/asymm key w3c/webappsec#449 (3 comments by @devd, @ghost, @jonathanKingston)
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec#380 (3 comments by @hillbrad, @mikewest)
-
CREDENTIAL: could we make it easier to extend? w3c/webappsec#490 (2 comments by @jonathanKingston, @mikewest)
-
SECURE: Consider expanding definition of "potentially trustworthy". w3c/webappsec#478 (2 comments by @mikewest, @sleevi)
-
CSP section 4.2.2 step 2 performs case sensitive test for url scheme w3c/webappsec#475 (2 comments by @hillbrad, @michaelficarra)
-
CSP: Tests references in implementation report aren't in the repo. w3c/webappsec#473 (2 comments by @hillbrad)
-
SRI: Clarify how to handle non-eligible and invalid metadata w3c/webappsec#317 (1 comment by @fmarier)
-
CSP: Provide source of violation in SecurityPolicyViolationEvents w3c/webappsec#467 (1 comment by @mikewest)
-
CREDENTIAL: Credential scope should not be limited to login w3c/webappsec#256 (1 comment by @mikewest)
-
CREDENTIAL: Clean up language around 'lowest common ancestor'. w3c/webappsec#289 (1 comment by @mikewest)
-
-
10 pull requests opened.
-
SRI: Add response tainting to the eligibility algorithm (fixes #487) w3c/webappsec#492, by @fmarier.
-
Update date and status of Web Workers w3c/webappsec#491, by @AFBarstow.
-
Rewrite instance of SHA256 to SHA384, see issue #477 w3c/webappsec#488, by @mozfreddyb.
-
SRI: clarify the CORS requirement in security considerations (fixes #418) w3c/webappsec#485, by @fmarier.
-
SRI: fix broken links in the spec and upgrade them to HTTPS (fixes #440) w3c/webappsec#484, by @fmarier.
-
COWL: add to README index w3c/webappsec#483, by @deian.
-
remove unnecessary "a" in CSP 4.2.2 step 2 w3c/webappsec#480, by @michaelficarra.
-
Minor: Use gender neutral term for users w3c/webappsec#471, by @craigfrancis.
-
Typo: "requirments" -> "requirements" w3c/webappsec#470, by @konklone.
-
COWL: intial commit towards FPWD w3c/webappsec#466, by @deian.
-
-
11 pull requests merged.
-
Update date and status of Web Workers w3c/webappsec#491.
-
SRI: clarify the CORS requirement in security considerations (fixes #418) w3c/webappsec#485.
-
Rewrite instance of SHA256 to SHA384, see issue #477 w3c/webappsec#488.
-
SRI: remove "Fetch Modifications" section w3c/webappsec#460.
-
SRI: re-introduce the distinction between empty and invalid metadata w3c/webappsec#455.
-
SRI: fix broken links in the spec and upgrade them to HTTPS (fixes #440) w3c/webappsec#484.
-
COWL: add to README index w3c/webappsec#483.
-
remove unnecessary "a" in CSP 4.2.2 step 2 w3c/webappsec#480.
-
COWL: intial commit towards FPWD w3c/webappsec#466.
-
Minor: Use gender neutral term for users w3c/webappsec#471.
-
Typo: "requirments" -> "requirements" w3c/webappsec#470.
-
-
11 pull requests received 35 new comments.
-
SRI: clarify the CORS requirement in security considerations (fixes #418) w3c/webappsec#485 (7 comments by @devd, @fmarier, @joelweinberger, @jonathanKingston, @mozfreddyb)
-
COWL: intial commit towards FPWD w3c/webappsec#466 (7 comments by @deian, @jonathanKingston, @mikewest)
-
SRI: remove "Fetch Modifications" section w3c/webappsec#460 (5 comments by @fmarier, @joelweinberger, @sideshowbarker)
-
SRI: re-introduce the distinction between empty and invalid metadata w3c/webappsec#455 (4 comments by @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
SRI: fix broken links in the spec and upgrade them to HTTPS (fixes #440) w3c/webappsec#484 (4 comments by @devd, @fmarier, @joelweinberger)
-
w3c/permissions
-
4 issues opened.
-
navigator.permissions.request w3c/permissions#48, by @jimmywarting.
-
Add "nfc" to enum PermissionName w3c/permissions#47, by @zolkis.
-
Consider removing Permissions.revoke(). w3c/permissions#46, by @martinthomson.
-
Add screen sharing permissions w3c/permissions#45, by @martinthomson.
-
-
1 issue received 4 new comments.
-
Consider removing Permissions.revoke(). w3c/permissions#46 (4 comments by @martinthomson, @mounirlamouri)
-
TR publications
-
1 document published.
-
Clear Site Data published as a First Public Working Draft. History of Clear Site Data
-
Participants
-
3 participants joined.
-
Dan Kaminsky (HUMAN) joined.
-
Josh Soref (W3C Invited Experts) joined.
-
Kristijan Burnik (W3C Invited Experts) joined.
-
GitHub
w3c/webappsec
-
13 issues opened.
-
CSP: Define 'nonce' processing hooks for HTML. w3c/webappsec#463, by @mikewest.
-
CSP: frame-ancestors grammar doesn't match what browsers implement w3c/webappsec#461, by @shekyan.
-
CSP: Consider allowing `frame-ancestors` to work for subresource loads. w3c/webappsec#458, by @mikewest.
-
CSP: Evaluate a JSON syntax. w3c/webappsec#457, by @mikewest.
-
referrer source from (dedicated | shared) workers w3c/webappsec#456, by @yutakahirano.
-
[SRI] Integrity option in importScripts w3c/webappsec#454, by @matthewbauer.
-
CSP: Deal with local schemes in new browsing contexts? w3c/webappsec#451, by @mikewest.
-
[SRI] Shorter hashes w3c/webappsec#450, by @devd.
-
[SRI] Support signatures/asymm key w3c/webappsec#449, by @devd.
-
CSP: form-nonce directive w3c/webappsec#448, by @btoews.
-
EPR: Provide a way to apply a policy to a path (instead of a whole domain) w3c/webappsec#447, by @anishathalye.
-
CREDENTIAL: requestAutocomplete can already provide local credentials w3c/webappsec#445, by @mnoorenberghe.
-
Non-normative pointer to Fetch is wrong w3c/webappsec#443, by @annevk.
-
-
3 issues closed.
-
CSP: frame-ancestors grammar doesn't match what browsers implement w3c/webappsec#461.
-
referrer source from (dedicated | shared) workers w3c/webappsec#456.
-
Non-normative pointer to Fetch is wrong w3c/webappsec#443.
-
-
17 issues received 51 new comments.
-
CREDENTIAL: requestAutocomplete can already provide local credentials w3c/webappsec#445 (8 comments by @AxelNennker, @jonathanKingston, @mikewest, @mnoorenberghe)
-
[SRI] Support signatures/asymm key w3c/webappsec#449 (7 comments by @annevk, @devd, @hillbrad, @jonathanKingston)
-
referrer source from (dedicated | shared) workers w3c/webappsec#456 (6 comments by @annevk, @yutakahirano)
-
CSP: frame-ancestors grammar doesn't match what browsers implement w3c/webappsec#461 (4 comments by @mikewest, @shekyan)
-
CSP: Consider allowing `frame-ancestors` to work for subresource loads. w3c/webappsec#458 (4 comments by @annevk, @briansmith, @hillbrad)
-
CSP: Deal with local schemes in new browsing contexts? w3c/webappsec#451 (2 comments by @hillbrad, @mikewest)
-
Allow public-key signatures in CSP allowed script sources w3c/webappsec#436 (2 comments by @fmarier, @mikewest)
-
EPR: Provide a way to apply a policy to a path (instead of a whole domain) w3c/webappsec#447 (2 comments by @anishathalye, @mikewest)
-
CREDENTIAL: Support generation of passwords from LocalCredential w3c/webappsec#250 (1 comment by @jonathanKingston)
-
SRI: add a distinction between "unknown algorithm" and "known insecure algorithm" w3c/webappsec#342 (1 comment by @fmarier)
-
-
8 pull requests opened.
-
address review comments by timeless w3c/webappsec#462, by @hillbrad.
-
SRI: remove "Fetch Modifications" section w3c/webappsec#460, by @fmarier.
-
Explore automatic publication with Travis & Echidna w3c/webappsec#459, by @tripu.
-
SRI: re-introduce the distinction between empty and invalid metadata w3c/webappsec#455, by @fmarier.
-
Credential Manager API. Use get instead of request. w3c/webappsec#453, by @tehhi.
-
Credential Manager API. Use store instead of notifySignIn. w3c/webappsec#452, by @tehhi.
-
Fix typo w3c/webappsec#446, by @taravancil.
-
fixing typos w3c/webappsec#444, by @dret.
-
-
7 pull requests merged.
-
address review comments by timeless w3c/webappsec#462.
-
SRI: Alphabetize authors w3c/webappsec#442.
-
SRI: Francois' review of the spec w3c/webappsec#431.
-
Credential Manager API. Use get instead of request. w3c/webappsec#453.
-
Credential Manager API. Use store instead of notifySignIn. w3c/webappsec#452.
-
Fail closed on CORS failures w3c/webappsec#437.
-
fixing typos w3c/webappsec#444.
-
-
1 pull request closed.
-
Fix typo w3c/webappsec#446.
-
-
10 pull requests received 27 new comments.
-
SRI: re-introduce the distinction between empty and invalid metadata w3c/webappsec#455 (7 comments by @devd, @fmarier)
-
Explore automatic publication with Travis & Echidna w3c/webappsec#459 (3 comments by @hillbrad, @mikewest, @tripu)
-
Credential Manager API. Use store instead of notifySignIn. w3c/webappsec#452 (1 comment by @mikewest)
-
w3c/permissions
-
1 pull request opened.
-
Minor editorial fixes w3c/permissions#44, by @overholt.
-
TR publications
-
2 documents published.
-
Content Security Policy Level 2 published as a Candidate Recommendation Snapshot. History of Content Security Policy Level 2
-
Subresource Integrity published as a Working Draft. History of Subresource Integrity
-
GitHub
w3c/webappsec
-
15 issues opened.
-
Fix broken links throughout spec w3c/webappsec#440, by @joelweinberger.
-
Allow public-key signatures in CSP allowed script sources w3c/webappsec#436, by @ekobrin.
-
CSP: Provide a way to restrict domain of document.cookie w3c/webappsec#432, by @kentonv.
-
CLEAR: grammar nit w3c/webappsec#429, by @mozfreddyb.
-
SRI: stable references to Fetch w3c/webappsec#428, by @fmarier.
-
open source license w3c/webappsec#425, by @marionrenz26.
-
MIX: Link "deprecated authentication" to HTTPS State. w3c/webappsec#424, by @mikewest.
-
Ambitious charter timeline w3c/webappsec#421, by @jonathanKingston.
-
SRI: explain CORS requirement clearly w3c/webappsec#418, by @jonathanKingston.
-
Mixed Content: fetch() in service workers broken w3c/webappsec#415, by @annevk.
-
REFERRER: Examples w3c/webappsec#414, by @craigfrancis.
-
Referrer and cross-origin CSS w3c/webappsec#413, by @annevk.
-
Mixed Content: express UI requirements imperatively w3c/webappsec#412, by @annevk.
-
-
9 issues closed.
-
Typos w3c/webappsec#434.
-
CLEAR: grammar nit w3c/webappsec#429.
-
Referrer and cross-origin CSS w3c/webappsec#413.
-
UPGRADE: `Request` is a `dfn`, not an `interface`. w3c/webappsec#234.
-
UPGRADE: Rework 'navigation set'. w3c/webappsec#295.
-
UPGRADE: Note the archivist's perspective. w3c/webappsec#208.
-
Clarify examples. w3c/webappsec#226.
-
Ambitious charter timeline w3c/webappsec#421.
-
SRI: Respond to mnot comments w3c/webappsec#217.
-
-
1 issue reopened.
-
SRI: Clarify how to handle non-eligible and invalid metadata w3c/webappsec#317, by @fmarier.
-
-
23 issues received 129 new comments.
-
SRI: Clarify how to handle non-eligible and invalid metadata w3c/webappsec#317 (20 comments by @annevk, @fmarier, @hillbrad, @joelweinberger, @jonathanKingston, @mozfreddyb, @slightlyoff)
-
Referrer and cross-origin CSS w3c/webappsec#413 (18 comments by @annevk, @jeisinger, @mikewest, @sicking)
-
Referrer attribute and Fetch integration w3c/webappsec#409 (14 comments by @annevk, @briansmith, @fmarier, @jeisinger, @mikewest, @sc0ttbeardsley)
-
SRI: explain CORS requirement clearly w3c/webappsec#418 (13 comments by @annevk, @devd, @fmarier, @joelweinberger, @jonathanKingston, @mozfreddyb)
-
CSP: Provide a way to restrict domain of document.cookie w3c/webappsec#432 (8 comments by @annevk, @hillbrad, @kentonv, @mikewest, @paulproteus)
-
REFERRER: `origin` shouldn't send a trailing `/`. w3c/webappsec#382 (7 comments by @annevk, @briansmith, @franziskuskiefer, @kristijanburnik)
-
CSP: Specify response checking. w3c/webappsec#227 (6 comments by @annevk, @mikewest, @sicking, @wanderview)
-
Clarify handling of style attribute vs. individual elements contributing to computed style w3c/webappsec#423 (3 comments by @annevk, @jonathanKingston)
-
Mixed Content: express UI requirements imperatively w3c/webappsec#412 (3 comments by @annevk, @mikewest)
-
Mixed Content: fetch() in service workers broken w3c/webappsec#415 (3 comments by @annevk, @mikewest)
-
REFERRER: Allowed values for the referrer attribute w3c/webappsec#408 (2 comments by @franziskuskiefer, @sc0ttbeardsley)
-
-
17 pull requests opened.
-
SRI: Alphabetize authors w3c/webappsec#442, by @joelweinberger.
-
SRI: Fix broken links w3c/webappsec#441, by @joelweinberger.
-
CLEAR: typo fix for CSRF w3c/webappsec#439, by @jonathanKingston.
-
CSP: Fix example description. w3c/webappsec#438, by @kristijanburnik.
-
Fail closed on CORS failures w3c/webappsec#437, by @joelweinberger.
-
fixing typos w3c/webappsec#433, by @dret.
-
SRI: Francois' review of the spec w3c/webappsec#431, by @fmarier.
-
CLEAR: fixes #429 w3c/webappsec#430, by @mozfreddyb.
-
[Credential manager API test] Creation of local credentials support old and new names. w3c/webappsec#427, by @tehhi.
-
SRI: Changing rel value to keyword for matching stylesheets w3c/webappsec#426, by @jonathanKingston.
-
Remove note about non CORS load w3c/webappsec#422, by @devd.
-
Fixing some markup errors in the charter w3c/webappsec#420, by @jonathanKingston.
-
Mixed content upgrades w3c/webappsec#419, by @fmarier.
-
Webex details differ for this meeting w3c/webappsec#417, by @wseltzer.
-
Notes re HTTPS migration for W3C w3c/webappsec#416, by @wseltzer.
-
RFC: Replace resource with response w3c/webappsec#411, by @devd.
-
-
13 pull requests merged.
-
SRI: Fix broken links w3c/webappsec#441.
-
CLEAR: typo fix for CSRF w3c/webappsec#439.
-
CSP: Fix example description. w3c/webappsec#438.
-
fixing typos w3c/webappsec#433.
-
Fixing some markup errors in the charter w3c/webappsec#420.
-
Remove note about non CORS load w3c/webappsec#422.
-
CLEAR: fixes #429 w3c/webappsec#430.
-
SRI: Changing rel value to keyword for matching stylesheets w3c/webappsec#426.
-
Webex details differ for this meeting w3c/webappsec#417.
-
Notes re HTTPS migration for W3C w3c/webappsec#416.
-
SRI: no need to add "Cache-Control: no-transform" w3c/webappsec#403.
-
RFC: Replace resource with response w3c/webappsec#411.
-
-
1 pull request closed.
-
Clarify getPrioritizedHashFunction in Note w3c/webappsec#410.
-
-
16 pull requests received 81 new comments.
-
SRI: Francois' review of the spec w3c/webappsec#431 (16 comments by @annevk, @fmarier, @jonathanKingston, @mozfreddyb, @sideshowbarker)
-
rename 'referrer' attribute to 'referrerpolicy', make rel=noreferrer take priority w3c/webappsec#435 (14 comments by @annevk, @jeisinger, @mikewest, @sc0ttbeardsley)
-
Fail closed on CORS failures w3c/webappsec#437 (14 comments by @annevk, @devd, @fmarier, @joelweinberger, @jonathanKingston)
-
RFC: Replace resource with response w3c/webappsec#411 (8 comments by @annevk, @devd, @fmarier, @joelweinberger, @mnot)
-
SRI: Changing rel value to keyword for matching stylesheets w3c/webappsec#426 (6 comments by @fmarier, @joelweinberger, @jonathanKingston, @mozfreddyb)
-
Fixing some markup errors in the charter w3c/webappsec#420 (2 comments by @jonathanKingston, @mozfreddyb)
-
[Credential manager API test] Creation of local credentials support old and new names. w3c/webappsec#427 (1 comment by @mikewest)
-
w3c/permissions
-
1 issue opened.
-
Permissions may change status in other ways than "trying to access" w3c/permissions#43, by @alvestrand.
-
-
2 issues received 6 new comments.
TR publications
-
1 document published.
-
Entry Point Regulation published as a First Public Working Draft. History of Entry Point Regulation
-
Participants
-
1 participant joined.
-
Jonathan Kingston (Duck Duck Go, Inc.) joined.
-
-
1 organization joined.
-
Samsung Electronics Co., Ltd. joined.
-
GitHub
w3c/permissions
-
4 issues opened.
-
Allow query with a DOMString value w3c/permissions#42, by @annevk.
-
Add permissions.request() w3c/permissions#41, by @mounirlamouri.
-
Add permissions.revoke() w3c/permissions#40, by @mounirlamouri.
-
Add persistent storage w3c/permissions#39, by @mounirlamouri.
-
-
11 issues closed.
-
Tackle origin w3c/permissions#34.
-
Add permissions.revoke() w3c/permissions#40.
-
Rename PermissionStatus.status to PermissionStatus.state w3c/permissions#31.
-
Add Promise.all() example for multiple queries w3c/permissions#19.
-
Privacy Considerations w3c/permissions#22.
-
Why "prompt" instead of "default"? w3c/permissions#25.
-
Extensibility: make sure we have it right w3c/permissions#17.
-
Should we have a more explicit enumerating process? w3c/permissions#13.
-
Remove global variables w3c/permissions#35.
-
status of this document: reached FPWD w3c/permissions#36.
-
Geolocation API does not leave the page unaware of permission status w3c/permissions#30.
-
-
11 issues received 16 new comments.
-
Why "prompt" instead of "default"? w3c/permissions#25 (2 comments by @martinthomson, @mounirlamouri)
-
Should we have a more explicit enumerating process? w3c/permissions#13 (1 comment by @mounirlamouri)
-
Geolocation API does not leave the page unaware of permission status w3c/permissions#30 (1 comment by @mounirlamouri)
-
What should "retrieve the permission state" do for pickers? w3c/permissions#8 (1 comment by @jonathanKingston)
-
2 pull requests opened.
-
grammar nits w3c/permissions#38, by @hillbrad.
-
Added Editor IDs w3c/permissions#37, by @marcoscaceres.
-
-
2 pull requests merged.
-
grammar nits w3c/permissions#38.
-
Added Editor IDs w3c/permissions#37.
-
w3c/webappsec
-
7 issues opened.
-
Referrer attribute and Fetch integration w3c/webappsec#409, by @annevk.
-
REFERRER: Allowed values for the referrer attribute w3c/webappsec#408, by @franziskuskiefer.
-
SECURE: determining if settings is secure in SharedWorker w3c/webappsec#406, by @wanderview.
-
CSP: specify whether unsafe-inline or unsafe-eval was violated in violation reports w3c/webappsec#401, by @pames.
-
CSP: Refused to execute inline script even with a valid sha1 or sha256 w3c/webappsec#400, by @WebReflection.
-
SRI: Consider adding <svg:script> with the same behavior as <html:script> w3c/webappsec#396, by @erikdahlstrom.
-
Nit regarding SecurityPolicyViolationEventInit section header. w3c/webappsec#392, by @mikewest.
-
-
9 issues closed.
-
[EPR] re-use Fetch terminology for requests w/o credentials w3c/webappsec#374.
-
[MIX] Sandboxed iframes as optionally-blockable Content w3c/webappsec#179.
-
[EPR] clarify behavior when EPR:1 header not set w3c/webappsec#375.
-
SRI: additional Acknowledgements? w3c/webappsec#362.
-
SRI: Integration with Fetch w3c/webappsec#238.
-
SRI: explain how to parse tokens w3c/webappsec#366.
-
SRI: note about CORS headers for resources behind firewalls w3c/webappsec#337.
-
SRI: should integrity checks be restricted to 200 responses? w3c/webappsec#384.
-
-
1 issue reopened.
-
SRI: Clarify how to handle non-eligible and invalid metadata w3c/webappsec#317, by @fmarier.
-
-
19 issues received 94 new comments.
-
SRI: Clarify how to handle non-eligible and invalid metadata w3c/webappsec#317 (39 comments by @devd, @fmarier, @joelweinberger, @mikewest, @mozfreddyb)
-
SECURE: determining if settings is secure in SharedWorker w3c/webappsec#406 (5 comments by @annevk, @mikewest)
-
SRI: should integrity checks be restricted to 200 responses? w3c/webappsec#384 (5 comments by @devd, @joelweinberger)
-
[EPR] clarify interaction with Access-Control-* headers for CORS requests/responses w3c/webappsec#376 (3 comments by @annevk, @randomdross)
-
CSP: Refused to execute inline script even with a valid sha1 or sha256 w3c/webappsec#400 (3 comments by @mathiasbynens, @WebReflection)
-
SRI: Consider adding <svg:script> with the same behavior as <html:script> w3c/webappsec#396 (2 comments by @annevk, @joelweinberger)
-
SRI: note about CORS headers for resources behind firewalls w3c/webappsec#337 (2 comments by @annevk, @devd)
-
[EPR] Resolve whether EPR manifest is like a WebApp Manifest or a /.well-known w3c/webappsec#373 (1 comment by @randomdross)
-
[EPR] re-use Fetch terminology for requests w/o credentials w3c/webappsec#374 (1 comment by @randomdross)
-
REFERRER: Specify redirection behavior or include links to relevant specs w3c/webappsec#386 (1 comment by @annevk)
-
[SRI] "Authorization" is a request header, not a resource (response) header w3c/webappsec#345 (1 comment by @joelweinberger)
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec#380 (1 comment by @adrifelt)
-
Nit regarding SecurityPolicyViolationEventInit section header. w3c/webappsec#392 (1 comment by @foolip)
-
-
12 pull requests opened.
-
Clarify getPrioritizedHashFunction in Note w3c/webappsec#410, by @Broetchen1234.
-
Lowercase 'must' regarding priority of hash functions w3c/webappsec#407, by @joelweinberger.
-
remove cache-control bits w3c/webappsec#405, by @devd.
-
SRI: add francois' website URL w3c/webappsec#404, by @fmarier.
-
SRI: no need to add "Cache-Control: no-transform" w3c/webappsec#403, by @fmarier.
-
SRI: Acknowledge more w3c/webappsec#402, by @devd.
-
SRI: Add website url for author w3c/webappsec#399, by @joelweinberger.
-
Add integrity attribute to Request class interface w3c/webappsec#398, by @joelweinberger.
-
Define token parsing per section on integrity metadata w3c/webappsec#397, by @devd.
-
Fixed broken syntax in template (missing ':' after mailto). w3c/webappsec#395, by @joelweinberger.
-
SRI: Fail open on ineligible w3c/webappsec#394, by @joelweinberger.
-
Clarify getPrioritizedHashFunction in Note w3c/webappsec#393, by @devd.
-
-
10 pull requests merged.
-
Lowercase 'must' regarding priority of hash functions w3c/webappsec#407.
-
SRI: Acknowledge more w3c/webappsec#402.
-
SRI: add francois' website URL w3c/webappsec#404.
-
Point to right chunk of CSP ABNF for hash syntax w3c/webappsec#356.
-
Define token parsing per section on integrity metadata w3c/webappsec#397.
-
SRI: Add website url for author w3c/webappsec#399.
-
Add integrity attribute to Request class interface w3c/webappsec#398.
-
SRI: Simplify the element modifications to just set integrity metadata w3c/webappsec#391.
-
SRI: Fail open on ineligible w3c/webappsec#394.
-
Fixed broken syntax in template (missing ':' after mailto). w3c/webappsec#395.
-
-
2 pull requests closed.
-
remove cache-control bits w3c/webappsec#405.
-
Clarify getPrioritizedHashFunction in Note w3c/webappsec#393.
-
-
11 pull requests received 42 new comments.
-
SRI: Simplify the element modifications to just set integrity metadata w3c/webappsec#391 (11 comments by @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
Lowercase 'must' regarding priority of hash functions w3c/webappsec#407 (7 comments by @annevk, @fmarier, @joelweinberger)
-
Point to right chunk of CSP ABNF for hash syntax w3c/webappsec#356 (5 comments by @devd, @fmarier, @manger)
-
Define token parsing per section on integrity metadata w3c/webappsec#397 (3 comments by @devd, @fmarier)
-
SRI: no need to add "Cache-Control: no-transform" w3c/webappsec#403 (2 comments by @annevk, @fmarier)
-
Add integrity attribute to Request class interface w3c/webappsec#398 (2 comments by @annevk, @joelweinberger)
-
TR publications
-
1 document published.
-
Subresource Integrity published as a Working Draft. History of Subresource Integrity
-
Participants
-
7 organizations joined.
-
imec joined.
-
Cable Television Laboratories Inc joined.
-
Tencent joined.
-
eBay joined.
-
AT&T joined.
-
International Webmasters Association (IWA) joined.
-
Microsoft Corporation joined.
-
GitHub
w3c/webappsec
-
32 issues opened.
-
SRI: make it clear that getPrioritizedHashFunction() is not exposed by user agents w3c/webappsec#387, by @fmarier.
-
REFERRER: Specify redirection behavior or include links to relevant specs w3c/webappsec#386, by @kristijanburnik.
-
SRI: should integrity checks be restricted to 200 responses? w3c/webappsec#384, by @fmarier.
-
REFERRER: `origin` shouldn't send a trailing `/`. w3c/webappsec#382, by @mikewest.
-
CREDENTIAL: Add a privacy concern regarding editing credential metadata. w3c/webappsec#381, by @mikewest.
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec#380, by @mikewest.
-
REFERRER: Specify delivery method precedence and how to resolve overrides w3c/webappsec#379, by @kristijanburnik.
-
[EPR] clarify interaction with Access-Control-* headers for CORS requests/responses w3c/webappsec#376, by @hillbrad.
-
[EPR] clarify behavior when EPR:1 header not set w3c/webappsec#375, by @hillbrad.
-
[EPR] re-use Fetch terminology for requests w/o credentials w3c/webappsec#374, by @hillbrad.
-
[EPR] Resolve whether EPR manifest is like a WebApp Manifest or a /.well-known w3c/webappsec#373, by @hillbrad.
-
[CSP] Broaden nonce-value grammar w3c/webappsec#370, by @shekyan.
-
SRI: support for multiple hashes with the same algorithm w3c/webappsec#367, by @devd.
-
SRI: explain how to parse tokens w3c/webappsec#366, by @devd.
-
[CSP] base64-value grammar doesn't allow for alternative 63rd and 64th characters w3c/webappsec#364, by @shekyan.
-
reconcile/cross reference CSP and SRI hash behaviors w3c/webappsec#363, by @hakanson.
-
SRI: additional Acknowledgements? w3c/webappsec#362, by @mozfreddyb.
-
[CSP] path-part should be represented by path-abempty w3c/webappsec#361, by @shekyan.
-
Redirects and SRI w3c/webappsec#357, by @devd.
-
[CSP] Enforcing CSP for Service Workers w3c/webappsec#350, by @jungkees.
-
[SRI] getPrioritizedHash should use the hash-source production prefix w3c/webappsec#347, by @hillbrad.
-
[SRI] getPrioritizedHashFunction should be a normative definition w3c/webappsec#346, by @hillbrad.
-
[SRI] "Authorization" is a request header, not a resource (response) header w3c/webappsec#345, by @hillbrad.
-
SRI: should we leave the options completely unspecified? w3c/webappsec#343, by @fmarier.
-
SRI: add a distinction between "unknown algorithm" and "known insecure algorithm" w3c/webappsec#342, by @fmarier.
-
SRI: explore the idea of removing the CORS requirement w3c/webappsec#338, by @fmarier.
-
SRI: note about CORS headers for resources behind firewalls w3c/webappsec#337, by @fmarier.
-
Broken link nist.gov PDF w3c/webappsec#331, by @tagawa.
-
[CREDENTIAL] OAuth 2.0 is not an authentication protocol w3c/webappsec#330, by @tbroyer.
-
REFERRER: Describe behavior for `about:blank` inheritance. w3c/webappsec#328, by @mikewest.
-
SRI: Cannot use jQuery in our example w3c/webappsec#327, by @fmarier.
-
-
21 issues closed.
-
SRI: support for multiple hashes with the same algorithm w3c/webappsec#367.
-
[SRI] "Authorization" is a request header, not a resource (response) header w3c/webappsec#345.
-
SRI: are there more problematic headers? w3c/webappsec#305.
-
SRI: Should the about: scheme be whitelisted? w3c/webappsec#319.
-
[SRI] Remove browser UI integrity use case? w3c/webappsec#321.
-
REFERRER: `origin` shouldn't send a trailing `/`. w3c/webappsec#382.
-
[SRI] getPrioritizedHashFunction should be a normative definition w3c/webappsec#346.
-
SRI: Broken markdown in Sections 3.1 and 3.2 w3c/webappsec#320.
-
[SRI] getPrioritizedHash should use the hash-source production prefix w3c/webappsec#347.
-
Redirects and SRI w3c/webappsec#357.
-
SRI: should we leave the options completely unspecified? w3c/webappsec#343.
-
CREDENTIAL: Credential Synthesis is open to abuse by browser vendors w3c/webappsec#279.
-
CREDENTIAL: send() value mismatch w3c/webappsec#310.
-
[CREDENTIAL] OAuth 2.0 is not an authentication protocol w3c/webappsec#330.
-
Broken link nist.gov PDF w3c/webappsec#331.
-
[SRI] Mention MIME-type chameleons in Security Considerations? w3c/webappsec#324.
-
[SRI] Mash-up use case is weak or wrong? w3c/webappsec#323.
-
[SRI] Avoid unnecessary gendered pronouns w3c/webappsec#322.
-
SRI: Cannot use jQuery in our example w3c/webappsec#327.
-
-
2 issues reopened.
-
[SRI] Remove browser UI integrity use case? w3c/webappsec#321, by @fmarier.
-
[SRI] Remove browser UI integrity use case? w3c/webappsec#321, by @fmarier.
-
-
30 issues received 116 new comments.
-
SRI: Should the about: scheme be whitelisted? w3c/webappsec#319 (11 comments by @annevk, @devd, @fmarier, @mikewest, @mozfreddyb)
-
[SRI] Remove browser UI integrity use case? w3c/webappsec#321 (9 comments by @devd, @fmarier, @hillbrad, @mozfreddyb)
-
CREDENTIAL: Extension points discussion suggests things that are not possible in Web IDL w3c/webappsec#349 (7 comments by @bzbarsky, @mikewest)
-
SRI: explore the idea of removing the CORS requirement w3c/webappsec#338 (7 comments by @annevk, @fmarier, @joelweinberger, @mikewest, @mozfreddyb)
-
SRI: support for multiple hashes with the same algorithm w3c/webappsec#367 (6 comments by @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
[SRI] getPrioritizedHashFunction should be a normative definition w3c/webappsec#346 (6 comments by @devd, @fmarier, @hillbrad, @mozfreddyb)
-
SRI: Broken markdown in Sections 3.1 and 3.2 w3c/webappsec#320 (6 comments by @darobin, @devd, @fmarier, @mozfreddyb)
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec#380 (5 comments by @adrifelt, @hillbrad, @mikewest, @terriko)
-
SRI: should integrity checks be restricted to 200 responses? w3c/webappsec#384 (4 comments by @devd, @fmarier)
-
SRI: are there more problematic headers? w3c/webappsec#305 (4 comments by @annevk, @devd, @hillbrad, @mozfreddyb)
-
POWER: Privileged Contexts -> Secure Contexts w3c/webappsec#264 (4 comments by @annevk, @diracdeltas, @torgo)
-
REFERRER: `origin` shouldn't send a trailing `/`. w3c/webappsec#382 (3 comments by @kristijanburnik, @mikewest)
-
SRI: should we leave the options completely unspecified? w3c/webappsec#343 (3 comments by @devd, @joelweinberger, @mikewest)
-
CREDENTIAL: Credential Synthesis is open to abuse by browser vendors w3c/webappsec#279 (3 comments by @adrianhopebailie, @mikewest)
-
[SRI] Mention MIME-type chameleons in Security Considerations? w3c/webappsec#324 (3 comments by @fmarier, @hillbrad, @mozfreddyb)
-
[SRI] "Authorization" is a request header, not a resource (response) header w3c/webappsec#345 (2 comments by @devd)
-
reconcile/cross reference CSP and SRI hash behaviors w3c/webappsec#363 (2 comments by @hakanson, @hillbrad)
-
[CSP] path-part should be represented by path-abempty w3c/webappsec#361 (1 comment by @michaelficarra)
-
CREDENTIAL: Why are all the interfaces [NoInterfaceObject] and using mixins instead of inheritance w3c/webappsec#309 (1 comment by @mikewest)
-
34 pull requests opened.
-
SRI: Simplify the element modifications to just set integrity metadata w3c/webappsec#391, by @joelweinberger.
-
SRI: stop whitelisting the `about` scheme (fix #319) w3c/webappsec#390, by @fmarier.
-
Fix typo: s/An resource's origin/A resource's origin/ w3c/webappsec#389, by @kristijanburnik.
-
SRI: add missing period w3c/webappsec#388, by @fmarier.
-
SRI: remove an unnecessary step w3c/webappsec#385, by @fmarier.
-
SRI: give more flexibility to user agents during hash deprecation period w3c/webappsec#383, by @fmarier.
-
SRI: Remove problematic headers section (fix #305) w3c/webappsec#378, by @fmarier.
-
Revert "getprioritizedhashfunction is not exposed to webapps" w3c/webappsec#377, by @mozfreddyb.
-
[EPR] grammar, spelling, terminology nits w3c/webappsec#372, by @hillbrad.
-
SRI: update hash deprecation wording w3c/webappsec#371, by @devd.
-
getprioritizedhashfunction is not exposed to webapps w3c/webappsec#369, by @devd.
-
CSP: fix broken hash value in 7.15.2 w3c/webappsec#368, by @michaelficarra.
-
Remove highlight class w3c/webappsec#365, by @devd.
-
CSP: link to definition of media-type-list in plugin-types definition w3c/webappsec#360, by @michaelficarra.
-
CSP: fix URLs for RFC5234 links w3c/webappsec#359, by @michaelficarra.
-
Use domains reserved for examples, complete examples, and consistent … w3c/webappsec#358, by @manger.
-
Point to right chunk of CSP ABNF for hash syntax w3c/webappsec#356, by @devd.
-
Recalculate hashes in agility section w3c/webappsec#355, by @devd.
-
alert example should escape quotes w3c/webappsec#354, by @devd.
-
SRI: sort authors alphabetically by first name w3c/webappsec#353, by @fmarier.
-
Remove UI integrity from UA use case w3c/webappsec#352, by @devd.
-
Use hash-source production prefix for getPrioritizedHashFunction w3c/webappsec#351, by @devd.
-
Mixed content algorithms unaffected by SRI w3c/webappsec#348, by @joelweinberger.
-
Change option-expression to be *VCHAR w3c/webappsec#344, by @joelweinberger.
-
update references to powerfulfeatures spec to use new name and dfns w3c/webappsec#341, by @hillbrad.
-
Referrer policy specification text fixes w3c/webappsec#340, by @kristijanburnik.
-
Please rename while we can w3c/webappsec#339, by @annevk.
-
POWER: Combine "Should X require priv. context" w/ threat model w3c/webappsec#336, by @diracdeltas.
-
Specify that user agents must ignore unrecognized option-expressions w3c/webappsec#335, by @joelweinberger.
-
fixing typos w3c/webappsec#334, by @dret.
-
SRI: Fixed broken link to the NIST hashing standard documentation (fixes #331) w3c/webappsec#333, by @tagawa.
-
SRI: Small fixes - two typos and two link corrections w3c/webappsec#332, by @tagawa.
-
Switch example to generic framework w3c/webappsec#329, by @devd.
-
SRI: Add missing closing tag w3c/webappsec#326, by @fmarier.
-
-
36 pull requests merged.
-
Mixed content algorithms unaffected by SRI w3c/webappsec#348.
-
SRI: Remove problematic headers section (fix #305) w3c/webappsec#378.
-
SRI: remove an unnecessary step w3c/webappsec#385.
-
SRI: add missing period w3c/webappsec#388.
-
SRI: stop whitelisting the `about` scheme (fix #319) w3c/webappsec#390.
-
CSP: fix broken hash value in 7.15.2 w3c/webappsec#368.
-
[EPR] grammar, spelling, terminology nits w3c/webappsec#372.
-
Fix typo: s/An resource's origin/A resource's origin/ w3c/webappsec#389.
-
SRI: give more flexibility to user agents during hash deprecation period w3c/webappsec#383.
-
SRI: simpler script HTML5 changes w3c/webappsec#315.
-
Revert "getprioritizedhashfunction is not exposed to webapps" w3c/webappsec#377.
-
getprioritizedhashfunction is not exposed to webapps w3c/webappsec#369.
-
alert example should escape quotes w3c/webappsec#354.
-
Remove highlight class w3c/webappsec#365.
-
CSP: link to definition of media-type-list in plugin-types definition w3c/webappsec#360.
-
CSP: fix URLs for RFC5234 links w3c/webappsec#359.
-
Use hash-source production prefix for getPrioritizedHashFunction w3c/webappsec#351.
-
Remove UI integrity from UA use case w3c/webappsec#352.
-
SRI: sort authors alphabetically by first name w3c/webappsec#353.
-
Use domains reserved for examples, complete examples, and consistent … w3c/webappsec#358.
-
SRI: simpler link HTML5 changes w3c/webappsec#313.
-
SRI: Allow non-eligible resources with empty integrity attributes w3c/webappsec#314.
-
Change option-expression to be *VCHAR w3c/webappsec#344.
-
update references to powerfulfeatures spec to use new name and dfns w3c/webappsec#341.
-
Please rename while we can w3c/webappsec#339.
-
Referrer policy specification text fixes w3c/webappsec#340.
-
POWER: Combine "Should X require priv. context" w/ threat model w3c/webappsec#336.
-
Specify that user agents must ignore unrecognized option-expressions w3c/webappsec#335.
-
fixing typos w3c/webappsec#334.
-
SRI: Small fixes - two typos and two link corrections w3c/webappsec#332.
-
SRI: Remove a redundant use case w3c/webappsec#298.
-
SRI: Add missing closing tag w3c/webappsec#326.
-
SRI: Remove unnecessary personal pronouns w3c/webappsec#286.
-
Switch example to generic framework w3c/webappsec#329.
-
Grammar nit, remove false modesty. w3c/webappsec#325.
-
-
3 pull requests closed.
-
Recalculate hashes in agility section w3c/webappsec#355.
-
SRI: update hash deprecation wording w3c/webappsec#371.
-
other way around password vs PasswordCredential w3c/webappsec#303.
-
-
34 pull requests received 101 new comments.
-
SRI: Add section Security Considerations: Behavior of chameleon resources w3c/webappsec#302 (17 comments by @awwright, @devd, @joelweinberger, @mozfreddyb)
-
SRI: give more flexibility to user agents during hash deprecation period w3c/webappsec#383 (7 comments by @devd, @fmarier, @gerv, @joelweinberger, @mozfreddyb)
-
SRI: Allow non-eligible resources with empty integrity attributes w3c/webappsec#314 (5 comments by @devd, @fmarier, @joelweinberger)
-
SRI: stop whitelisting the `about` scheme (fix #319) w3c/webappsec#390 (4 comments by @devd, @fmarier, @mozfreddyb)
-
SRI: Small fixes - two typos and two link corrections w3c/webappsec#332 (4 comments by @mozfreddyb, @tagawa)
-
CREDENTIAL: Generic matching algorithm w3c/webappsec#292 (3 comments by @adrianhopebailie, @mikewest)
-
getprioritizedhashfunction is not exposed to webapps w3c/webappsec#369 (3 comments by @fmarier, @mozfreddyb)
-
Referrer policy specification text fixes w3c/webappsec#340 (3 comments by @kristijanburnik, @mikewest)
-
SRI: Simplify the element modifications to just set integrity metadata w3c/webappsec#391 (2 comments by @devd, @joelweinberger)
-
Point to right chunk of CSP ABNF for hash syntax w3c/webappsec#356 (2 comments by @fmarier, @manger)
-
Specify that user agents must ignore unrecognized option-expressions w3c/webappsec#335 (2 comments by @devd, @joelweinberger)
-
CSP: link to definition of media-type-list in plugin-types definition w3c/webappsec#360 (1 comment by @mikewest)
-
Use domains reserved for examples, complete examples, and consistent … w3c/webappsec#358 (1 comment by @devd)
-
update references to powerfulfeatures spec to use new name and dfns w3c/webappsec#341 (1 comment by @mikewest)
-
POWER: Combine "Should X require priv. context" w/ threat model w3c/webappsec#336 (1 comment by @mikewest)
-
SRI: Fixed broken link to the NIST hashing standard documentation (fixes #331) w3c/webappsec#333 (1 comment by @tagawa)
-
w3c/permissions
-
4 issues opened.
-
status of this document: reached FPWD w3c/permissions#36, by @npdoty.
-
Remove global variables w3c/permissions#35, by @annevk.
-
Tackle origin w3c/permissions#34, by @annevk.
-
Define underlying infrastructure w3c/permissions#33, by @annevk.
-
-
5 issues received 23 new comments.
-
Why "prompt" instead of "default"? w3c/permissions#25 (15 comments by @annevk, @marcoscaceres, @martinthomson, @sicking, @travisleithead)
-
What should "retrieve the permission state" do for context related permissions? w3c/permissions#9 (1 comment by @martinthomson)
-
What should "retrieve the permission state" do for pickers? w3c/permissions#8 (1 comment by @martinthomson)
-
TR publications
-
5 documents published.
-
Privileged Contexts published as a Working Draft. History of Privileged Contexts
-
Upgrade Insecure Requests published as a Working Draft. History of Upgrade Insecure Requests
-
Subresource Integrity published as a Working Draft. History of Subresource Integrity
-
Credential Management Level 1 published as a First Public Working Draft. History of Credential Management Level 1
-
The Permissions API published as a First Public Working Draft. History of The Permissions API
-
Participants
-
5 participants joined.
-
Wendy Seltzer (W3C) joined.
-
Tobias Gondrom (W3C Invited Experts) joined.
-
Giorgio Maone (W3C Invited Experts) joined.
-
Michael[tm] Smith (sideshowbarker) (W3C) joined.
-
Keiji Takeda (W3C) joined.
-
-
13 organizations joined.
-
DigiCert SSL Certificate Authority joined.
-
Mitsubishi Electric Corporation joined.
-
Verisign, Inc. joined.
-
Adobe joined.
-
MITRE Corporation joined.
-
X joined.
-
Dropbox, Inc. joined.
-
Pacific Northwest National Laboratory joined.
-
Yandex joined.
-
Alibaba Group joined.
-
Baidu, Inc. joined.
-
Electronics and Telecommunications Research Institute (ETRI) joined.
-
Digital Bazaar joined.
-
GitHub
w3c/webappsec
-
62 issues opened.
-
[SRI] Mention MIME-type chameleons in Security Considerations? w3c/webappsec#324, by @hillbrad.
-
[SRI] Mash-up use case is weak or wrong? w3c/webappsec#323, by @hillbrad.
-
[SRI] Avoid unnecessary gendered pronouns w3c/webappsec#322, by @hillbrad.
-
[SRI] Remove browser UI integrity use case? w3c/webappsec#321, by @hillbrad.
-
SRI: Broken markdown in Sections 3.1 and 3.2 w3c/webappsec#320, by @fmarier.
-
SRI: Should the about: scheme be whitelisted? w3c/webappsec#319, by @fmarier.
-
SRI: Clarify how to handle non-eligible and invalid metadata w3c/webappsec#317, by @fmarier.
-
SRI: Do we need to make changes to HTML5's fetch too? w3c/webappsec#316, by @fmarier.
-
CSP: Change the scope of the Permissions API w3c/webappsec#312, by @andyearnshaw.
-
CSP: frame-ancestors should check origins, not URLs w3c/webappsec#311, by @dveditz.
-
CREDENTIAL: send() value mismatch w3c/webappsec#310, by @jonathanKingston.
-
SRI: consider the impact of integrity checks on `vary` headers w3c/webappsec#307, by @fmarier.
-
SRI: specify verification of CSS-loaded subresources w3c/webappsec#306, by @fmarier.
-
SRI: are there more problematic headers? w3c/webappsec#305, by @fmarier.
-
UPGRADE: Clarify cross-origin subresource upgrades. w3c/webappsec#301, by @mikewest.
-
UPGRADE: Rework 'navigation set'. w3c/webappsec#295, by @mikewest.
-
CREDENTIAL: mismatch of "type" value between note and example w3c/webappsec#294, by @AxelNennker.
-
CREDENTIAL: Give clear implementation advice. w3c/webappsec#290, by @mikewest.
-
CREDENTIAL: Clean up language around 'lowest common ancestor'. w3c/webappsec#289, by @mikewest.
-
CREDENTIAL: Apply hash functions before POSTing passwords? w3c/webappsec#288, by @mikewest.
-
CREDENTIAL: Define structured clones. w3c/webappsec#287, by @mikewest.
-
[SRI] freddy's review from april 20th, 2015 w3c/webappsec#280, by @mozfreddyb.
-
CREDENTIAL: Credential Synthesis is open to abuse by browser vendors w3c/webappsec#279, by @adrianhopebailie.
-
CREDENTIAL: filter is underdefined w3c/webappsec#273, by @annevk.
-
CREDENTIAL: document the reducing the carousel use case w3c/webappsec#272, by @annevk.
-
CREDENTIAL: expose type so you can avoid instanceof? w3c/webappsec#271, by @annevk.
-
CREDENTIAL: use "password" rather than "PasswordCredential" w3c/webappsec#270, by @annevk.
-
CREDENTIAL: unclear that store() returns a promise w3c/webappsec#269, by @annevk.
-
CREDENTIAL: requireUserMediation() does not return a promise w3c/webappsec#268, by @annevk.
-
CREDENTIAL: use Promise<void> w3c/webappsec#267, by @annevk.
-
CREDENTIAL: Use of FederatedCredential for federation protocols is unclear w3c/webappsec#266, by @adrianhopebailie.
-
CREDENTIAL: use [Exposed] w3c/webappsec#265, by @annevk.
-
POWER: Privileged Contexts -> Secure Contexts w3c/webappsec#264, by @annevk.
-
SECURE: DOM-exposed property? w3c/webappsec#263, by @mikewest.
-
POWER: IDL syntax? w3c/webappsec#262, by @annevk.
-
CREDENTIAL: replace "avatar" with "icon" or similar w3c/webappsec#261, by @hillbrad.
-
CREDENTIAL: federated example could be a bit more detailed w3c/webappsec#260, by @domenic.
-
CREDENTIAL: don't resolve promises with errors w3c/webappsec#259, by @domenic.
-
CREDENTIAL: avatarURL should be USVString w3c/webappsec#257, by @domenic.
-
CREDENTIAL: Credential scope should not be limited to login w3c/webappsec#256, by @dlongley.
-
CREDENTIAL: Use Linked Data for extending credentials w3c/webappsec#255, by @dlongley.
-
CREDENTIAL: Support 3rd party credential storage and retrieval protocol w3c/webappsec#254, by @dlongley.
-
CREDENTIAL: Note danger of storing data along with credentials. w3c/webappsec#253, by @mikewest.
-
CREDENTIAL: Explicitly describe the extension model. w3c/webappsec#252, by @mikewest.
-
CREDENTIAL: credential manager hook w3c/webappsec#251, by @jonathanKingston.
-
CREDENTIAL: Support generation of passwords from LocalCredential w3c/webappsec#250, by @jonathanKingston.
-
CREDENTIAL: boolean acceptPasswords = true; w3c/webappsec#249, by @annevk.
-
CREDENTIAL: expanding public suffix scope w3c/webappsec#248, by @annevk.
-
CREDENTIAL: avatar w3c/webappsec#247, by @annevk.
-
CREDENTIAL: Chooser Leakage w3c/webappsec#246, by @annevk.
-
CREDENTIAL: Reintroducing autocomplete="off" w3c/webappsec#245, by @annevk.
-
CREDENTIAL: Use case bullet point 3 is weak w3c/webappsec#244, by @annevk.
-
CREDENTIAL: LocalCredential constructor is not extensible w3c/webappsec#243, by @annevk.
-
CREDENTIAL: Local Sign-in example is broken w3c/webappsec#242, by @annevk.
-
CREDENTIAL: use fetch() w3c/webappsec#241, by @annevk.
-
SRI: add respec metadata for github & implementation status w3c/webappsec#239, by @mozfreddyb.
-
SRI: Integration with Fetch w3c/webappsec#238, by @annevk.
-
SRI: One resource, many representations. w3c/webappsec#235, by @mikewest.
-
-
32 issues closed.
-
SRI: Do we need to make changes to HTML5's fetch too? w3c/webappsec#316.
-
[SRI] freddy's review from april 20th, 2015 w3c/webappsec#280.
-
SRI: consider the impact of integrity checks on `vary` headers w3c/webappsec#307.
-
UPGRADE: Clarify cross-origin subresource upgrades. w3c/webappsec#301.
-
CREDENTIAL: mismatch of "type" value between note and example w3c/webappsec#294.
-
CREDENTIAL: Use of FederatedCredential for federation protocols is unclear w3c/webappsec#266.
-
ABNF bugs w3c/webappsec#214.
-
CREDENTIAL: document the reducing the carousel use case w3c/webappsec#272.
-
CREDENTIAL: Use case bullet point 3 is weak w3c/webappsec#244.
-
Revise eligibility algorithm to require CORS w3c/webappsec#207.
-
CREDENTIAL: credential manager hook w3c/webappsec#251.
-
CREDENTIAL: Explicitly describe the extension model. w3c/webappsec#252.
-
CREDENTIAL: Note danger of storing data along with credentials. w3c/webappsec#253.
-
SRI: add respec metadata for github & implementation status w3c/webappsec#239.
-
CREDENTIAL: expose type so you can avoid instanceof? w3c/webappsec#271.
-
CREDENTIAL: use "password" rather than "PasswordCredential" w3c/webappsec#270.
-
CREDENTIAL: filter is underdefined w3c/webappsec#273.
-
CREDENTIAL: use [Exposed] w3c/webappsec#265.
-
CREDENTIAL: use Promise<void> w3c/webappsec#267.
-
CREDENTIAL: requireUserMediation() does not return a promise w3c/webappsec#268.
-
CREDENTIAL: unclear that store() returns a promise w3c/webappsec#269.
-
CREDENTIAL: boolean acceptPasswords = true; w3c/webappsec#249.
-
CREDENTIAL: avatarURL should be USVString w3c/webappsec#257.
-
CREDENTIAL: don't resolve promises with errors w3c/webappsec#259.
-
CREDENTIAL: federated example could be a bit more detailed w3c/webappsec#260.
-
CREDENTIAL: replace "avatar" with "icon" or similar w3c/webappsec#261.
-
CREDENTIAL: LocalCredential constructor is not extensible w3c/webappsec#243.
-
CREDENTIAL: Local Sign-in example is broken w3c/webappsec#242.
-
CREDENTIAL: Reintroducing autocomplete="off" w3c/webappsec#245.
-
-
2 issues reopened.
-
CREDENTIAL: Use of FederatedCredential for federation protocols is unclear w3c/webappsec#266, by @mikewest.
-
CREDENTIAL: federated example could be a bit more detailed w3c/webappsec#260, by @mikewest.
-
-
55 issues received 343 new comments.
-
CREDENTIAL: Credential scope should not be limited to login w3c/webappsec#256 (66 comments by @adrianhopebailie, @annevk, @dlongley, @domenic, @jmajnert, @mikewest)
-
SRI: One resource, many representations. w3c/webappsec#235 (48 comments by @annevk, @devd, @fmarier, @igrigorik, @joelweinberger, @mikewest, @yoavweiss)
-
CREDENTIAL: use fetch() w3c/webappsec#241 (22 comments by @annevk, @domenic, @mikewest, @yutakahirano)
-
CREDENTIAL: Use a generic matching algorithm that would work for custom Credentials types w3c/webappsec#274 (16 comments by @adrianhopebailie, @dlongley, @mikewest)
-
CREDENTIAL: Why are all the interfaces [NoInterfaceObject] and using mixins instead of inheritance w3c/webappsec#309 (12 comments by @bzbarsky, @domenic, @heycam, @mikewest)
-
CREDENTIAL: document the reducing the carousel use case w3c/webappsec#272 (11 comments by @adrianhopebailie, @annevk, @jmajnert, @mikewest)
-
CREDENTIAL: Note danger of storing data along with credentials. w3c/webappsec#253 (10 comments by @annevk, @mikewest)
-
CREDENTIAL: expose type so you can avoid instanceof? w3c/webappsec#271 (10 comments by @adrianhopebailie, @annevk, @mikewest)
-
CREDENTIAL: Credential Synthesis is open to abuse by browser vendors w3c/webappsec#279 (9 comments by @adrianhopebailie, @mikewest)
-
CREDENTIAL: Support 3rd party credential storage and retrieval protocol w3c/webappsec#254 (9 comments by @annevk, @dlongley, @jmajnert, @mikewest)
-
SRI: specify verification of CSS-loaded subresources w3c/webappsec#306 (7 comments by @annevk, @devd, @fmarier, @joelweinberger, @tabatkins)
-
CREDENTIAL: Use of FederatedCredential for federation protocols is unclear w3c/webappsec#266 (7 comments by @adrianhopebailie, @mikewest)
-
CREDENTIAL: boolean acceptPasswords = true; w3c/webappsec#249 (7 comments by @annevk, @domenic, @mikewest)
-
Revise eligibility algorithm to require CORS w3c/webappsec#207 (6 comments by @annevk, @fmarier, @joelweinberger, @mozfreddyb)
-
CREDENTIAL: use "password" rather than "PasswordCredential" w3c/webappsec#270 (6 comments by @annevk, @mikewest)
-
[SRI] Add a note about falling back to another resource if the integrity check fails w3c/webappsec#149 (5 comments by @fmarier, @joelweinberger, @mozfreddyb)
-
CSP: Change the scope of the Permissions API w3c/webappsec#312 (4 comments by @andyearnshaw, @hillbrad)
-
CSP: frame-ancestors should check origins, not URLs w3c/webappsec#311 (3 comments by @hillbrad, @mikewest)
-
CREDENTIAL: Support generation of passwords from LocalCredential w3c/webappsec#250 (3 comments by @jonathanKingston, @mikewest)
-
SRI: add respec metadata for github & implementation status w3c/webappsec#239 (3 comments by @devd, @fmarier, @joelweinberger)
-
CREDENTIAL: Use Linked Data for extending credentials w3c/webappsec#255 (3 comments by @dlongley, @mikewest)
-
CREDENTIAL: Explicitly describe the extension model. w3c/webappsec#252 (3 comments by @jonathanKingston, @mikewest)
-
SRI: Do we need to make changes to HTML5's fetch too? w3c/webappsec#316 (2 comments by @annevk, @fmarier)
-
CSP: Duplicate Directives should "add" instead of be ignored w3c/webappsec#221 (2 comments by @devd, @dveditz)
-
SRI spec should insist on checking mime-type if specified w3c/webappsec#211 (2 comments by @devd, @joelweinberger)
-
CREDENTIAL: LocalCredential constructor is not extensible w3c/webappsec#243 (2 comments by @domenic, @mikewest)
-
SRI: Clarify how to handle non-eligible and invalid metadata w3c/webappsec#317 (1 comment by @fmarier)
-
SRI: consider the impact of integrity checks on `vary` headers w3c/webappsec#307 (1 comment by @annevk)
-
CREDENTIAL: mismatch of "type" value between note and example w3c/webappsec#294 (1 comment by @mikewest)
-
CREDENTIAL: introduce [[requiresUserMediationSlot]] in the definition of the Credential class w3c/webappsec#258 (1 comment by @mikewest)
-
CREDENTIAL: federated example could be a bit more detailed w3c/webappsec#260 (1 comment by @mikewest)
-
-
29 pull requests opened.
-
Grammar nit, remove false modesty. w3c/webappsec#325, by @hillbrad.
-
SRI: Explicitly mention the third component (options) of metadata w3c/webappsec#318, by @fmarier.
-
SRI: simpler script HTML5 changes w3c/webappsec#315, by @fmarier.
-
SRI: Allow non-eligible resources with empty integrity attributes w3c/webappsec#314, by @fmarier.
-
SRI: simpler link HTML5 changes w3c/webappsec#313, by @fmarier.
-
SRI: remove inline issues w3c/webappsec#308, by @fmarier.
-
SRI: make example browser-neutral w3c/webappsec#304, by @fmarier.
-
other way around password vs PasswordCredential w3c/webappsec#303, by @AxelNennker.
-
SRI: Add section Security Considerations: Behavior of chameleon resources w3c/webappsec#302, by @awwright.
-
SRI: simplified error reporting w3c/webappsec#300, by @fmarier.
-
SRI: Remove references to unsupported elements w3c/webappsec#299, by @fmarier.
-
SRI: Remove a redundant use case w3c/webappsec#298, by @fmarier.
-
SRI: Fix typos w3c/webappsec#297, by @fmarier.
-
SRI: Minor style fixes w3c/webappsec#296, by @fmarier.
-
CREDENTIAL: mismatch of "type" value between note and example w3c/webappsec#293, by @AxelNennker.
-
CREDENTIAL: Generic matching algorithm w3c/webappsec#292, by @adrianhopebailie.
-
SRI: Remove unnecessary personal pronouns w3c/webappsec#286, by @fmarier.
-
Remove reporting mode and CSP directive from v1 w3c/webappsec#285, by @fmarier.
-
EPR draft spec w3c/webappsec#284, by @randomdross.
-
Expand option-value-char characters w3c/webappsec#283, by @joelweinberger.
-
move tracking future work into an issue (not a reference) w3c/webappsec#282, by @hillbrad.
-
Added note about failed integrity checks w3c/webappsec#281, by @joelweinberger.
-
add missing braces to example w3c/webappsec#278, by @AxelNennker.
-
CREDENTIAL: Add 'Future Work by Other Groups'. w3c/webappsec#277, by @dlongley.
-
Removed references to shared cache (closes #207) w3c/webappsec#276, by @joelweinberger.
-
Add extra spec metadata to SRI w3c/webappsec#275, by @joelweinberger.
-
Use [SRI] as the list prefix w3c/webappsec#240, by @fmarier.
-
"CSP"-Header ABNF adjusted w3c/webappsec#237, by @StefanOssendorf.
-
Support per-hash options and remove MIME type support w3c/webappsec#236, by @joelweinberger.
-
-
20 pull requests merged.
-
SRI: Explicitly mention the third component (options) of metadata w3c/webappsec#318.
-
SRI: remove inline issues w3c/webappsec#308.
-
SRI: make example browser-neutral w3c/webappsec#304.
-
SRI: simplified error reporting w3c/webappsec#300.
-
Update examples with crossorigin=anonymous w3c/webappsec#190.
-
SRI: Minor style fixes w3c/webappsec#296.
-
SRI: Remove references to unsupported elements w3c/webappsec#299.
-
SRI: Fix typos w3c/webappsec#297.
-
Added note about failed integrity checks w3c/webappsec#281.
-
Expand option-value-char characters w3c/webappsec#283.
-
Remove reporting mode and CSP directive from v1 w3c/webappsec#285.
-
move tracking future work into an issue (not a reference) w3c/webappsec#282.
-
EPR draft spec w3c/webappsec#284.
-
Removed references to shared cache (closes #207) w3c/webappsec#276.
-
add missing braces to example w3c/webappsec#278.
-
Add extra spec metadata to SRI w3c/webappsec#275.
-
Use [SRI] as the list prefix w3c/webappsec#240.
-
Support per-hash options and remove MIME type support w3c/webappsec#236.
-
"CSP"-Header ABNF adjusted w3c/webappsec#237.
-
SRI: Use an equal sign in option-expression w3c/webappsec#222.
-
-
2 pull requests closed.
-
CREDENTIAL: mismatch of "type" value between note and example w3c/webappsec#293.
-
CREDENTIAL: Add 'Future Work by Other Groups'. w3c/webappsec#277.
-
-
2 pull requests reopened.
-
Added note about failed integrity checks w3c/webappsec#281, by @mozfreddyb.
-
SRI: Use an equal sign in option-expression w3c/webappsec#222, by @joelweinberger.
-
-
23 pull requests received 97 new comments.
-
CREDENTIAL: Generic matching algorithm w3c/webappsec#292 (39 comments by @adrianhopebailie, @mikewest)
-
CREDENTIAL: Add 'Future Work by Other Groups'. w3c/webappsec#277 (10 comments by @akuckartz, @annevk, @dlongley, @hillbrad, @mikewest, @msporny)
-
Added note about failed integrity checks w3c/webappsec#281 (9 comments by @devd, @fmarier, @joelweinberger)
-
Update examples with crossorigin=anonymous w3c/webappsec#190 (6 comments by @devd, @fmarier, @joelweinberger)
-
SRI: Add section Security Considerations: Behavior of chameleon resources w3c/webappsec#302 (3 comments by @awwright, @mozfreddyb)
-
Support per-hash options and remove MIME type support w3c/webappsec#236 (3 comments by @fmarier, @joelweinberger)
-
SRI: Allow non-eligible resources with empty integrity attributes w3c/webappsec#314 (2 comments by @fmarier, @mozfreddyb)
-
CREDENTIAL: mismatch of "type" value between note and example w3c/webappsec#293 (1 comment by @mikewest)
-
move tracking future work into an issue (not a reference) w3c/webappsec#282 (1 comment by @mikewest)
-
w3c/permissions
-
8 issues opened.
-
Rename PermissionStatus.status to PermissionStatus.state w3c/permissions#31, by @mvano.
-
Geolocation API does not leave the page unaware of permission status w3c/permissions#30, by @mvano.
-
Support for background sync (one-off and periodic) w3c/permissions#29, by @KenjiBaheux.
-
Flesh out more complex permission issues we see down the road w3c/permissions#28, by @progers.
-
Add "fullscreen" w3c/permissions#26, by @annevk.
-
Why "prompt" instead of "default"? w3c/permissions#25, by @annevk.
-
Move to using Echidna w3c/permissions#24, by @marcoscaceres.
-
Privacy Considerations w3c/permissions#22, by @wseltzer.
-
-
1 issue reopened.
-
Move to using Echidna w3c/permissions#24, by @marcoscaceres.
-
-
5 issues received 8 new comments.
-
Support for background sync (one-off and periodic) w3c/permissions#29 (2 comments by @annevk, @KenjiBaheux)
-
Geolocation API does not leave the page unaware of permission status w3c/permissions#30 (1 comment by @marcoscaceres)
-
Flesh out more complex permission issues we see down the road w3c/permissions#28 (1 comment by @mounirlamouri)
-
3 pull requests opened.
-
Boilerplate mail list should be public-webappsec w3c/permissions#32, by @AFBarstow.
-
Fixes to make pubrules compliant w3c/permissions#27, by @astorije.
-
A few typos w3c/permissions#23, by @wseltzer.
-
-
3 pull requests merged.
-
Boilerplate mail list should be public-webappsec w3c/permissions#32.
-
Fixes to make pubrules compliant w3c/permissions#27.
-
A few typos w3c/permissions#23.
-
-
2 pull requests received 2 new comments.
Lifecycle
-
1 charter started.
-
Chartered until 31 December 2016. Participants had to rejoin under this charter.
-
TR publications
-
1 document published.
-
Mixed Content published as a Candidate Recommendation Snapshot. History of Mixed Content
-
Participants
-
7 participants left.
-
Jun Murai (W3C) left.
-
Wendy Seltzer (W3C) left.
-
Tobias Gondrom (W3C Invited Experts) left.
-
Brandon Sterne (W3C Invited Experts) left.
-
David Huang (W3C Invited Experts) left.
-
Giorgio Maone (W3C Invited Experts) left.
-
Michael[tm] Smith (sideshowbarker) (W3C) left.
-
-
6 organizations joined.
-
Stanford University joined.
-
Akamai Technologies joined.
-
Google LLC joined.
-
Meta joined.
-
Mozilla Foundation joined.
-
Intel Corporation joined.
-
-
33 organizations left.
-
AT&T left.
-
Alibaba Group left.
-
Cable Television Laboratories Inc left.
-
Dropbox, Inc. left.
-
MITRE Corporation left.
-
International Webmasters Association (IWA) left.
-
Stanford University left.
-
Tencent left.
-
Meta left.
-
Yandex left.
-
Verisign, Inc. left.
-
Keio University left.
-
Mitsubishi Electric Corporation left.
-
Verizon left.
-
Pacific Northwest National Laboratory left.
-
PayGate left.
-
China Academy of Information and Communications Technology (CAICT) left.
-
X left.
-
eBay left.
-
360 left.
-
Baidu, Inc. left.
-
China Unicom left.
-
DigiCert SSL Certificate Authority left.
-
imec left.
-
Google LLC left.
-
Mozilla Foundation left.
-
Electronics and Telecommunications Research Institute (ETRI) left.
-
Intel Corporation left.
-
Opera Software AS left.
-
Boeing Company left.
-
Nokia Corporation left.
-
Microsoft Corporation left.
-
Adobe left.
-
GitHub
w3c/permissions
-
11 issues opened.
-
Add Promise.all() example for multiple queries w3c/permissions#19, by @mounirlamouri.
-
Extensibility: make sure we have it right w3c/permissions#17, by @mounirlamouri.
-
Exposition (Window,Worker) should be explicit w3c/permissions#16, by @mounirlamouri.
-
Should we add a global change event? w3c/permissions#15, by @mounirlamouri.
-
Should we have a more explicit enumerating process? w3c/permissions#13, by @mounirlamouri.
-
Should 'prompt' be renamed as 'default'? w3c/permissions#12, by @mounirlamouri.
-
Should Permissions be an interface with static objects? w3c/permissions#11, by @mounirlamouri.
-
Add getUserMedia permissions w3c/permissions#10, by @mounirlamouri.
-
What should "retrieve the permission state" do for context related permissions? w3c/permissions#9, by @mounirlamouri.
-
What should "retrieve the permission state" do for pickers? w3c/permissions#8, by @mounirlamouri.
-
-
10 issues closed.
-
Permission states w3c/permissions#3.
-
Should Permissions be an interface with static objects? w3c/permissions#11.
-
A "dismissed" state w3c/permissions#4.
-
Should 'prompt' be renamed as 'default'? w3c/permissions#12.
-
Redundant assertion w3c/permissions#2.
-
Is `Permissions.get` the right name? w3c/permissions#5.
-
Should we add a global change event? w3c/permissions#15.
-
Exposition (Window,Worker) should be explicit w3c/permissions#16.
-
Could we ask for several permissions at a time ? w3c/permissions#6.
-
11 issues received 31 new comments.
-
Could we ask for several permissions at a time ? w3c/permissions#6 (7 comments by @marcoscaceres, @mounirlamouri, @QuentinFchx)
-
Should 'prompt' be renamed as 'default'? w3c/permissions#12 (5 comments by @KenjiBaheux, @mounirlamouri)
-
Is `Permissions.get` the right name? w3c/permissions#5 (5 comments by @jyasskin, @mounirlamouri, @mvano)
-
Specify how to behave when an extended Permission dictionary doesn't match requirements w3c/permissions#14 (1 comment by @mounirlamouri)
-
What should "retrieve the permission state" do for context related permissions? w3c/permissions#9 (1 comment by @mounirlamouri)
-
-
4 pull requests opened.
-
Fix typo around Promise.all w3c/permissions#21, by @domenic.
-
Version of the API that should be simple, extensible and ready for MVP. w3c/permissions#20, by @mounirlamouri.
-
Have an instance of Permissions on Navigator and WorkerNavigator. w3c/permissions#18, by @mounirlamouri.
-
Renamed .get to .check (closes #5) w3c/permissions#7, by @marcoscaceres.
-
-
3 pull requests merged.
-
Fix typo around Promise.all w3c/permissions#21.
-
Version of the API that should be simple, extensible and ready for MVP. w3c/permissions#20.
-
Have an instance of Permissions on Navigator and WorkerNavigator. w3c/permissions#18.
-
-
1 pull request closed.
-
Renamed .get to .check (closes #5) w3c/permissions#7.
-
-
4 pull requests received 34 new comments.
-
Version of the API that should be simple, extensible and ready for MVP. w3c/permissions#20 (23 comments by @domenic, @marcoscaceres, @mounirlamouri)
-
Have an instance of Permissions on Navigator and WorkerNavigator. w3c/permissions#18 (7 comments by @marcoscaceres, @mounirlamouri)
-
w3c/webappsec
-
24 issues opened.
-
UPGRADE: `Request` is a `dfn`, not an `interface`. w3c/webappsec#234, by @mikewest.
-
CREDENTIAL: Introduce a new request context? w3c/webappsec#231, by @mikewest.
-
CSP3: Reconsider report sampling. w3c/webappsec#230, by @mikewest.
-
CSP3: Allow report batching. w3c/webappsec#229, by @mikewest.
-
Recursive SRI w3c/webappsec#228, by @annevk.
-
CSP: Specify response checking. w3c/webappsec#227, by @mikewest.
-
Clarify examples. w3c/webappsec#226, by @mikewest.
-
Should we allow alternate ports to be configured? w3c/webappsec#225, by @mikewest.
-
Spell out relationship to Mixed Content strict mode. w3c/webappsec#224, by @mikewest.
-
CSP: Duplicate Directives should "add" instead of be ignored w3c/webappsec#221, by @devd.
-
CSP: Allow directive references. w3c/webappsec#219, by @mikewest.
-
SRI: Respond to mnot comments w3c/webappsec#217, by @devd.
-
Pick the shortest reasonable Prefer / upgrade header w3c/webappsec#216, by @pde.
-
UPGRADE: Consider `upgrade-insecure-requests` in an insecure response as redirecting. w3c/webappsec#212, by @mikewest.
-
SRI spec should insist on checking mime-type if specified w3c/webappsec#211, by @devd.
-
SRI object support w3c/webappsec#210, by @devd.
-
UPGRADE: Note the archivist's perspective. w3c/webappsec#208, by @mikewest.
-
Revise eligibility algorithm to require CORS w3c/webappsec#207, by @mozfreddyb.
-
CSP: Consider a `permissions` directive. w3c/webappsec#206, by @mikewest.
-
CREDENTIAL: Why avatarURL MUST NOT be a priori insecure URL w3c/webappsec#200, by @jmajnert.
-
CREDENTIAL: opaque FormData link leads outside of W3C specs w3c/webappsec#199, by @jmajnert.
-
CREDENTIAL: notifySingedOut() and require user mediation w3c/webappsec#198, by @jmajnert.
-
CREDENTIAL: hanging link w3c/webappsec#197, by @jmajnert.
-
-
16 issues closed.
-
CREDENTIAL: notifySingedOut() and require user mediation w3c/webappsec#198.
-
CREDENTIAL: opaque FormData link leads outside of W3C specs w3c/webappsec#199.
-
Should we allow alternate ports to be configured? w3c/webappsec#225.
-
Spell out relationship to Mixed Content strict mode. w3c/webappsec#224.
-
Recursive SRI w3c/webappsec#228.
-
Explicitly mention the four cases around the HTTPS requirement in SRI w3c/webappsec#116.
-
Pick the shortest reasonable Prefer / upgrade header w3c/webappsec#216.
-
[MIX] HSTS and Resource Fetching w3c/webappsec#157.
-
CREDENTIAL: Why avatarURL MUST NOT be a priori insecure URL w3c/webappsec#200.
-
CREDENTIAL: hanging link w3c/webappsec#197.
-
SRI: Comments on *Is resource eligible for integrity validation*, 3.3.2 w3c/webappsec#105.
-
SRI: "Hello, world." should be replaced with a more appropriate example w3c/webappsec#144.
-
1 issue reopened.
-
SRI: Integration to Worker constructor seems brittle and not very future proof w3c/webappsec#75, by @devd.
-
-
25 issues received 155 new comments.
-
[SRI] Add a note about falling back to another resource if the integrity check fails w3c/webappsec#149 (38 comments by @annevk, @devd, @fmarier, @joelweinberger, @mikewest, @mozfreddyb)
-
Pick the shortest reasonable Prefer / upgrade header w3c/webappsec#216 (11 comments by @igrigorik, @mikewest, @pde)
-
Should we allow alternate ports to be configured? w3c/webappsec#225 (10 comments by @annevk, @hillbrad, @jgraham, @mikewest)
-
CSP: Duplicate Directives should "add" instead of be ignored w3c/webappsec#221 (9 comments by @devd, @hillbrad, @mikewest)
-
CREDENTIAL: notifySingedOut() and require user mediation w3c/webappsec#198 (8 comments by @jmajnert, @mikewest)
-
CREDENTIAL: opaque FormData link leads outside of W3C specs w3c/webappsec#199 (8 comments by @jmajnert, @mikewest)
-
SRI: Fine grained "require integrity" option w3c/webappsec#16 (7 comments by @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
UPGRADE: Consider `upgrade-insecure-requests` in an insecure response as redirecting. w3c/webappsec#212 (6 comments by @mikewest, @pde, @yoavweiss)
-
CSP: Allow directive references. w3c/webappsec#219 (5 comments by @annevk, @briansmith, @jonathanKingston, @mikewest)
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139 (4 comments by @cure53, @mikewest)
-
[SRI]: use the terms of (un)authenticated origins instead of (in)secure channels? w3c/webappsec#71 (4 comments by @devd, @mikewest, @mozfreddyb)
-
SRI: Integration to Worker constructor seems brittle and not very future proof w3c/webappsec#75 (3 comments by @annevk, @devd)
-
CREDENTIAL: Why avatarURL MUST NOT be a priori insecure URL w3c/webappsec#200 (2 comments by @jmajnert, @mikewest)
-
SI: Talk about Image Elements with srcset attributes w3c/webappsec#5 (2 comments by @devd, @mozfreddyb)
-
SRI: Comments on *Is resource eligible for integrity validation*, 3.3.2 w3c/webappsec#105 (2 comments by @devd, @mozfreddyb)
-
Explicitly mention the four cases around the HTTPS requirement in SRI w3c/webappsec#116 (1 comment by @mozfreddyb)
-
-
21 pull requests opened.
-
Added algorithm termination after TypeError w3c/webappsec#233, by @jmajnert.
-
Fixing some easy nits from w3c/webappsec#223, by @mozfreddyb.
-
SRI: Use an equal sign in option-expression w3c/webappsec#222, by @awwright.
-
SRI: Fix ABNF w3c/webappsec#220, by @awwright.
-
Update the charter links w3c/webappsec#218, by @wseltzer.
-
[upgrade] Clarify examples w3c/webappsec#215, by @mnot.
-
Sri mention http w3c/webappsec#213, by @joelweinberger.
-
Clarify the conditionality of the upgrade mechanism w3c/webappsec#209, by @pde.
-
No caching goal w3c/webappsec#205, by @devd.
-
Remove refs to secure channel/insecure channel w3c/webappsec#204, by @devd.
-
CREDENTIAL: Unified security error conditions w3c/webappsec#203, by @jmajnert.
-
CREDENTIAL: Fix for "top-level browsing context" dfn href w3c/webappsec#202, by @jmajnert.
-
remove require-for-all for v1 w3c/webappsec#201, by @devd.
-
[CredentialManagement] Use of singular they instead of she w3c/webappsec#196, by @jmajnert.
-
[CredentialManagement] Removed a step from Request a Credential with options algorithm w3c/webappsec#195, by @jmajnert.
-
[CredentialManagement] Nits w3c/webappsec#194, by @jmajnert.
-
Update example to use javascript and alert w3c/webappsec#193, by @devd.
-
Fix minor CORS typo w3c/webappsec#192, by @devd.
-
Unknown / unsupported hash functions do not break w3c/webappsec#191, by @devd.
-
Update examples with crossorigin=anonymous w3c/webappsec#190, by @devd.
-
-
16 pull requests merged.
-
Added algorithm termination after TypeError w3c/webappsec#233.
-
Fixing some easy nits from w3c/webappsec#223.
-
Sri mention http w3c/webappsec#213.
-
SRI: Fix ABNF w3c/webappsec#220.
-
Update the charter links w3c/webappsec#218.
-
[upgrade] Clarify examples w3c/webappsec#215.
-
Unknown / unsupported hash functions do not break w3c/webappsec#191.
-
No caching goal w3c/webappsec#205.
-
Remove refs to secure channel/insecure channel w3c/webappsec#204.
-
CREDENTIAL: Unified security error conditions w3c/webappsec#203.
-
CREDENTIAL: Fix for "top-level browsing context" dfn href w3c/webappsec#202.
-
remove require-for-all for v1 w3c/webappsec#201.
-
[CredentialManagement] Nits w3c/webappsec#194.
-
Update example to use javascript and alert w3c/webappsec#193.
-
Fix minor CORS typo w3c/webappsec#192.
-
Make the return value of "Parse metadata" consistent w3c/webappsec#86.
-
-
4 pull requests closed.
-
Fixups w3c/webappsec#232.
-
Clarify the conditionality of the upgrade mechanism w3c/webappsec#209.
-
[CredentialManagement] Use of singular they instead of she w3c/webappsec#196.
-
-
20 pull requests received 79 new comments.
-
Update examples with crossorigin=anonymous w3c/webappsec#190 (19 comments by @annevk, @btoews, @devd, @fmarier, @mozfreddyb)
-
Sri mention http w3c/webappsec#213 (14 comments by @annevk, @devd, @fmarier, @joelweinberger, @mikewest)
-
SRI: Use an equal sign in option-expression w3c/webappsec#222 (7 comments by @awwright, @devd, @fmarier, @mozfreddyb)
-
Unknown / unsupported hash functions do not break w3c/webappsec#191 (6 comments by @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
Clarify the conditionality of the upgrade mechanism w3c/webappsec#209 (5 comments by @mikewest, @pde)
-
CREDENTIAL: Unified security error conditions w3c/webappsec#203 (5 comments by @jmajnert, @mikewest)
-
[CredentialManagement] Use of singular they instead of she w3c/webappsec#196 (2 comments by @jmajnert, @mikewest)
-
[CredentialManagement] Removed a step from Request a Credential with options algorithm w3c/webappsec#195 (2 comments by @jmajnert, @mikewest)
-
CREDENTIAL: Fix for "top-level browsing context" dfn href w3c/webappsec#202 (1 comment by @mikewest)
-
TR publications
-
4 documents published.
-
Content Security Policy Level 2 published as a Candidate Recommendation Snapshot. History of Content Security Policy Level 2
-
Content Security Policy Pinning published as a First Public Working Draft. History of Content Security Policy Pinning
-
Upgrade Insecure Requests published as a First Public Working Draft. History of Upgrade Insecure Requests
-
Content Security Policy 1.0 published as a Note. History of Content Security Policy 1.0
-
Participants
-
1 organization joined.
-
Alibaba Group joined.
-
GitHub
w3c/webappsec
-
9 issues opened.
-
Add a violation report example w3c/webappsec#189, by @fmarier.
-
Consider a `-src`-style directive. w3c/webappsec#184, by @mikewest.
-
[MIX] Sandboxed iframes as optionally-blockable Content w3c/webappsec#179, by @kyprizel.
-
Decide whether or not to keep content-type in SRI version 1 w3c/webappsec#176, by @fmarier.
-
CSP3: Service Worker "kill switch" w3c/webappsec#174, by @joelweinberger.
-
CSP3: Consider IP syntax support w3c/webappsec#170, by @joelweinberger.
-
CSP: Add a recommendation regarding default policies. w3c/webappsec#168, by @mikewest.
-
[CSPP] how are multiple max-age directives handled? w3c/webappsec#164, by @dveditz.
-
-
6 issues closed.
-
Decide whether or not to keep content-type in SRI version 1 w3c/webappsec#176.
-
[SRI] Typo: missing hyphen in 3.10.1: ni:///sha-256 w3c/webappsec#133.
-
[SRI] Add support for the base64 encoding w3c/webappsec#163.
-
SRI: noncanonical-src use cases w3c/webappsec#68.
-
[CSPP] how are multiple max-age directives handled? w3c/webappsec#164.
-
-
1 issue reopened.
-
CSP3: Service Worker "kill switch" w3c/webappsec#174, by @mikewest.
-
-
12 issues received 48 new comments.
-
Decide whether or not to keep content-type in SRI version 1 w3c/webappsec#176 (16 comments by @briansmith, @devd, @fmarier, @hillbrad, @mikewest, @mozfreddyb, @yoavweiss)
-
Explicitly mention the four cases around the HTTPS requirement in SRI w3c/webappsec#116 (5 comments by @devd, @fmarier, @joelweinberger)
-
Resolve ambiguity in the "parse metadata" algorithm between "()" and "no metadata" w3c/webappsec#119 (5 comments by @devd, @fmarier, @mozfreddyb)
-
[SRI] Add support for the base64 encoding w3c/webappsec#163 (5 comments by @devd, @fmarier, @mozfreddyb)
-
CSP reports for eval() and inline script are identical w3c/webappsec#52 (4 comments by @kravietz, @mozfreddyb, @oreoshake)
-
[MIX] Sandboxed iframes as optionally-blockable Content w3c/webappsec#179 (4 comments by @briansmith, @kyprizel, @mikewest)
-
CSP3: Service Worker "kill switch" w3c/webappsec#174 (3 comments by @devd, @joelweinberger, @KenjiBaheux)
-
[POWER] should provide a single agorithm that checks both the Document and Settings Object w3c/webappsec#160 (1 comment by @mikewest)
-
-
17 pull requests opened.
-
fixing typo w3c/webappsec#188, by @dret.
-
adding missing parenthesis w3c/webappsec#187, by @dret.
-
it's two header fields, right? w3c/webappsec#186, by @dret.
-
Dev now works at Dropbox w3c/webappsec#183, by @devd.
-
Fix some typos, make a note non-redundant w3c/webappsec#182, by @wseltzer.
-
Change one of the examples to a stylesheet load w3c/webappsec#181, by @fmarier.
-
name change, indicate TAG as co-deliverer of Sufficiently Secure Context... w3c/webappsec#180, by @hillbrad.
-
Re-generate the index.html file w3c/webappsec#178, by @fmarier.
-
Fixed typos w3c/webappsec#177, by @marcoscaceres.
-
Add a new "referrer attribute" delivery mechanism w3c/webappsec#175, by @fmarier.
-
Probably a bikeshed-ism, but let's not have the ??? in the biblio. w3c/webappsec#173, by @hillbrad.
-
minor typos, seriousing-stuff-up for FPWD w3c/webappsec#172, by @hillbrad.
-
CSP2: remove base64url and sha-* w3c/webappsec#171, by @fmarier.
-
typos in 2015 charter w3c/webappsec#169, by @deian.
-
Fix two typos w3c/webappsec#167, by @foolip.
-
Fix URL to the spec itself w3c/webappsec#166, by @foolip.
-
Saw typo, fixed a typo w3c/webappsec#165, by @tomrittervg.
-
-
20 pull requests merged.
-
fixing typo w3c/webappsec#188.
-
it's two header fields, right? w3c/webappsec#186.
-
adding missing parenthesis w3c/webappsec#187.
-
Dev now works at Dropbox w3c/webappsec#183.
-
Change one of the examples to a stylesheet load w3c/webappsec#181.
-
Fix some typos, make a note non-redundant w3c/webappsec#182.
-
Add a new "referrer attribute" delivery mechanism w3c/webappsec#175.
-
name change, indicate TAG as co-deliverer of Sufficiently Secure Context... w3c/webappsec#180.
-
Re-generate the index.html file w3c/webappsec#178.
-
Stylesheet links without a MIME type should be eligible for integrity checks w3c/webappsec#158.
-
Fixed typos w3c/webappsec#177.
-
Adopt the same format as CSP Level 2 for the hash format w3c/webappsec#156.
-
Probably a bikeshed-ism, but let's not have the ??? in the biblio. w3c/webappsec#173.
-
minor typos, seriousing-stuff-up for FPWD w3c/webappsec#172.
-
CSP2: remove base64url and sha-* w3c/webappsec#171.
-
typos in 2015 charter w3c/webappsec#169.
-
Fix two typos w3c/webappsec#167.
-
Fix URL to the spec itself w3c/webappsec#166.
-
Saw typo, fixed a typo w3c/webappsec#165.
-
-
2 pull requests closed.
-
Allow the empty set as a return value for parsemetada (fixes #119) w3c/webappsec#120.
-
SRI: RFC6920 clarifications w3c/webappsec#124.
-
-
1 pull request reopened.
-
Fix some typos, make a note non-redundant w3c/webappsec#182, by @wseltzer.
-
-
22 pull requests received 72 new comments.
-
Add a new "referrer attribute" delivery mechanism w3c/webappsec#175 (11 comments by @annevk, @briansmith, @fmarier, @mikewest, @sc0ttbeardsley, @WooseokJeong)
-
Adopt the same format as CSP Level 2 for the hash format w3c/webappsec#156 (9 comments by @devd, @fmarier, @hillbrad, @mikewest)
-
Mention the one thing that integrity protects against on insecure origins w3c/webappsec#98 (8 comments by @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
Re-generate the index.html file w3c/webappsec#178 (7 comments by @devd, @fmarier, @mikewest, @mozfreddyb)
-
Make the return value of "Parse metadata" consistent w3c/webappsec#86 (5 comments by @devd, @fmarier, @joelweinberger, @mikewest, @mozfreddyb)
-
Stylesheet links without a MIME type should be eligible for integrity checks w3c/webappsec#158 (3 comments by @devd, @fmarier, @mozfreddyb)
-
Allow the empty set as a return value for parsemetada (fixes #119) w3c/webappsec#120 (2 comments by @devd, @fmarier)
-
Probably a bikeshed-ism, but let's not have the ??? in the biblio. w3c/webappsec#173 (1 comment by @mikewest)
-
w3c/permissions
-
2 issues opened.
-
Could we ask for several permissions at a time ? w3c/permissions#6, by @QuentinFchx.
-
Is `Permissions.get` the right name? w3c/permissions#5, by @jyasskin.
-
-
2 issues received 5 new comments.
Participants
-
3 organizations joined.
-
Cable Television Laboratories Inc joined.
-
Dropbox, Inc. joined.
-
MITRE Corporation joined.
-
GitHub
w3c/webappsec
-
16 issues opened.
-
[SRI] Add support for the base64 encoding w3c/webappsec#163, by @fmarier.
-
[MIX] HSTS and Resource Fetching w3c/webappsec#157, by @ylafon.
-
CSP: Maybe removing <meta> should remove its policy? w3c/webappsec#153, by @mikewest.
-
[SRI] Add a note about falling back to another resource if the integrity check fails w3c/webappsec#149, by @fmarier.
-
[CSP] Accept base64url values for script hash w3c/webappsec#147, by @joelweinberger.
-
Section 6.2: Typo in identityprovider.example.net w3c/webappsec#146, by @alexmuller.
-
Support internationalized domain names directly. w3c/webappsec#145, by @mikewest.
-
SRI: "Hello, world." should be replaced with a more appropriate example w3c/webappsec#144, by @fmarier.
-
SRI: Consider converting to Bikeshed. w3c/webappsec#141, by @mikewest.
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139, by @mikewest.
-
[SRI] Typo: missing hyphen in 3.10.1: ni:///sha-256 w3c/webappsec#133, by @manger.
-
[SRI] Inconsistent "Hello, world" examples w3c/webappsec#132, by @joelweinberger.
-
[SRI] openssl example command leaves newline characters w3c/webappsec#131, by @joelweinberger.
-
[SRI] Inconsistencies between wording and examples with base64 "=" padding w3c/webappsec#130, by @joelweinberger.
-
Should we get sha-384 and sha-512 added to the named information IANA registry? w3c/webappsec#121, by @fmarier.
-
-
20 issues closed.
-
Define a term that should guard access to "Powerful New Features" w3c/webappsec#41.
-
[MIX] private origin does not account for IPv6 w3c/webappsec#60.
-
Overview.html syntax error? w3c/webappsec#76.
-
CSP Sec 5.1 Worker owner document clarification w3c/webappsec#70.
-
SHA256 mismatches w3c/webappsec#82.
-
[CSP] Specification misses an acknowledgment section w3c/webappsec#65.
-
[SRI] Talk about Fonts w3c/webappsec#17.
-
SRI: remove integrity for downloads (for the minimum viable revision) w3c/webappsec#81.
-
[CSP] Accept base64url values for script hash w3c/webappsec#147.
-
Section 6.2: Typo in identityprovider.example.net w3c/webappsec#146.
-
csp spec doesn't compile w3c/webappsec#100.
-
[SRI] Inconsistent "Hello, world" examples w3c/webappsec#132.
-
[SRI] openssl example command leaves newline characters w3c/webappsec#131.
-
[SRI] Inconsistencies between wording and examples with base64 "=" padding w3c/webappsec#130.
-
[SRI] Inconsistent Integrity Metadata Conventions w3c/webappsec#114.
-
normalize hash function algorithm name w3c/webappsec#104.
-
SRI: fix HTTP reference w3c/webappsec#55.
-
-
19 issues received 31 new comments.
-
SRI: Consider converting to Bikeshed. w3c/webappsec#141 (5 comments by @devd, @joelweinberger, @mikewest, @mozfreddyb)
-
[POWER] should provide a single agorithm that checks both the Document and Settings Object w3c/webappsec#160 (3 comments by @jyasskin, @mikewest)
-
[SRI] Add a note about falling back to another resource if the integrity check fails w3c/webappsec#149 (3 comments by @fmarier, @mozfreddyb)
-
Should we get sha-384 and sha-512 added to the named information IANA registry? w3c/webappsec#121 (2 comments by @devd, @fmarier)
-
Define a term that should guard access to "Powerful New Features" w3c/webappsec#41 (1 comment by @mikewest)
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139 (1 comment by @hillbrad)
-
[SRI] Inconsistencies between wording and examples with base64 "=" padding w3c/webappsec#130 (1 comment by @fmarier)
-
-
27 pull requests opened.
-
Add francois as editor, remove Mike West w3c/webappsec#162, by @joelweinberger.
-
CSP3: message-src message-sink w3c/webappsec#161, by @deian.
-
Ignore trailing equal signs when comparing base64 hashes (fix #73) w3c/webappsec#159, by @fmarier.
-
Stylesheet links without a MIME type should be eligible for integrity checks w3c/webappsec#158, by @fmarier.
-
Adopt the same format as CSP Level 2 for the hash format w3c/webappsec#156, by @fmarier.
-
Fix a typo in the ABNF grammar w3c/webappsec#155, by @fmarier.
-
Separate base64-value and base64url-value w3c/webappsec#154, by @joelweinberger.
-
Remove section about XHRs for v1 w3c/webappsec#152, by @fmarier.
-
Remove a reference to the `a` element w3c/webappsec#151, by @fmarier.
-
Remove a commented-out section on iframe support w3c/webappsec#150, by @fmarier.
-
Remove all references to fonts from the spec (fix #17) w3c/webappsec#148, by @fmarier.
-
Remove the anchor element from v1 of the spec w3c/webappsec#143, by @fmarier.
-
Fetch spec references w3c/webappsec#142, by @fmarier.
-
SRI: Prescriptivize usage of `ni` URLs for metadata. w3c/webappsec#140, by @mikewest.
-
Add a requirement to support SHA-384 w3c/webappsec#138, by @fmarier.
-
refreshing gh-pages w3c/webappsec#137, by @mozfreddyb.
-
Make the example string match the example hash (fix #132) w3c/webappsec#136, by @fmarier.
-
Link fixup w3c/webappsec#135, by @fmarier.
-
Remove newline characters in the openssl base64 output (fix #131) w3c/webappsec#134, by @fmarier.
-
Stricter hash normalization step w3c/webappsec#129, by @fmarier.
-
Add a link to the Powerful Features spec. w3c/webappsec#128, by @jyasskin.
-
Fix typo in the `script` element section w3c/webappsec#127, by @fmarier.
-
Replace references to RFC2616 with RFC723x (fix #55) w3c/webappsec#126, by @fmarier.
-
Add a step to normalize the hash function name (fix #104) w3c/webappsec#125, by @fmarier.
-
SRI: RFC6920 clarifications w3c/webappsec#124, by @fmarier.
-
SRI: Refer to the MIME type definition and capitalize Content Type w3c/webappsec#123, by @fmarier.
-
SRI: Use the {:.note} directive to mark note paragraphs up w3c/webappsec#122, by @fmarier.
-
-
25 pull requests merged.
-
Add francois as editor, remove Mike West w3c/webappsec#162.
-
Ignore trailing equal signs when comparing base64 hashes (fix #73) w3c/webappsec#159.
-
Fix a typo in the ABNF grammar w3c/webappsec#155.
-
Remove a reference to the `a` element w3c/webappsec#151.
-
Remove a commented-out section on iframe support w3c/webappsec#150.
-
Move hyperlink auditing ("ping") to the connect-src directive w3c/webappsec#99.
-
Remove section about XHRs for v1 w3c/webappsec#152.
-
Separate base64-value and base64url-value w3c/webappsec#154.
-
Move the fallback / noncanonical bits to v2 w3c/webappsec#118.
-
SRI: Refer to the MIME type definition and capitalize Content Type w3c/webappsec#123.
-
Remove all references to fonts from the spec (fix #17) w3c/webappsec#148.
-
Remove the anchor element from v1 of the spec w3c/webappsec#143.
-
Add a requirement to support SHA-384 w3c/webappsec#138.
-
Fetch spec references w3c/webappsec#142.
-
SRI: Prescriptivize usage of `ni` URLs for metadata. w3c/webappsec#140.
-
refreshing gh-pages w3c/webappsec#137.
-
Make the example string match the example hash (fix #132) w3c/webappsec#136.
-
Link fixup w3c/webappsec#135.
-
Remove newline characters in the openssl base64 output (fix #131) w3c/webappsec#134.
-
SRI: Use the {:.note} directive to mark note paragraphs up w3c/webappsec#122.
-
Add a link to the Powerful Features spec. w3c/webappsec#128.
-
Stricter hash normalization step w3c/webappsec#129.
-
Add a step to normalize the hash function name (fix #104) w3c/webappsec#125.
-
Fix typo in the `script` element section w3c/webappsec#127.
-
Replace references to RFC2616 with RFC723x (fix #55) w3c/webappsec#126.
-
-
2 pull requests closed.
-
CSP: message-src and message-sink w3c/webappsec#101.
-
draft note for interaction of sandbox directive and workers w3c/webappsec#102.
-
-
17 pull requests received 48 new comments.
-
Remove the anchor element from v1 of the spec w3c/webappsec#143 (10 comments by @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
Add francois as editor, remove Mike West w3c/webappsec#162 (6 comments by @devd, @fmarier, @joelweinberger, @mozfreddyb)
-
Move the fallback / noncanonical bits to v2 w3c/webappsec#118 (5 comments by @devd, @fmarier, @mozfreddyb)
-
Adopt the same format as CSP Level 2 for the hash format w3c/webappsec#156 (4 comments by @fmarier, @joelweinberger)
-
Add a step to normalize the hash function name (fix #104) w3c/webappsec#125 (4 comments by @devd, @fmarier, @mozfreddyb)
-
Stylesheet links without a MIME type should be eligible for integrity checks w3c/webappsec#158 (3 comments by @fmarier, @joelweinberger, @mozfreddyb)
-
SRI: Use the {:.note} directive to mark note paragraphs up w3c/webappsec#122 (3 comments by @fmarier, @mozfreddyb)
-
SRI: Prescriptivize usage of `ni` URLs for metadata. w3c/webappsec#140 (2 comments by @mikewest, @mozfreddyb)
-
Move hyperlink auditing ("ping") to the connect-src directive w3c/webappsec#99 (1 comment by @mikewest)
-
Allow the empty set as a return value for parsemetada (fixes #119) w3c/webappsec#120 (1 comment by @fmarier)
-
draft note for interaction of sandbox directive and workers w3c/webappsec#102 (1 comment by @mikewest)
-