Web Application Security Working Group - Activity in 2016
No matches.
TR publications
-
2 documents published.
-
Content Security Policy Level 2 published as a Recommendation. History of Content Security Policy Level 2
-
Referrer Policy published as a Working Draft. History of Referrer Policy
-
Participants
-
1 participant joined.
-
Malika Aubakirova (W3C Invited Experts) joined.
-
GitHub
w3c/webappsec-referrer-policy
-
3 issues opened.
-
Where does a "block" come from in the sheet-with-null-location case? w3c/webappsec-referrer-policy#90, by @bzbarsky.
-
The CSS declaration block bit in the draft doesn't make sense w3c/webappsec-referrer-policy#89, by @bzbarsky.
-
"TLS-protected" link seems not very useful w3c/webappsec-referrer-policy#82, by @Ms2ger.
-
-
6 pull requests opened.
-
Add snapshots of published WDs + CR w3c/webappsec-referrer-policy#88, by @jeisinger.
-
Change shortname again, hoping it works this time... w3c/webappsec-referrer-policy#87, by @jeisinger.
-
Undo change of shortname, and instead mark the spec as unlevelled w3c/webappsec-referrer-policy#86, by @jeisinger.
-
Update shortname to match the URL on w3c.org w3c/webappsec-referrer-policy#85, by @jeisinger.
-
Fix specberus errors w3c/webappsec-referrer-policy#84, by @jeisinger.
-
Update "Integration with CSS" section to be more concrete w3c/webappsec-referrer-policy#83, by @jeisinger.
-
-
6 pull requests merged.
-
Add snapshots of published WDs + CR w3c/webappsec-referrer-policy#88.
-
Change shortname again, hoping it works this time... w3c/webappsec-referrer-policy#87.
-
Undo change of shortname, and instead mark the spec as unlevelled w3c/webappsec-referrer-policy#86.
-
Update shortname to match the URL on w3c.org w3c/webappsec-referrer-policy#85.
-
Fix specberus errors w3c/webappsec-referrer-policy#84.
-
Update "Integration with CSS" section to be more concrete w3c/webappsec-referrer-policy#83.
-
-
1 pull request closed.
-
Redact origin according to policy w3c/webappsec-referrer-policy#77.
-
-
2 pull requests received 15 new comments.
-
Update "Integration with CSS" section to be more concrete w3c/webappsec-referrer-policy#83 (12 comments by @domenic, @jeisinger, @mikewest)
-
Redact origin according to policy w3c/webappsec-referrer-policy#77 (3 comments by @bzbarsky, @hillbrad)
-
w3c/webappsec-credential-management
-
9 issues opened.
-
Update body-extraction algorithm to match Fetch spec w3c/webappsec-credential-management#49, by @vabr-g.
-
Saving PSL matched credentials w3c/webappsec-credential-management#43, by @battre.
-
Dealing with failed logins w3c/webappsec-credential-management#42, by @battre.
-
Request a Credential algorithm is confusing w3c/webappsec-credential-management#41, by @vabr-g.
-
Fix bikeshed warnings w3c/webappsec-credential-management#39, by @vabr-g.
-
Example 3 has wrong input type w3c/webappsec-credential-management#36, by @vabr-g.
-
Should PasswordCredential accept `id` of the form elements if the `name` is missing? w3c/webappsec-credential-management#35, by @vabr-g.
-
PasswordCredential(HTMLFormElement form) may fail in valid password change form cases w3c/webappsec-credential-management#34, by @battre.
-
PasswordCredential(HTMLFormElement form) Constructor not very robust w3c/webappsec-credential-management#32, by @battre.
-
-
5 issues closed.
-
Should PasswordCredential accept `id` of the form elements if the `name` is missing? w3c/webappsec-credential-management#35.
-
CREDENTIAL: Add `toURLSearchParams` w3c/webappsec-credential-management#9.
-
Example 3 has wrong input type w3c/webappsec-credential-management#36.
-
Some example code don't work w3c/webappsec-credential-management#15.
-
Typo w3c/webappsec-credential-management#10.
-
-
11 issues received 30 new comments.
-
Allow a site to specify a JSON template with a placeholder for the credential w3c/webappsec-credential-management#21 (6 comments by @mikewest, @vabr-g)
-
Support programmatically filling a `<form>` with a PasswordCredential w3c/webappsec-credential-management#17 (5 comments by @battre, @mikewest)
-
Unclear how to distinguish between: no credentials versus user dismisses login window (clicks X) w3c/webappsec-credential-management#23 (4 comments by @battre, @seansan)
-
Request a Credential algorithm is confusing w3c/webappsec-credential-management#41 (4 comments by @battre, @vabr-g)
-
Should PasswordCredential accept `id` of the form elements if the `name` is missing? w3c/webappsec-credential-management#35 (2 comments by @mikewest, @vabr-g)
-
CREDENTIAL: Add `toURLSearchParams` w3c/webappsec-credential-management#9 (2 comments by @battre, @mikewest)
-
Clarify storage of a SiteBoundCredential w3c/webappsec-credential-management#28 (1 comment by @battre)
-
PasswordCredential(HTMLFormElement form) may fail in valid password change form cases w3c/webappsec-credential-management#34 (1 comment by @vabr-g)
-
-
12 pull requests opened.
-
Update 'Extract body' algorithm to fit in the latest Fetch spec w3c/webappsec-credential-management#50, by @vabr-g.
-
additionalData should handle generic objects w3c/webappsec-credential-management#48, by @vabr-g.
-
Clarify the "Request a Credential" algorithm w3c/webappsec-credential-management#47, by @vabr-g.
-
Issue 28: Clarify storing credentials w3c/webappsec-credential-management#46, by @battre.
-
Issue 20: Clarify unmediated get w3c/webappsec-credential-management#45, by @battre.
-
Note that a UA may create a new credential from the selection UI w3c/webappsec-credential-management#44, by @battre.
-
Fix easy bikeshed warnings for index.html w3c/webappsec-credential-management#40, by @vabr-g.
-
Fix input type for passwords w3c/webappsec-credential-management#38, by @battre.
-
Instruct to call store() after get() w3c/webappsec-credential-management#37, by @battre.
-
Fix IDP selector in example 2. w3c/webappsec-credential-management#33, by @battre.
-
Fix for issue 15: Some example code does not work w3c/webappsec-credential-management#31, by @battre.
-
Fix typo (s/chosent/chosen/) w3c/webappsec-credential-management#30, by @battre.
-
-
6 pull requests merged.
-
Clarify the "Request a Credential" algorithm w3c/webappsec-credential-management#47.
-
Fix easy bikeshed warnings for index.html w3c/webappsec-credential-management#40.
-
Fix input type for passwords w3c/webappsec-credential-management#38.
-
Fix IDP selector in example 2. w3c/webappsec-credential-management#33.
-
Fix for issue 15: Some example code does not work w3c/webappsec-credential-management#31.
-
Fix typo (s/chosent/chosen/) w3c/webappsec-credential-management#30.
-
-
12 pull requests received 47 new comments.
-
additionalData should handle generic objects w3c/webappsec-credential-management#48 (21 comments by @domenic, @mikewest, @tobie, @vabr-g)
-
Instruct to call store() after get() w3c/webappsec-credential-management#37 (8 comments by @battre, @mikewest, @vabr-g)
-
Fix for issue 15: Some example code does not work w3c/webappsec-credential-management#31 (4 comments by @battre, @vabr-g)
-
Fix typo (s/chosent/chosen/) w3c/webappsec-credential-management#30 (3 comments by @mikewest, @vabr-g)
-
Issue 28: Clarify storing credentials w3c/webappsec-credential-management#46 (2 comments by @mikewest)
-
Update 'Extract body' algorithm to fit in the latest Fetch spec w3c/webappsec-credential-management#50 (1 comment by @vabr-g)
-
Clarify the "Request a Credential" algorithm w3c/webappsec-credential-management#47 (1 comment by @vabr-g)
-
Note that a UA may create a new credential from the selection UI w3c/webappsec-credential-management#44 (1 comment by @mikewest)
-
Fix easy bikeshed warnings for index.html w3c/webappsec-credential-management#40 (1 comment by @vabr-g)
-
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
Sending expected headers & allowing public keys integrity w3c/webappsec-subresource-integrity#62, by @homakov.
-
Mysterious "element:" at top of spec w3c/webappsec-subresource-integrity#61, by @foolip.
-
-
1 issue closed.
-
Sending expected headers & allowing public keys integrity w3c/webappsec-subresource-integrity#62.
-
-
4 issues received 9 new comments.
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (4 comments by @btrask, @hillbrad, @kevincox, @ScottHelme)
-
Sending expected headers & allowing public keys integrity w3c/webappsec-subresource-integrity#62 (3 comments by @annevk, @mozfreddyb)
-
Extend SRI to apply to <link rel=preload> w3c/webappsec-subresource-integrity#26 (1 comment by @yoavweiss)
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (1 comment by @adon-at-work)
-
w3c/webappsec
-
1 issue opened.
-
CSP: Specification of report-uri misleading w3c/webappsec#521, by @sbrewell.
-
-
1 issue closed.
-
CSP: Specification of report-uri misleading w3c/webappsec#521.
-
-
3 issues received 15 new comments.
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139 (8 comments by @bzbarsky, @mikewest, @zcorpan)
-
CSP: Specification of report-uri misleading w3c/webappsec#521 (6 comments by @mikewest, @sbrewell, @ScottHelme)
-
-
3 pull requests opened.
-
more realistic team-contact time w3c/webappsec#524, by @wseltzer.
-
update IETF ref w3c/webappsec#523, by @wseltzer.
-
Editorial changes w3c/webappsec#522, by @wseltzer.
-
-
3 pull requests merged.
-
Editorial changes w3c/webappsec#522.
-
more realistic team-contact time w3c/webappsec#524.
-
update IETF ref w3c/webappsec#523.
-
-
1 pull request received 2 new comments.
w3c/webappsec-csp
-
4 issues opened.
-
Clarify matching expressions with `host-source` but without `scheme-source` w3c/webappsec-csp#166, by @shekyan.
-
`scheme-source` matching algorithm skips port matching w3c/webappsec-csp#162, by @shekyan.
-
Specify browser behavior for CSP headers on 304 (not modified) responses w3c/webappsec-csp#161, by @lweichselbaum.
-
Clarification needed on location of Subtype key to indicate Alternate content-type w3c/webappsec-csp#159, by @journeymansix.
-
-
1 issue closed.
-
Clarification needed on location of Subtype key to indicate Alternate content-type w3c/webappsec-csp#159.
-
-
1 issue reopened.
-
Clarify worker-src goals w3c/webappsec-csp#146, by @mikewest.
-
-
7 issues received 21 new comments.
-
Clarify matching expressions with `host-source` but without `scheme-source` w3c/webappsec-csp#166 (4 comments by @mikewest, @shekyan)
-
Specify browser behavior for CSP headers on 304 (not modified) responses w3c/webappsec-csp#161 (3 comments by @annevk, @mikewest)
-
`scheme-source` matching algorithm skips port matching w3c/webappsec-csp#162 (2 comments by @mikewest, @shekyan)
-
Clarification needed on location of Subtype key to indicate Alternate content-type w3c/webappsec-csp#159 (2 comments by @journeymansix, @mikewest)
-
Consider providing a way to tighten source-expressions that contain `self` w3c/webappsec-csp#91 (2 comments by @april)
-
10 pull requests opened.
-
EE: Subsumption algorithm w3c/webappsec-csp#170, by @aubakirova.
-
EE: Fixing linking and errors w3c/webappsec-csp#169, by @aubakirova.
-
EE: Response's CSP list subsumption w3c/webappsec-csp#168, by @aubakirova.
-
EE: Path matching fix w3c/webappsec-csp#167, by @aubakirova.
-
EE: Effective source list w3c/webappsec-csp#165, by @aubakirova.
-
Embedding-CSP: Intersection of a list of policies. w3c/webappsec-csp#164, by @aubakirova.
-
Embedding-CSP: What is an intersection of two policy objects? w3c/webappsec-csp#163, by @aubakirova.
-
Embedding-CSP: Small fixes w3c/webappsec-csp#160, by @aubakirova.
-
Embedding-CSP: Changing serialized-source-list to source-list w3c/webappsec-csp#158, by @aubakirova.
-
Embedding-CSP: Intersection of two source lists. w3c/webappsec-csp#157, by @aubakirova.
-
-
12 pull requests merged.
-
EE: Fixing linking and errors w3c/webappsec-csp#169.
-
EE: Response's CSP list subsumption w3c/webappsec-csp#168.
-
EE: Effective source list w3c/webappsec-csp#165.
-
Embedding-CSP: Intersection of a list of policies. w3c/webappsec-csp#164.
-
Embedding-CSP: What is an intersection of two policy objects? w3c/webappsec-csp#163.
-
Embedding-CSP: Intersection of two source lists. w3c/webappsec-csp#157.
-
EE: Path matching fix w3c/webappsec-csp#167.
-
Embedding-CSP: Changing serialized-source-list to source-list w3c/webappsec-csp#158.
-
Embedding CSP: Finding effective directive for a given name w3c/webappsec-csp#153.
-
Embbeding-CSP: Subsumption on policy to policy level w3c/webappsec-csp#154.
-
Embedding-CSP: Small fixes w3c/webappsec-csp#160.
-
Fixing a type in a domain name w3c/webappsec-csp#156.
-
-
1 pull request closed.
-
Update index.src.html: fix typo w3c/webappsec-csp#102.
-
-
13 pull requests received 145 new comments.
-
Embedding-CSP: Intersection of two source lists. w3c/webappsec-csp#157 (39 comments by @aubakirova, @mikewest)
-
Embbeding-CSP: Subsumption on policy to policy level w3c/webappsec-csp#154 (26 comments by @aubakirova, @mikewest)
-
EE: Fixing linking and errors w3c/webappsec-csp#169 (18 comments by @aubakirova, @mikewest, @tabatkins)
-
Embedding-CSP: What is an intersection of two policy objects? w3c/webappsec-csp#163 (10 comments by @aubakirova, @mikewest)
-
Embedding-CSP: Intersection of a list of policies. w3c/webappsec-csp#164 (6 comments by @aubakirova, @mikewest)
-
Embedding-CSP: Changing serialized-source-list to source-list w3c/webappsec-csp#158 (6 comments by @aubakirova, @mikewest)
-
Embedding CSP: Finding effective directive for a given name w3c/webappsec-csp#153 (2 comments by @aubakirova)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Specify handling of IDN / Unicode chars in origins w3c/webappsec-permissions-policy#51, by @clelland.
-
Feature proposal: opener w3c/webappsec-permissions-policy#50, by @clelland.
-
-
1 issue received 1 new comment.
w3c/webcrypto
-
1 issue closed.
-
Bug 27815 - IANA Considerations for "ext" w3c/webcrypto#78.
-
-
3 issues received 3 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @evilaliv3)
w3c/webappsec-clear-site-data
-
1 pull request opened.
-
Improve the clear-cookies/clear-dom sections. w3c/webappsec-clear-site-data#15, by @msramek.
-
-
1 pull request merged.
-
Add a demo implementation. w3c/webappsec-clear-site-data#14.
-
-
3 pull requests received 17 new comments.
-
Fix the examples in section 2.1.1 w3c/webappsec-clear-site-data#6 (2 comments by @msramek, @wseltzer)
w3c/permissions
-
1 issue received 1 new comment.
-
1 pull request received 1 new comment.
-
Define restrictions on "device-info" permission (from TPAC). w3c/permissions#131 (1 comment by @alvestrand)
-
TR publications
-
1 document published.
-
Content Security Policy Level 2 published as a Proposed Recommendation. History of Content Security Policy Level 2
-
Participants
-
1 organization joined.
-
China Mobile Communications Corporation joined.
-
-
1 organization left.
-
WIZVERA Co., Ltd. left.
-
GitHub
w3c/webappsec-csp
-
6 issues opened.
-
Thoughts on letting CSP govern attributes that must appear in Set-Cookie w3c/webappsec-csp#152, by @aidantwoods.
-
The specification examples do not follow specification advice regarding nonces w3c/webappsec-csp#148, by @briansmith.
-
Make `unsafe-hashed-attributes' less unsafe w3c/webappsec-csp#147, by @briansmith.
-
Clarify worker-src goals w3c/webappsec-csp#146, by @briansmith.
-
Deprecate child-src w3c/webappsec-csp#145, by @briansmith.
-
Does CSP3+Fetch apply to redirects correctly? w3c/webappsec-csp#134, by @estark37.
-
-
3 issues closed.
-
Deprecate child-src w3c/webappsec-csp#145.
-
The specification examples do not follow specification advice regarding nonces w3c/webappsec-csp#148.
-
Allow `hash-source` expressions match integrity metadata for external scripts. w3c/webappsec-csp#78.
-
-
11 issues received 31 new comments.
-
Clarify worker-src goals w3c/webappsec-csp#146 (14 comments by @annevk, @arturjanc, @briansmith, @mikewest)
-
Does CSP3+Fetch apply to redirects correctly? w3c/webappsec-csp#134 (5 comments by @anforowicz, @annevk, @mikewest)
-
Make `unsafe-hashed-attributes' less unsafe w3c/webappsec-csp#147 (3 comments by @arturjanc, @briansmith, @mikewest)
-
Allow `hash-source` expressions match integrity metadata for external scripts. w3c/webappsec-csp#78 (2 comments by @devd, @mikewest)
-
Thoughts on letting CSP govern attributes that must appear in Set-Cookie w3c/webappsec-csp#152 (1 comment by @aidantwoods)
-
-
17 pull requests opened.
-
Fixing a type in a domain name w3c/webappsec-csp#156, by @aubakirova.
-
Explaining `self` in Embedded Enforcement w3c/webappsec-csp#155, by @aubakirova.
-
Embbeding-CSP: Subsumption on policy to policy level w3c/webappsec-csp#154, by @aubakirova.
-
Embedding CSP: Finding effective directive for a given name w3c/webappsec-csp#153, by @aubakirova.
-
Part 3.1 of Subsumption Algorithm: Addign support for source wildcards w3c/webappsec-csp#151, by @aubakirova.
-
Referencing `allow-unsafe-inline` in embedded/ from csp3 w3c/webappsec-csp#150, by @aubakirova.
-
Extracting `allow all inline` to re-use in embedded/index.src.html w3c/webappsec-csp#149, by @aubakirova.
-
Part 2.3: What is an intersection of the two source expressions? w3c/webappsec-csp#144, by @aubakirova.
-
Definition of subsumption w3c/webappsec-csp#143, by @aubakirova.
-
Handle navigation to `javascript:` URLs as inline script. w3c/webappsec-csp#142, by @mikewest.
-
Part 1.3: Does a serialized-source-list `A` subsume a serialized-source-list `B`? w3c/webappsec-csp#141, by @aubakirova.
-
Part 1.2: Does a list of source expressions `A` subsume a list of source expressions `B`? w3c/webappsec-csp#140, by @aubakirova.
-
Make mode explicit. w3c/webappsec-csp#139, by @jdalton.
-
Does source expression subsume another source expression? w3c/webappsec-csp#138, by @aubakirova.
-
Adding match-hosts, match-ports and match-paths. w3c/webappsec-csp#137, by @aubakirova.
-
Adding algorithm "Does scheme-part match another scheme-part?" w3c/webappsec-csp#136, by @aubakirova.
-
Use request's "current url" rather than "url". w3c/webappsec-csp#135, by @mikewest.
-
-
13 pull requests merged.
-
Explaining `self` in Embedded Enforcement w3c/webappsec-csp#155.
-
Part 2.3: What is an intersection of the two source expressions? w3c/webappsec-csp#144.
-
Part 3.1 of Subsumption Algorithm: Addign support for source wildcards w3c/webappsec-csp#151.
-
Referencing `allow-unsafe-inline` in embedded/ from csp3 w3c/webappsec-csp#150.
-
Extracting `allow all inline` to re-use in embedded/index.src.html w3c/webappsec-csp#149.
-
Part 1.2: Does a list of source expressions `A` subsume a list of source expressions `B`? w3c/webappsec-csp#140.
-
Handle navigation to `javascript:` URLs as inline script. w3c/webappsec-csp#142.
-
Definition of subsumption w3c/webappsec-csp#143.
-
Does source expression subsume another source expression? w3c/webappsec-csp#138.
-
Adding match-hosts, match-ports and match-paths. w3c/webappsec-csp#137.
-
Make mode explicit. w3c/webappsec-csp#139.
-
Use request's "current url" rather than "url". w3c/webappsec-csp#135.
-
Adding algorithm "Does scheme-part match another scheme-part?" w3c/webappsec-csp#136.
-
-
2 pull requests closed.
-
Part 1.3: Does a serialized-source-list `A` subsume a serialized-source-list `B`? w3c/webappsec-csp#141.
-
-
15 pull requests received 208 new comments.
-
Part 1.2: Does a list of source expressions `A` subsume a list of source expressions `B`? w3c/webappsec-csp#140 (45 comments by @aubakirova, @mikewest)
-
Part 2.3: What is an intersection of the two source expressions? w3c/webappsec-csp#144 (40 comments by @aubakirova, @mikewest)
-
Adding match-hosts, match-ports and match-paths. w3c/webappsec-csp#137 (35 comments by @aubakirova, @mikewest)
-
Extracting `allow all inline` to re-use in embedded/index.src.html w3c/webappsec-csp#149 (20 comments by @aubakirova, @mikewest)
-
Referencing `allow-unsafe-inline` in embedded/ from csp3 w3c/webappsec-csp#150 (18 comments by @aubakirova, @mikewest)
-
Does source expression subsume another source expression? w3c/webappsec-csp#138 (14 comments by @aubakirova, @mikewest)
-
Adding algorithm "Does scheme-part match another scheme-part?" w3c/webappsec-csp#136 (11 comments by @aubakirova, @michaelficarra, @mikewest, @wseltzer)
-
Embedding CSP: Finding effective directive for a given name w3c/webappsec-csp#153 (3 comments by @aubakirova, @mikewest)
-
Handle navigation to `javascript:` URLs as inline script. w3c/webappsec-csp#142 (3 comments by @annevk, @bzbarsky, @mikewest)
-
Part 1.3: Does a serialized-source-list `A` subsume a serialized-source-list `B`? w3c/webappsec-csp#141 (3 comments by @aubakirova, @mikewest)
-
Explaining `self` in Embedded Enforcement w3c/webappsec-csp#155 (2 comments by @aubakirova, @michaelficarra)
-
Part 3.1 of Subsumption Algorithm: Addign support for source wildcards w3c/webappsec-csp#151 (2 comments by @aubakirova, @mikewest)
-
Embbeding-CSP: Subsumption on policy to policy level w3c/webappsec-csp#154 (1 comment by @aubakirova)
-
w3c/webappsec-clear-site-data
-
2 issues closed.
-
Clear-Site-Data should not work for fetch() without 'credentials' w3c/webappsec-clear-site-data#4.
-
Clear-Site-Data must not be honored if the response was modified by a service worker w3c/webappsec-clear-site-data#5.
-
-
4 pull requests opened.
-
Add a demo implementation. w3c/webappsec-clear-site-data#14, by @msramek.
-
update jfv reference w3c/webappsec-clear-site-data#13, by @reschke.
-
Update JFV reference w3c/webappsec-clear-site-data#12, by @reschke.
-
Link section 3.3. to the clear() API. w3c/webappsec-clear-site-data#11, by @msramek.
-
-
3 pull requests merged.
-
Update JFV reference w3c/webappsec-clear-site-data#12.
-
update jfv reference w3c/webappsec-clear-site-data#13.
-
Respect the credentials mode (in section 2.3. Fetch integration) w3c/webappsec-clear-site-data#7.
-
-
1 pull request closed.
-
Ignore Clear-Site-Data on service worker responses w3c/webappsec-clear-site-data#10.
-
-
7 pull requests received 23 new comments.
-
Respect the credentials mode (in section 2.3. Fetch integration) w3c/webappsec-clear-site-data#7 (8 comments by @mikewest, @msramek)
-
Link section 3.3. to the clear() API. w3c/webappsec-clear-site-data#11 (7 comments by @annevk, @mikewest, @msramek)
-
Fix the examples in section 2.1.1 w3c/webappsec-clear-site-data#6 (2 comments by @msramek, @wseltzer)
-
Ignore Clear-Site-Data on service worker responses w3c/webappsec-clear-site-data#10 (1 comment by @msramek)
-
w3c/webcrypto
-
1 issue opened.
-
"Asynchronously perform the remaining steps" is not well-defined w3c/webcrypto#168, by @bzbarsky.
-
-
1 issue received 1 new comment.
w3c/webappsec-cors-for-developers
-
1 pull request opened.
-
Fix incorrect ACAM header w3c/webappsec-cors-for-developers#6, by @april.
-
w3c/webappsec-permissions-policy
-
8 issues opened.
-
Additional feature: WebVR w3c/webappsec-permissions-policy#49, by @ddorwin.
-
The implications of the default disable/enable policy are unclear w3c/webappsec-permissions-policy#48, by @ddorwin.
-
Delivery section should address new/unrecognized features and directive members w3c/webappsec-permissions-policy#47, by @ddorwin.
-
Normatively reference a definition of "origin" w3c/webappsec-permissions-policy#46, by @ddorwin.
-
Provide example(s) of enabling disabled-by-default feature(s) w3c/webappsec-permissions-policy#45, by @ddorwin.
-
Address addition of new features w3c/webappsec-permissions-policy#44, by @ddorwin.
-
(Updated) Feature Policy v1 explainer w3c/webappsec-permissions-policy#43, by @igrigorik.
-
The WebIDL in section 2.4.1 cookie redefines document.cookie w3c/webappsec-permissions-policy#42, by @tobie.
-
-
6 issues closed.
-
Add information about scope of policy to the Introduction w3c/webappsec-permissions-policy#32.
-
Relationship with permissions spec w3c/webappsec-permissions-policy#27.
-
Disable Set-Cookie also + other storage w3c/webappsec-permissions-policy#16.
-
Understand relationship of OriginPolicy with FeaturePolicy/ContentSecurityPolicy w3c/webappsec-permissions-policy#35.
-
Support for enable/disable attribute on iframes w3c/webappsec-permissions-policy#11.
-
Define disable policy for Permissions API? w3c/webappsec-permissions-policy#14.
-
-
11 issues received 31 new comments.
-
(Updated) Feature Policy v1 explainer w3c/webappsec-permissions-policy#43 (12 comments by @alvestrand, @annevk, @igrigorik, @raymeskhoury, @tobie)
-
How should iframe navigations work? w3c/webappsec-permissions-policy#38 (7 comments by @clelland, @igrigorik, @raymeskhoury)
-
Relationship with permissions spec w3c/webappsec-permissions-policy#27 (4 comments by @alvestrand, @igrigorik)
-
Add information about scope of policy to the Introduction w3c/webappsec-permissions-policy#32 (1 comment by @igrigorik)
-
Send feature policy in sub-resource request headers w3c/webappsec-permissions-policy#20 (1 comment by @igrigorik)
-
Disable Set-Cookie also + other storage w3c/webappsec-permissions-policy#16 (1 comment by @igrigorik)
-
Understand relationship of OriginPolicy with FeaturePolicy/ContentSecurityPolicy w3c/webappsec-permissions-policy#35 (1 comment by @igrigorik)
-
Support for enable/disable attribute on iframes w3c/webappsec-permissions-policy#11 (1 comment by @igrigorik)
-
Define disable policy for Permissions API? w3c/webappsec-permissions-policy#14 (1 comment by @igrigorik)
-
-
1 pull request opened.
-
Update JFV reference w3c/webappsec-permissions-policy#41, by @reschke.
-
-
1 pull request merged.
-
Update JFV reference w3c/webappsec-permissions-policy#41.
-
-
1 pull request received 2 new comments.
w3c/webappsec
-
2 issues received 5 new comments.
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Add an example for multiple Referrer-Policy headers w3c/webappsec-referrer-policy#81, by @estark37.
-
-
1 issue received 1 new comment.
-
Add an example for multiple Referrer-Policy headers w3c/webappsec-referrer-policy#81 (1 comment by @april)
-
-
2 pull requests merged.
-
Editorial: export terms for Fetch w3c/webappsec-referrer-policy#80.
-
Editorial: reduce dependency on anchors block w3c/webappsec-referrer-policy#79.
-
-
5 pull requests received 24 new comments.
-
Add a section about CSS and referrers (#5) w3c/webappsec-referrer-policy#68 (12 comments by @bzbarsky, @jeisinger)
-
Editorial: export terms for Fetch w3c/webappsec-referrer-policy#80 (5 comments by @annevk, @estark37)
-
Editorial: reduce dependency on anchors block w3c/webappsec-referrer-policy#79 (5 comments by @annevk, @estark37)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
121 w3c/webappsec-upgrade-insecure-requests#6, by @TomHardyrus.
-
w3c/webappsec-credential-management
-
1 pull request merged.
-
Clarify the autocomplete attribute behavior. w3c/webappsec-credential-management#22.
-
-
1 pull request received 2 new comments.
-
Clarify the autocomplete attribute behavior. w3c/webappsec-credential-management#22 (2 comments by @mikewest, @vabr-g)
-
w3c/webappsec-subresource-integrity
-
1 issue closed.
-
Upstream the `integrity` attribute to HTML. w3c/webappsec-subresource-integrity#31.
-
-
1 issue received 3 new comments.
-
Require that proxies do not modify integrity checked assets w3c/webappsec-subresource-integrity#60 (3 comments by @fmarier, @mozfreddyb, @ScottHelme)
-
TR publications
-
1 document published.
-
Referrer Policy published as a Working Draft. History of Referrer Policy
-
Participants
-
1 participant left.
-
Tobias Gondrom (W3C Invited Experts) left.
-
-
1 organization joined.
-
Opera Software AS joined.
-
GitHub
w3c/webappsec-subresource-integrity
-
4 issues opened.
-
Require that proxies do not modify integrity checked assets w3c/webappsec-subresource-integrity#60, by @ScottHelme.
-
<script type=module> w3c/webappsec-subresource-integrity#59, by @mozfreddyb.
-
Consider Shared Library Cache w3c/webappsec-subresource-integrity#58, by @ghost.
-
Applying SRI to HTTP ranges w3c/webappsec-subresource-integrity#57, by @darobin.
-
-
1 issue closed.
-
Consider Shared Library Cache w3c/webappsec-subresource-integrity#58.
-
-
4 issues received 15 new comments.
-
Require that proxies do not modify integrity checked assets w3c/webappsec-subresource-integrity#60 (6 comments by @fmarier, @ScottHelme, @shekyan)
-
Upstream the `integrity` attribute to HTML. w3c/webappsec-subresource-integrity#31 (5 comments by @devd, @joelweinberger, @mikewest)
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (2 comments by @kevincox, @mozfreddyb)
-
Consider Shared Library Cache w3c/webappsec-subresource-integrity#58 (2 comments by @annevk, @mozfreddyb)
-
w3c/webappsec-csp
-
9 issues opened.
-
Embedded Enforcement: Allowed directives w3c/webappsec-csp#132, by @aubakirova.
-
Embedded Enforcement: Invalid required csp attribute on iframe w3c/webappsec-csp#131, by @aubakirova.
-
Having problems setting up "worker-src" help pls w3c/webappsec-csp#130, by @ghost.
-
Multiple headers of Allow-CSP-From w3c/webappsec-csp#129, by @aubakirova.
-
SecurityPolicyViolation and shadow trees w3c/webappsec-csp#128, by @annevk.
-
Interaction of CSP and javascript: URLs in iframe src is not defined anywhere w3c/webappsec-csp#127, by @bzbarsky.
-
Embedded: Think about the implications of allowing injected `csp` with reporting. w3c/webappsec-csp#126, by @mikewest.
-
Allow navigation to only whitelisted URLs via navigate-to w3c/webappsec-csp#125, by @april.
-
Stop using whitelist as a term w3c/webappsec-csp#124, by @annevk.
-
-
4 issues closed.
-
Stop using whitelist as a term w3c/webappsec-csp#124.
-
Having problems setting up "worker-src" help pls w3c/webappsec-csp#130.
-
Embedded Enforcement: Allowed directives w3c/webappsec-csp#132.
-
SecurityPolicyViolation and shadow trees w3c/webappsec-csp#128.
-
-
8 issues received 49 new comments.
-
SecurityPolicyViolation and shadow trees w3c/webappsec-csp#128 (15 comments by @annevk, @foolip, @mikewest)
-
Allow navigation to only whitelisted URLs via navigate-to w3c/webappsec-csp#125 (8 comments by @april, @dhausknecht, @hillbrad, @mikewest)
-
Interaction of CSP and javascript: URLs in iframe src is not defined anywhere w3c/webappsec-csp#127 (8 comments by @annevk, @bzbarsky, @shekyan)
-
Specify behavior of prefetch requests w3c/webappsec-csp#107 (7 comments by @april, @mikewest, @yoavweiss)
-
Having problems setting up "worker-src" help pls w3c/webappsec-csp#130 (3 comments by @annevk, @ghost, @mikewest)
-
Allow `hash-source` expressions match integrity metadata for external scripts. w3c/webappsec-csp#78 (3 comments by @devd, @fmarier)
-
-
2 pull requests opened.
-
Is scheme-source / host-source expression subsumed under another scheme-source / host-source? w3c/webappsec-csp#133, by @aubakirova.
-
Update IDL to introduce SecurityPolicyVioationEventDisposition type w3c/webappsec-csp#122, by @shekyan.
-
-
1 pull request merged.
-
Update IDL to introduce SecurityPolicyVioationEventDisposition type w3c/webappsec-csp#122.
-
-
1 pull request received 1 new comment.
-
Update IDL to introduce SecurityPolicyVioationEventDisposition type w3c/webappsec-csp#122 (1 comment by @mikewest)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
noreferrer isn't integrated with <link> w3c/webappsec-referrer-policy#74, by @jdm.
-
-
2 issues closed.
-
Travis config is broken w3c/webappsec-referrer-policy#61.
-
Define how CSS interacts with spec for the sake of defining how referrers should be handled w3c/webappsec-referrer-policy#5.
-
-
7 pull requests opened.
-
Editorial: export terms for Fetch w3c/webappsec-referrer-policy#80, by @annevk.
-
Editorial: reduce dependency on anchors block w3c/webappsec-referrer-policy#79, by @annevk.
-
Use "potentially trustworthy URLs" w3c/webappsec-referrer-policy#78, by @hillbrad.
-
Redact origin according to policy w3c/webappsec-referrer-policy#77, by @hillbrad.
-
Add link element referrerpolicy dfn w3c/webappsec-referrer-policy#76, by @estark37.
-
Attempt to fix travis config (fixes #61) w3c/webappsec-referrer-policy#75, by @jeisinger.
-
-
5 pull requests merged.
-
Use "potentially trustworthy URLs" w3c/webappsec-referrer-policy#78.
-
Add link element referrerpolicy dfn w3c/webappsec-referrer-policy#76.
-
Copy edit w3c/webappsec-referrer-policy#73.
-
Attempt to fix travis config (fixes #61) w3c/webappsec-referrer-policy#75.
-
Add a section about CSS and referrers (#5) w3c/webappsec-referrer-policy#68.
-
-
5 pull requests received 42 new comments.
-
Redact origin according to policy w3c/webappsec-referrer-policy#77 (34 comments by @annevk, @bzbarsky, @domenic, @estark37, @hillbrad, @jeisinger, @mikewest)
-
Editorial: reduce dependency on anchors block w3c/webappsec-referrer-policy#79 (2 comments by @annevk)
-
Use "potentially trustworthy URLs" w3c/webappsec-referrer-policy#78 (2 comments by @domenic, @estark37)
-
w3c/webappsec-secure-contexts
-
1 issue reopened.
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26, by @annevk.
-
-
1 issue received 2 new comments.
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26 (2 comments by @bzbarsky)
-
w3c/webappsec-credential-management
-
4 issues opened.
-
5.3. Credential Selection could make it clearer which credentials are allowed to be presented w3c/webappsec-credential-management#29, by @vabr-g.
-
Clarify storage of a SiteBoundCredential w3c/webappsec-credential-management#28, by @jonathanKingston.
-
PasswordCredential(HTMLFormElement form) Constructor typo? w3c/webappsec-credential-management#26, by @jonathanKingston.
-
"Integration with fetch" section should probably be part of fetch w3c/webappsec-credential-management#24, by @bzbarsky.
-
-
1 issue closed.
-
PasswordCredential(HTMLFormElement form) Constructor typo? w3c/webappsec-credential-management#26.
-
-
5 issues received 13 new comments.
-
Clarify storage of a SiteBoundCredential w3c/webappsec-credential-management#28 (5 comments by @jonathanKingston, @mikewest, @vabr-g)
-
5.3. Credential Selection could make it clearer which credentials are allowed to be presented w3c/webappsec-credential-management#29 (2 comments by @mikewest, @vabr-g)
-
Unclear how to distinguish between: no credentials versus user dismisses login window (clicks X) w3c/webappsec-credential-management#23 (2 comments by @mikewest, @vabr-g)
-
PasswordCredential(HTMLFormElement form) Constructor typo? w3c/webappsec-credential-management#26 (2 comments by @vabr-g)
-
"Integration with fetch" section should probably be part of fetch w3c/webappsec-credential-management#24 (2 comments by @bzbarsky, @mikewest)
-
-
2 pull requests opened.
-
formData -> params in step 9.3 of 3.1.3.1 w3c/webappsec-credential-management#27, by @vabr-g.
-
Request() needs new w3c/webappsec-credential-management#25, by @tyoshino.
-
-
2 pull requests merged.
-
formData -> params in step 9.3 of 3.1.3.1 w3c/webappsec-credential-management#27.
-
Request() needs new w3c/webappsec-credential-management#25.
-
-
2 pull requests received 7 new comments.
-
Request() needs new w3c/webappsec-credential-management#25 (5 comments by @mikewest, @tyoshino, @vabr-g, @wseltzer)
-
formData -> params in step 9.3 of 3.1.3.1 w3c/webappsec-credential-management#27 (2 comments by @mikewest, @vabr-g)
-
w3c/webappsec-permissions-policy
-
3 issues opened.
-
eme: Encrypted Media Extensions w3c/webappsec-permissions-policy#40, by @ghost.
-
Error handling while parsing policy strings w3c/webappsec-permissions-policy#39, by @clelland.
-
How should iframe navigations work? w3c/webappsec-permissions-policy#38, by @raymeskhoury.
-
-
3 issues received 16 new comments.
-
How should iframe navigations work? w3c/webappsec-permissions-policy#38 (9 comments by @clelland, @igrigorik, @mikewest, @raymeskhoury)
-
Error handling while parsing policy strings w3c/webappsec-permissions-policy#39 (5 comments by @igrigorik, @ojanvafai, @tabatkins)
-
w3c/webappsec-suborigins
-
3 issues opened.
-
Don't use The Web Origin Concept w3c/webappsec-suborigins#53, by @annevk.
-
Update security model opt-out flags to interact with processing models w3c/webappsec-suborigins#51, by @joelweinberger.
-
Stop using blacklist as a term w3c/webappsec-suborigins#49, by @annevk.
-
-
6 issues closed.
-
Don't use The Web Origin Concept w3c/webappsec-suborigins#53.
-
Define 'physical origin' w3c/webappsec-suborigins#17.
-
set-cookie with suborigin header should set cookie in new cookie jar w3c/webappsec-suborigins#27.
-
<meta http-equiv="Set-Cookie" content="..."> should be ignored w3c/webappsec-suborigins#36.
-
Default to withCredentials=true for CORS requests w3c/webappsec-suborigins#33.
-
Stop using blacklist as a term w3c/webappsec-suborigins#49.
-
-
7 issues received 13 new comments.
-
Don't use The Web Origin Concept w3c/webappsec-suborigins#53 (4 comments by @annevk, @devd, @joelweinberger)
-
set-cookie with suborigin header should set cookie in new cookie jar w3c/webappsec-suborigins#27 (2 comments by @joelweinberger)
-
<meta http-equiv="Set-Cookie" content="..."> should be ignored w3c/webappsec-suborigins#36 (2 comments by @joelweinberger)
-
Default to withCredentials=true for CORS requests w3c/webappsec-suborigins#33 (1 comment by @joelweinberger)
-
Behavior of Host prefix in the presence of unsafe-cookies option w3c/webappsec-suborigins#28 (1 comment by @devd)
-
-
12 pull requests opened.
-
Remove issue about HTML origins w3c/webappsec-suborigins#63, by @joelweinberger.
-
Suborigin names can only start with letters. w3c/webappsec-suborigins#62, by @joelweinberger.
-
Minor WebSockets heading change w3c/webappsec-suborigins#61, by @joelweinberger.
-
Remove "origin concept" references w3c/webappsec-suborigins#60, by @joelweinberger.
-
Simplify web platform section w3c/webappsec-suborigins#59, by @joelweinberger.
-
Minor cookie wording tweaks w3c/webappsec-suborigins#58, by @joelweinberger.
-
Origin update w3c/webappsec-suborigins#57, by @joelweinberger.
-
Disable <meta> Set-Cookie w3c/webappsec-suborigins#56, by @joelweinberger.
-
Fix Document link error and lack of privacy considerations section w3c/webappsec-suborigins#55, by @joelweinberger.
-
Move opt outs to their own subsections w3c/webappsec-suborigins#54, by @joelweinberger.
-
Force with credentials w3c/webappsec-suborigins#52, by @joelweinberger.
-
Force include credentials w3c/webappsec-suborigins#50, by @joelweinberger.
-
-
12 pull requests merged.
-
Remove issue about HTML origins w3c/webappsec-suborigins#63.
-
Suborigin names can only start with letters. w3c/webappsec-suborigins#62.
-
Minor WebSockets heading change w3c/webappsec-suborigins#61.
-
Simplify web platform section w3c/webappsec-suborigins#59.
-
Remove "origin concept" references w3c/webappsec-suborigins#60.
-
Minor cookie wording tweaks w3c/webappsec-suborigins#58.
-
Origin update w3c/webappsec-suborigins#57.
-
Disable <meta> Set-Cookie w3c/webappsec-suborigins#56.
-
Fix Document link error and lack of privacy considerations section w3c/webappsec-suborigins#55.
-
Move opt outs to their own subsections w3c/webappsec-suborigins#54.
-
Force with credentials w3c/webappsec-suborigins#52.
-
Force include credentials w3c/webappsec-suborigins#50.
-
-
6 pull requests received 69 new comments.
-
Force include credentials w3c/webappsec-suborigins#50 (15 comments by @annevk, @devd, @joelweinberger)
-
Disable <meta> Set-Cookie w3c/webappsec-suborigins#56 (11 comments by @annevk, @devd, @joelweinberger)
-
Suborigin names can only start with letters. w3c/webappsec-suborigins#62 (10 comments by @devd, @hillbrad, @joelweinberger)
w3c/webcrypto
-
8 issues opened.
-
Synchronous API ? w3c/webcrypto#167, by @mcarbonneaux.
-
Add a note directing future proposals to WICG w3c/webcrypto#165, by @mwatson2.
-
Require deterministic ECDSA rather than random ECDSA w3c/webcrypto#163, by @jimsch.
-
IANA Registration - optional+ will require IETF last call w3c/webcrypto#162, by @jimsch.
-
Should AlgorithmIdentifier be (Algorithm or DOMString)? w3c/webcrypto#161, by @foolip.
-
Update key discovery note to refer to CryptoKey w3c/webcrypto#157, by @mwatson2.
-
Some notes are explicitly marked as "non-normative" w3c/webcrypto#154, by @mwatson2.
-
Import and Export X9.63 Compressed and Uncompressed ECC Keys w3c/webcrypto#152, by @xcthulhu.
-
-
12 issues closed.
-
IANA Registration - optional+ will require IETF last call w3c/webcrypto#162.
-
Should AlgorithmIdentifier be (Algorithm or DOMString)? w3c/webcrypto#161.
-
Two minor issues with ECDH and ECDSA SPKI import w3c/webcrypto#146.
-
Return type for deriveBits, importKey, unwrapKey is fixed, but not in IDL w3c/webcrypto#144.
-
GlobalCrypto IDL is not valid w3c/webcrypto#150.
-
Bug 27816 - IANA considerations review for definition of algorithms w3c/webcrypto#79.
-
Bug 27374 - Please remove older Editorial Notes from spec w3c/webcrypto#30.
-
Update key discovery note to refer to CryptoKey w3c/webcrypto#157.
-
Some notes are explicitly marked as "non-normative" w3c/webcrypto#154.
-
Replace old svn Editor's Draft with link to new one w3c/webcrypto#151.
-
-
14 issues received 30 new comments.
-
Should AlgorithmIdentifier be (Algorithm or DOMString)? w3c/webcrypto#161 (13 comments by @foolip, @ghost, @mwatson2)
-
IANA Registration - optional+ will require IETF last call w3c/webcrypto#162 (2 comments by @mwatson2)
-
Bug 27374 - Please remove older Editorial Notes from spec w3c/webcrypto#30 (2 comments by @mwatson2)
-
Bug 27255 - Inconsistent handling of SPKI / PKCS#8 data between implementations w3c/webcrypto#26 (1 comment by @mwatson2)
-
Bug 27816 - IANA considerations review for definition of algorithms w3c/webcrypto#79 (1 comment by @hhalpin)
-
-
8 pull requests opened.
-
Fix #165: Add note directing future proposals to WICG w3c/webcrypto#166, by @mwatson2.
-
Fix #162: Change JOSE registrations from Optional+ to Optional w3c/webcrypto#164, by @mwatson2.
-
Fix #26: Add notes regarding interoperability for key formats other t… w3c/webcrypto#160, by @mwatson2.
-
Fix the date on the Key Discovery Note ED w3c/webcrypto#159, by @mwatson2.
-
Fix #157: Update Key Discovery note to refer to CryptoKey w3c/webcrypto#158, by @mwatson2.
-
Fix #30: Address remaining editorial notes w3c/webcrypto#156, by @mwatson2.
-
Fix #154: Remove explicit statements within notes about non-normative… w3c/webcrypto#155, by @mwatson2.
-
Fix #150: Expose GlobalCrypto on Worker as well as Window w3c/webcrypto#153, by @mwatson2.
-
-
10 pull requests merged.
-
Fix #162: Change JOSE registrations from Optional+ to Optional w3c/webcrypto#164.
-
Fix #85: Specify the global object associated with objects we create w3c/webcrypto#135.
-
Fix #146: Specify source of data for eliptic curve key import and fix… w3c/webcrypto#148.
-
Fix #144: Include return types in IDL for methods with algorithm-inde… w3c/webcrypto#149.
-
Fix #150: Expose GlobalCrypto on Worker as well as Window w3c/webcrypto#153.
-
Fix #26: Add notes regarding interoperability for key formats other t… w3c/webcrypto#160.
-
Fix #30: Address remaining editorial notes w3c/webcrypto#156.
-
Fix the date on the Key Discovery Note ED w3c/webcrypto#159.
-
Fix #157: Update Key Discovery note to refer to CryptoKey w3c/webcrypto#158.
-
Fix #154: Remove explicit statements within notes about non-normative… w3c/webcrypto#155.
-
-
1 pull request closed.
-
Editorial Notes merged into main text w3c/webcrypto#9.
-
-
4 pull requests received 7 new comments.
-
Fix #85: Specify the global object associated with objects we create w3c/webcrypto#135 (3 comments by @bzbarsky, @hhalpin, @mwatson2)
-
Fix #162: Change JOSE registrations from Optional+ to Optional w3c/webcrypto#164 (1 comment by @jimsch)
-
Fix #146: Specify source of data for eliptic curve key import and fix… w3c/webcrypto#148 (1 comment by @mwatson2)
-
w3c/webappsec-clear-site-data
-
2 issues opened.
-
Clear-Site-Data must not be honored if the response was modified by a service worker w3c/webappsec-clear-site-data#5, by @msramek.
-
Clear-Site-Data should not work for fetch() without 'credentials' w3c/webappsec-clear-site-data#4, by @msramek.
-
-
1 issue received 1 new comment.
-
Clear-Site-Data must not be honored if the response was modified by a service worker w3c/webappsec-clear-site-data#5 (1 comment by @msramek)
-
-
5 pull requests opened.
-
Ignore Clear-Site-Data on service worker responses w3c/webappsec-clear-site-data#10, by @msramek.
-
Add a setuptools upgrade step to .travis.yml w3c/webappsec-clear-site-data#9, by @msramek.
-
Mark the 'types' dictionary member as required. w3c/webappsec-clear-site-data#8, by @msramek.
-
Respect the credentials mode (in section 2.3. Fetch integration) w3c/webappsec-clear-site-data#7, by @msramek.
-
Fix the examples in section 2.1.1 w3c/webappsec-clear-site-data#6, by @msramek.
-
-
3 pull requests merged.
-
Add a setuptools upgrade step to .travis.yml w3c/webappsec-clear-site-data#9.
-
Mark the 'types' dictionary member as required. w3c/webappsec-clear-site-data#8.
-
Fix the examples in section 2.1.1 w3c/webappsec-clear-site-data#6.
-
-
5 pull requests received 18 new comments.
-
Respect the credentials mode (in section 2.3. Fetch integration) w3c/webappsec-clear-site-data#7 (12 comments by @annevk, @mikewest, @msramek)
-
Ignore Clear-Site-Data on service worker responses w3c/webappsec-clear-site-data#10 (2 comments by @annevk, @mikewest)
-
Add a setuptools upgrade step to .travis.yml w3c/webappsec-clear-site-data#9 (1 comment by @mikewest)
-
Mark the 'types' dictionary member as required. w3c/webappsec-clear-site-data#8 (1 comment by @mikewest)
-
w3c/permissions
-
3 issues opened.
-
Mechanism for permission feature-detection? w3c/permissions#134, by @RByers.
-
Drop "The" from title w3c/permissions#132, by @annevk.
-
Support for custom permission types w3c/permissions#130, by @ThomasArdal.
-
-
1 issue closed.
-
Drop "The" from title w3c/permissions#132.
-
-
3 issues received 10 new comments.
-
Support for custom permission types w3c/permissions#130 (6 comments by @benfredwells, @jyasskin, @ThomasArdal)
-
-
2 pull requests opened.
-
Link to the Storage spec for persistent-storage's definition w3c/permissions#133, by @jyasskin.
-
Define restrictions on "device-info" permission (from TPAC). w3c/permissions#131, by @jan-ivar.
-
-
1 pull request merged.
-
Link to the Storage spec for persistent-storage's definition w3c/permissions#133.
-
-
1 pull request received 1 new comment.
-
Link to the Storage spec for persistent-storage's definition w3c/permissions#133 (1 comment by @marcoscaceres)
-
w3c/webappsec-cors-for-developers
-
1 pull request opened.
-
editorial clarity, add null origin treatment w3c/webappsec-cors-for-developers#5, by @hillbrad.
-
-
1 pull request merged.
-
editorial clarity, add null origin treatment w3c/webappsec-cors-for-developers#5.
-
w3c/webappsec
-
2 issues opened.
-
Clarify CSP header recommendations for non-HTML pages w3c/webappsec#520, by @kravietz.
-
CSP in single-page applications w3c/webappsec#519, by @MaceWindu.
-
-
1 issue received 1 new comment.
TR publications
-
7 documents published.
-
Secure Contexts published as a Candidate Recommendation Snapshot. History of Secure Contexts
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Content Security Policy: Embedded Enforcement published as a Working Draft. History of Content Security Policy: Embedded Enforcement
-
Content Security Policy Pinning published as a Note. History of Content Security Policy Pinning
-
Entry Point Regulation published as a Note. History of Entry Point Regulation
-
GitHub
w3c/webappsec-csp
-
7 issues opened.
-
Nonces for Embedding-CSP w3c/webappsec-csp#121, by @dhausknecht.
-
Chrome throws a SecurityError while Firefox does not w3c/webappsec-csp#120, by @teddink.
-
Allow "inline" violation reports to contain the text of offending scripts w3c/webappsec-csp#119, by @arturjanc.
-
worth allowing embedded frame to declare origins it will accept any policy from? w3c/webappsec-csp#118, by @hillbrad.
-
do we want a directive to control postMessage explicit channels outbound? w3c/webappsec-csp#117, by @hillbrad.
-
Allow nonce-source to be used in more directives. w3c/webappsec-csp#116, by @ScottHelme.
-
Embedding-CSP header w3c/webappsec-csp#115, by @annevk.
-
-
7 issues closed.
-
Allow "*" to match scheme of protected resource w3c/webappsec-csp#104.
-
worth allowing embedded frame to declare origins it will accept any policy from? w3c/webappsec-csp#118.
-
CSP: Provide source of violation in SecurityPolicyViolationEvents w3c/webappsec-csp#14.
-
Add "disposition" attribute to SecurityPolicyViolationEvent w3c/webappsec-csp#94.
-
Clarify the target for `SecurityPolicyViolationEvent` w3c/webappsec-csp#90.
-
path-part should be represented by path-abempty w3c/webappsec-csp#89.
-
Specify behavior of preload requests w3c/webappsec-csp#108.
-
-
1 issue reopened.
-
Allow "*" to match scheme of protected resource w3c/webappsec-csp#104, by @mikewest.
-
-
22 issues received 80 new comments.
-
Allow nonce-source to be used in more directives. w3c/webappsec-csp#116 (11 comments by @mikewest, @ptoomey3, @ScottHelme, @shekyan)
-
Add a flag to strip potentially sensitive data from reports w3c/webappsec-csp#111 (7 comments by @estark37, @mikewest, @ScottHelme)
-
Allow "*" to match scheme of protected resource w3c/webappsec-csp#104 (6 comments by @dbates-wk, @mikewest, @shekyan)
-
worth allowing embedded frame to declare origins it will accept any policy from? w3c/webappsec-csp#118 (6 comments by @annevk, @mikewest)
-
Allow dynamically enabling/disabling nonce as a source w3c/webappsec-csp#88 (6 comments by @devd, @mikewest)
-
Allow `hash-source` expressions match integrity metadata for external scripts. w3c/webappsec-csp#78 (5 comments by @fmarier, @oreoshake)
-
Chrome throws a SecurityError while Firefox does not w3c/webappsec-csp#120 (4 comments by @annevk, @michaelficarra, @mikewest, @teddink)
-
Allow "inline" violation reports to contain the text of offending scripts w3c/webappsec-csp#119 (4 comments by @arturjanc, @mikewest)
-
Specify behavior of prefetch requests w3c/webappsec-csp#107 (3 comments by @igrigorik, @mikewest, @ScottHelme)
-
CSP Violation Reports for redirects should include full original URI and origins in the redirect URIs w3c/webappsec-csp#86 (3 comments by @devd, @mikewest)
-
Add a new directive governing the use of http-equiv in <meta> tags w3c/webappsec-csp#112 (3 comments by @aidantwoods, @mikewest)
-
Consider providing a way to tighten source-expressions that contain `self` w3c/webappsec-csp#91 (2 comments by @mikewest)
-
Prevent nonce stealing by looking for "<script" in attributes of nonced scripts w3c/webappsec-csp#98 (2 comments by @mikewest)
-
"Whitelisting external JavaScript with hashes" incorrectly assumes encoding of sources w3c/webappsec-csp#110 (1 comment by @mikewest)
-
CSP: Provide source of violation in SecurityPolicyViolationEvents w3c/webappsec-csp#14 (1 comment by @mikewest)
-
Add "disposition" attribute to SecurityPolicyViolationEvent w3c/webappsec-csp#94 (1 comment by @mikewest)
-
-
2 pull requests opened.
-
generate note versions of obsolete specs w3c/webappsec-csp#114, by @hillbrad.
-
Editorial: Update spelling of HTML terms to en-US w3c/webappsec-csp#113, by @zcorpan.
-
-
3 pull requests merged.
-
Added "policyDisposition" property on SecurityPolicyViolationEvent w3c/webappsec-csp#95.
-
generate note versions of obsolete specs w3c/webappsec-csp#114.
-
Editorial: Update spelling of HTML terms to en-US w3c/webappsec-csp#113.
-
-
2 pull requests received 11 new comments.
-
Added "policyDisposition" property on SecurityPolicyViolationEvent w3c/webappsec-csp#95 (7 comments by @mikewest, @shekyan)
-
Editorial: Update spelling of HTML terms to en-US w3c/webappsec-csp#113 (4 comments by @mikewest, @zcorpan)
-
w3c/webappsec-suborigins
-
3 issues opened.
-
Suborigin names should not be allowed to start with number w3c/webappsec-suborigins#47, by @joelweinberger.
-
What to do with WebSockets w3c/webappsec-suborigins#44, by @joelweinberger.
-
Suborigin cookies should not be treated as third-party w3c/webappsec-suborigins#43, by @devd.
-
-
2 issues closed.
-
Unsafe Opt-outs for postMessage w3c/webappsec-suborigins#24.
-
Underscore should not be used for serialization. w3c/webappsec-suborigins#38.
-
-
6 issues received 19 new comments.
-
Underscore should not be used for serialization. w3c/webappsec-suborigins#38 (7 comments by @annevk, @joelweinberger, @mikewest, @naskooskov)
-
What to do with WebSockets w3c/webappsec-suborigins#44 (6 comments by @annevk, @devd, @joelweinberger, @kentonv)
-
Suborigin names should not be allowed to start with number w3c/webappsec-suborigins#47 (3 comments by @annevk, @devd, @ghost)
-
Behavior of Host prefix in the presence of unsafe-cookies option w3c/webappsec-suborigins#28 (1 comment by @joelweinberger)
-
Suborigin cookies should not be treated as third-party w3c/webappsec-suborigins#43 (1 comment by @joelweinberger)
-
-
3 pull requests opened.
-
Add issues for v1 TODOs w3c/webappsec-suborigins#48, by @joelweinberger.
-
Disable WebSockets w3c/webappsec-suborigins#46, by @joelweinberger.
-
Change serialization to scheme and host version w3c/webappsec-suborigins#45, by @joelweinberger.
-
-
3 pull requests merged.
-
Add issues for v1 TODOs w3c/webappsec-suborigins#48.
-
Disable WebSockets w3c/webappsec-suborigins#46.
-
Change serialization to scheme and host version w3c/webappsec-suborigins#45.
-
-
2 pull requests received 2 new comments.
w3c/webappsec-credential-management
-
1 issue opened.
-
Unclear how to distinguish between: no credentials versus user dismisses login window (clicks X) w3c/webappsec-credential-management#23, by @seansan.
-
-
1 pull request opened.
-
Clarify the autocomplete attribute behavior. w3c/webappsec-credential-management#22, by @mikewest.
-
-
1 pull request received 1 new comment.
-
Clarify the autocomplete attribute behavior. w3c/webappsec-credential-management#22 (1 comment by @vabr-g)
-
w3c/webappsec-referrer-policy
-
2 issues opened.
-
redact location.ancestorOrigins according to Referrer Policy w3c/webappsec-referrer-policy#71, by @hillbrad.
-
`ping-from`? w3c/webappsec-referrer-policy#70, by @mikewest.
-
-
2 issues closed.
-
`Referrer-Policy` header syntax is incompatible with JSON. w3c/webappsec-referrer-policy#65.
-
Add the non-downgrading versions of origin and origin-when-cross-origin w3c/webappsec-referrer-policy#50.
-
-
6 issues received 25 new comments.
-
Define how CSS interacts with spec for the sake of defining how referrers should be handled w3c/webappsec-referrer-policy#5 (15 comments by @annevk, @bzbarsky, @domenic, @jeisinger)
-
redact location.ancestorOrigins according to Referrer Policy w3c/webappsec-referrer-policy#71 (2 comments by @bzbarsky)
-
`Referrer-Policy` header syntax is incompatible with JSON. w3c/webappsec-referrer-policy#65 (2 comments by @jeisinger)
-
Add the non-downgrading versions of origin and origin-when-cross-origin w3c/webappsec-referrer-policy#50 (1 comment by @fmarier)
-
-
3 pull requests opened.
-
redact ancestorOrigins according to referrer policy w3c/webappsec-referrer-policy#72, by @hillbrad.
-
Fix travis ci config (#61) w3c/webappsec-referrer-policy#69, by @jeisinger.
-
Add a section about CSS and referrers (#5) w3c/webappsec-referrer-policy#68, by @jeisinger.
-
-
2 pull requests closed.
-
redact ancestorOrigins according to referrer policy w3c/webappsec-referrer-policy#72.
-
Fix travis ci config (#61) w3c/webappsec-referrer-policy#69.
-
-
3 pull requests received 27 new comments.
-
Add a section about CSS and referrers (#5) w3c/webappsec-referrer-policy#68 (23 comments by @annevk, @domenic, @estark37, @jeisinger)
-
redact ancestorOrigins according to referrer policy w3c/webappsec-referrer-policy#72 (2 comments by @domenic, @hillbrad)
-
w3c/webcrypto
-
9 issues opened.
-
Replace old svn Editor's Draft with link to new one w3c/webcrypto#151, by @mwatson2.
-
GlobalCrypto IDL is not valid w3c/webcrypto#150, by @mwatson2.
-
Algorithm descriptions should be informative w3c/webcrypto#147, by @mwatson2.
-
Two minor issues with ECDH and ECDSA SPKI import w3c/webcrypto#146, by @mwatson2.
-
Add link the Security Guidance from CFRG w3c/webcrypto#145, by @hhalpin.
-
Return type for deriveBits, importKey, unwrapKey is fixed, but not in IDL w3c/webcrypto#144, by @mwatson2.
-
Section 20.8 has incorrect OID value w3c/webcrypto#143, by @jimsch.
-
Update reference for ECDSA to SEC-1 or appropriate RFC w3c/webcrypto#139, by @mwatson2.
-
JWK import for RSA algorithms do not consider "ext" parameter w3c/webcrypto#133, by @mwatson2.
-
-
17 issues closed.
-
Algorithm descriptions should be informative w3c/webcrypto#147.
-
Please require a secure origin (Bug 25972) w3c/webcrypto#28.
-
Raw format for EC keys in "raw" is under-specified (both import and export) w3c/webcrypto#129.
-
Text for "get key length" is missing algorithm normalization w3c/webcrypto#127.
-
JWK import for RSA algorithms do not consider "ext" parameter w3c/webcrypto#133.
-
Remove step (9) of deriveKey() w3c/webcrypto#126.
-
Remove step (8) of wrapKey() w3c/webcrypto#125.
-
Bug 27471 - Provide even more informative text over key wrapping? w3c/webcrypto#40.
-
Section 20.8 has incorrect OID value w3c/webcrypto#143.
-
EC key raw import has incorrect steps w3c/webcrypto#130.
-
Bug 27465 - Update references from X9.63 to SECG w3c/webcrypto#39.
-
Bug 27473 - Explicit salts for the algorithm formerly known as HKDF w3c/webcrypto#42.
-
Update acknowledgments w3c/webcrypto#106.
-
Update reference for ECDSA to SEC-1 or appropriate RFC w3c/webcrypto#139.
-
Consistency: "performing the XXX operation" vs "executing the XXX operation" w3c/webcrypto#128.
-
Change order when BufferSources are read in verify() w3c/webcrypto#124.
-
-
18 issues received 35 new comments.
-
Bug 29514 - Need to define which globals objects created by this spec are associated with w3c/webcrypto#85 (5 comments by @bzbarsky, @mwatson2)
-
Bug 27473 - Explicit salts for the algorithm formerly known as HKDF w3c/webcrypto#42 (4 comments by @engelke, @jimsch, @mwatson2)
-
Raw format for EC keys in "raw" is under-specified (both import and export) w3c/webcrypto#129 (3 comments by @mwatson2)
-
Return type for deriveBits, importKey, unwrapKey is fixed, but not in IDL w3c/webcrypto#144 (2 comments by @mwatson2)
-
Bug 27471 - Provide even more informative text over key wrapping? w3c/webcrypto#40 (2 comments by @ghost, @mwatson2)
-
JWK import for RSA algorithms do not consider "ext" parameter w3c/webcrypto#133 (2 comments by @ghost, @mwatson2)
-
Text for "get key length" is missing algorithm normalization w3c/webcrypto#127 (2 comments by @ghost, @mwatson2)
-
Consistency: "performing the XXX operation" vs "executing the XXX operation" w3c/webcrypto#128 (1 comment by @mwatson2)
-
-
10 pull requests opened.
-
Fix #144: Include return types in IDL for methods with algorithm-inde… w3c/webcrypto#149, by @mwatson2.
-
Fix #146: Specify source of data for eliptic curve key import and fix… w3c/webcrypto#148, by @mwatson2.
-
Fix #106: Update acknowledgements w3c/webcrypto#142, by @mwatson2.
-
Fix #133: Check ext member of JWK on import for RSA algorithms w3c/webcrypto#141, by @mwatson2.
-
Fix #130: Correct usages check for ECDSA raw import and remove extrac… w3c/webcrypto#140, by @mwatson2.
-
Fix #128: s/executing/performing/ for algorithm operations w3c/webcrypto#138, by @mwatson2.
-
Fix #127: Algorithm normalization for get key length in deriveKey() w3c/webcrypto#137, by @mwatson2.
-
Fix #125, Fix #126: Remove redundant algorithm checks w3c/webcrypto#136, by @mwatson2.
-
Fix #85: Specify the global object associated with objects we create w3c/webcrypto#135, by @mwatson2.
-
Fix #40: Note that non-extractable JWKs can be unwrapped but not wrapped w3c/webcrypto#134, by @mwatson2.
-
-
14 pull requests merged.
-
Fix #147: Descriptions are all non-normative w3c/webcrypto#7.
-
Fix #28: Require a secure origin using [SecureContext] annotation w3c/webcrypto#131.
-
Fix #127: Algorithm normalization for get key length in deriveKey() w3c/webcrypto#137.
-
Fix #133: Check ext member of JWK on import for RSA algorithms w3c/webcrypto#141.
-
Fix #125, Fix #126: Remove redundant algorithm checks w3c/webcrypto#136.
-
Fix #40: Note that non-extractable JWKs can be unwrapped but not wrapped w3c/webcrypto#134.
-
Correct reference for SHA-2 w/ RSA algorithm w3c/webcrypto#13.
-
Fix #143: Correct OID for rsaEncryption in the document. w3c/webcrypto#14.
-
Fix #130: Correct usages check for ECDSA raw import and remove extrac… w3c/webcrypto#140.
-
Switch to RFC 6090 for reference w3c/webcrypto#10.
-
Fix #106: Update acknowledgements w3c/webcrypto#142.
-
Fix #128: s/executing/performing/ for algorithm operations w3c/webcrypto#138.
-
Fix #48: Make use cases internally consistent, and clean up language w3c/webcrypto#108.
-
Fix #124: Take copies of parameters before algorithm normalization w3c/webcrypto#132.
-
-
4 pull requests closed.
-
Address DER/BER encoding editorial note w3c/webcrypto#11.
-
Ghpages w3c/webcrypto#19.
-
Odds and ends w3c/webcrypto#17.
-
Fix #111: Specify hash algorithm for ECDSA at generate/import w3c/webcrypto#120.
-
-
6 pull requests received 13 new comments.
-
Fix #127: Algorithm normalization for get key length in deriveKey() w3c/webcrypto#137 (2 comments by @mwatson2)
-
Fix #130: Correct usages check for ECDSA raw import and remove extrac… w3c/webcrypto#140 (2 comments by @mwatson2)
-
Fix #146: Specify source of data for eliptic curve key import and fix… w3c/webcrypto#148 (1 comment by @jimsch)
w3c/webappsec-cors-for-developers
-
4 pull requests opened.
-
add resource advice w3c/webappsec-cors-for-developers#4, by @hillbrad.
-
Typo fix: develper -> developer w3c/webappsec-cors-for-developers#2, by @tyoshino.
-
initial spec checkin w3c/webappsec-cors-for-developers#1, by @hillbrad.
-
-
4 pull requests merged.
-
add resource advice w3c/webappsec-cors-for-developers#4.
-
typo fix w3c/webappsec-cors-for-developers#3.
-
Typo fix: develper -> developer w3c/webappsec-cors-for-developers#2.
-
initial spec checkin w3c/webappsec-cors-for-developers#1.
-
-
3 pull requests reopened.
-
add resource advice w3c/webappsec-cors-for-developers#4, by @hillbrad.
-
add resource advice w3c/webappsec-cors-for-developers#4, by @hillbrad.
-
add resource advice w3c/webappsec-cors-for-developers#4, by @hillbrad.
-
-
1 pull request received 1 new comment.
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Consider: isSecureContext should be [Unforgeable] w3c/webappsec-secure-contexts#46, by @DigiTec.
-
-
3 issues received 10 new comments.
-
Consider: isSecureContext should be [Unforgeable] w3c/webappsec-secure-contexts#46 (7 comments by @annevk, @DigiTec, @domenic, @mikewest)
-
Allow "localhost" as long as it actually resolves to a localhost address w3c/webappsec-secure-contexts#43 (2 comments by @jungkees, @mikewest)
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9 (1 comment by @equalsJeffH)
-
w3c/permissions
-
2 issues opened.
-
Incorrectly says "camera", "microphone" aren't allowed in non-secure contexts. w3c/permissions#128, by @jan-ivar.
-
Make sure spec reflects issues w3c/permissions#126, by @marcoscaceres.
-
-
3 issues closed.
-
Passing base dictionary wont work. w3c/permissions#59.
-
Incorrectly says "camera", "microphone" aren't allowed in non-secure contexts. w3c/permissions#128.
-
Use HTML's new "allowed to use" algorithm w3c/permissions#121.
-
-
1 issue reopened.
-
Move to using Echidna w3c/permissions#24, by @jyasskin.
-
-
4 issues received 25 new comments.
-
Drop .request() w3c/permissions#83 (17 comments by @alvestrand, @jan-ivar, @jimmywarting, @jyasskin, @marcoscaceres, @martinthomson)
-
Incorrectly says "camera", "microphone" aren't allowed in non-secure contexts. w3c/permissions#128 (1 comment by @jyasskin)
-
-
2 pull requests opened.
-
Allow UA option to call getUserMedia in non-secure origin w3c/permissions#129, by @jan-ivar.
-
fix(request): clarify how requests affect state w3c/permissions#127, by @jyasskin.
-
-
7 pull requests merged.
-
Pass objects instead of PermissionDescriptors to the Permissions interface. w3c/permissions#125.
-
Allow UA option to call getUserMedia in non-secure origin w3c/permissions#129.
-
refactor(media devices): use "allowed to use" w3c/permissions#122.
-
fix(request): clarify how requests affect state w3c/permissions#127.
-
refactor(permission state): pass the settings object explicitly w3c/permissions#114.
-
feat(state): delegate to features for constraints w3c/permissions#117.
-
feat(travis): autopublish with echidna (closes #24) w3c/permissions#99.
-
-
5 pull requests received 17 new comments.
-
refactor(media devices): use "allowed to use" w3c/permissions#122 (8 comments by @alvestrand, @annevk, @foolip, @jyasskin, @marcoscaceres, @raymeskhoury)
-
fix(request): clarify how requests affect state w3c/permissions#127 (4 comments by @jan-ivar, @jyasskin, @martinthomson, @stefhak)
-
refactor(permission state): pass the settings object explicitly w3c/permissions#114 (2 comments by @jyasskin, @stefhak)
-
feat(state): delegate to features for constraints w3c/permissions#117 (2 comments by @jyasskin, @marcoscaceres)
-
Pass objects instead of PermissionDescriptors to the Permissions interface. w3c/permissions#125 (1 comment by @tobie)
-
w3c/webappsec
-
1 issue received 1 new comment.
-
CREDENTIAL: Support generation of passwords from LocalCredential w3c/webappsec#250 (1 comment by @indolering)
-
-
1 pull request opened.
-
update implementation report w3c/webappsec#518, by @hillbrad.
-
-
1 pull request merged.
-
update implementation report w3c/webappsec#518.
-
-
2 pull requests reopened.
-
update implementation report w3c/webappsec#518, by @hillbrad.
-
update implementation report w3c/webappsec#518, by @hillbrad.
-
-
1 pull request received 1 new comment.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Define integration with CSS. w3c/webappsec-subresource-integrity#56, by @mikewest.
-
-
1 issue closed.
-
Define integration with CSS. w3c/webappsec-subresource-integrity#56.
-
-
2 issues received 4 new comments.
-
Checking the integrity of resources pulled in from within CSS stylesheets w3c/webappsec-subresource-integrity#40 (2 comments by @jonathanKingston, @mikewest)
-
Define integration with CSS. w3c/webappsec-subresource-integrity#56 (2 comments by @annevk, @mikewest)
-
-
1 pull request received 1 new comment.
-
attempt to write down `require-sri-for` directive as part of SRI w3c/webappsec-subresource-integrity#32 (1 comment by @mozfreddyb)
-
TR publications
-
3 documents published.
-
Mixed Content published as a Candidate Recommendation Snapshot. History of Mixed Content
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Participants
-
2 participants left.
-
Dan Kaminsky (HUMAN) left.
-
Kristijan Burnik (W3C Invited Experts) left.
-
-
1 organization joined.
-
HUMAN joined.
-
GitHub
w3c/webappsec-referrer-policy
-
2 issues opened.
-
`Referrer-Policy` header syntax is incompatible with JSON. w3c/webappsec-referrer-policy#65, by @mikewest.
-
Take over "referrer policy" concept and ReferrerPolicy enum from Fetch w3c/webappsec-referrer-policy#62, by @annevk.
-
-
7 issues closed.
-
Clarify that "Unknown Policy Values" applies to Document policies w3c/webappsec-referrer-policy#46.
-
What is the motivation for "legacy keywords" in the header? w3c/webappsec-referrer-policy#53.
-
Take over "referrer policy" concept and ReferrerPolicy enum from Fetch w3c/webappsec-referrer-policy#62.
-
Use of "active document" in determining the referrer looks wrong w3c/webappsec-referrer-policy#29.
-
Srcdoc referrer policies don't interact well with <meta referrer> w3c/webappsec-referrer-policy#31.
-
Define HTML integration for referrerpolicy attributes w3c/webappsec-referrer-policy#40.
-
HTML integration plan w3c/webappsec-referrer-policy#43.
-
-
6 issues received 22 new comments.
-
Take over "referrer policy" concept and ReferrerPolicy enum from Fetch w3c/webappsec-referrer-policy#62 (7 comments by @annevk, @domenic, @estark37, @mikewest)
-
`Referrer-Policy` header syntax is incompatible with JSON. w3c/webappsec-referrer-policy#65 (5 comments by @annevk, @dveditz, @estark37, @mikewest)
-
What is the motivation for "legacy keywords" in the header? w3c/webappsec-referrer-policy#53 (5 comments by @annevk, @domenic, @estark37)
-
Srcdoc referrer policies don't interact well with <meta referrer> w3c/webappsec-referrer-policy#31 (1 comment by @estark37)
-
-
4 pull requests opened.
-
Remove "Determine policy for token" w3c/webappsec-referrer-policy#67, by @estark37.
-
Use referrer policy definition in parsing Referrer-Policy headers w3c/webappsec-referrer-policy#66, by @estark37.
-
Copy referrer policy concept and enum from Fetch w3c/webappsec-referrer-policy#64, by @estark37.
-
Fix use of "active document" in determining referrer w3c/webappsec-referrer-policy#63, by @estark37.
-
-
4 pull requests merged.
-
Remove "Determine policy for token" w3c/webappsec-referrer-policy#67.
-
Use referrer policy definition in parsing Referrer-Policy headers w3c/webappsec-referrer-policy#66.
-
Copy referrer policy concept and enum from Fetch w3c/webappsec-referrer-policy#64.
-
Fix use of "active document" in determining referrer w3c/webappsec-referrer-policy#63.
-
-
4 pull requests received 40 new comments.
-
Copy referrer policy concept and enum from Fetch w3c/webappsec-referrer-policy#64 (22 comments by @annevk, @domenic, @estark37, @mikewest)
-
Use referrer policy definition in parsing Referrer-Policy headers w3c/webappsec-referrer-policy#66 (10 comments by @domenic, @estark37)
-
Fix use of "active document" in determining referrer w3c/webappsec-referrer-policy#63 (5 comments by @domenic, @estark37)
-
Remove "Determine policy for token" w3c/webappsec-referrer-policy#67 (3 comments by @domenic, @estark37)
-
w3c/webappsec-csp
-
7 issues opened.
-
Add a new directive governing the use of http-equiv in <meta> tags w3c/webappsec-csp#112, by @aidantwoods.
-
Add a flag to strip potentially sensitive data from reports w3c/webappsec-csp#111, by @ScottHelme.
-
"Whitelisting external JavaScript with hashes" incorrectly assumes encoding of sources w3c/webappsec-csp#110, by @joelweinberger.
-
Hash encodings should be converted to UTF-8 w3c/webappsec-csp#109, by @joelweinberger.
-
Specify behavior of preload requests w3c/webappsec-csp#108, by @shekyan.
-
Specify behavior of prefetch requests w3c/webappsec-csp#107, by @dveditz.
-
Allow "*" to match scheme of protected resource w3c/webappsec-csp#104, by @dbates-wk.
-
-
1 issue closed.
-
Consider enforcing default-src if not explicit w3c/webappsec-csp#35.
-
-
10 issues received 74 new comments.
-
Add a flag to strip potentially sensitive data from reports w3c/webappsec-csp#111 (21 comments by @annevk, @estark37, @jacobbednarz, @jonathanKingston, @nico3333fr, @ScottHelme, @shekyan)
-
Prevent nonce stealing by looking for "<script" in attributes of nonced scripts w3c/webappsec-csp#98 (17 comments by @annevk, @arturjanc, @filedescriptor, @intchloe, @michaelficarra, @mikewest, @shekyan)
-
Allow "*" to match scheme of protected resource w3c/webappsec-csp#104 (17 comments by @dbates-wk, @intchloe, @mikewest, @shekyan)
-
Specify behavior of prefetch requests w3c/webappsec-csp#107 (8 comments by @annevk, @april, @dveditz, @igrigorik, @shekyan)
-
Consider enforcing default-src if not explicit w3c/webappsec-csp#35 (2 comments by @dveditz, @mikewest)
-
Hash encodings should be converted to UTF-8 w3c/webappsec-csp#109 (2 comments by @annevk, @joelweinberger)
-
-
2 pull requests opened.
-
Fix 'unsafe-hash-attributes' example w3c/webappsec-csp#106, by @shekyan.
-
Allow "*" to match scheme of protected resource w3c/webappsec-csp#105, by @shekyan.
-
-
3 pull requests merged.
-
Fix 'unsafe-hash-attributes' example w3c/webappsec-csp#106.
-
Allow "*" to match scheme of protected resource w3c/webappsec-csp#105.
-
Transition Cookie Controls and Pinning to NOTE status w3c/webappsec-csp#103.
-
-
3 pull requests received 23 new comments.
-
Allow "*" to match scheme of protected resource w3c/webappsec-csp#105 (16 comments by @dbates-wk, @mikewest, @shekyan)
-
Transition Cookie Controls and Pinning to NOTE status w3c/webappsec-csp#103 (4 comments by @mikewest, @tabatkins)
-
w3c/webappsec-permissions-policy
-
5 issues opened.
-
What is the purpose of being able to specify the target? w3c/webappsec-permissions-policy#37, by @sebastiannielsen.
-
sync-xhr, async attribute "false" w3c/webappsec-permissions-policy#36, by @craigfrancis.
-
Understand relationship of OriginPolicy with FeaturePolicy/ContentSecurityPolicy w3c/webappsec-permissions-policy#35, by @ojanvafai.
-
Add information about scope of policy to the Introduction w3c/webappsec-permissions-policy#32, by @alvestrand.
-
Mailing list information needs updating w3c/webappsec-permissions-policy#31, by @alvestrand.
-
-
18 issues closed.
-
Don't forbid document.domain getter w3c/webappsec-permissions-policy#23.
-
Provide lots of use case examples, explain design decision, etc., in introduction w3c/webappsec-permissions-policy#29.
-
Clearly define how the policies of embedded documents combine/interact w3c/webappsec-permissions-policy#28.
-
What is the purpose of being able to specify the target? w3c/webappsec-permissions-policy#37.
-
sync-xhr, async attribute "false" w3c/webappsec-permissions-policy#36.
-
Spec "disable: MIDI" enforcement w3c/webappsec-permissions-policy#2.
-
Spec "disable: push" enforcement w3c/webappsec-permissions-policy#4.
-
Spec "enable/disable: web-payments" policy w3c/webappsec-permissions-policy#18.
-
Spec "disable: notifications" enforcement w3c/webappsec-permissions-policy#3.
-
Spec "disable: webrtc" enforcement w3c/webappsec-permissions-policy#5.
-
Mailing list information needs updating w3c/webappsec-permissions-policy#31.
-
3.2.1 is not a valid example - conflicting with SameSite w3c/webappsec-permissions-policy#30.
-
Defaults aren't clear to me w3c/webappsec-permissions-policy#26.
-
target: "self" doesn't help defend against XSS. w3c/webappsec-permissions-policy#12.
-
Spec "disable: geolocation" enforcement w3c/webappsec-permissions-policy#1.
-
Mechanisms to "disable" a feature w3c/webappsec-permissions-policy#10.
-
Feature Policy ~v1 w3c/webappsec-permissions-policy#17.
-
Should we support `<meta http-equiv>` mechanism to set the policy? w3c/webappsec-permissions-policy#15.
-
-
23 issues received 65 new comments.
-
Disable Set-Cookie also + other storage w3c/webappsec-permissions-policy#16 (10 comments by @clelland, @igrigorik, @michael-oneill, @mikewest, @ojanvafai)
-
Support for enable/disable attribute on iframes w3c/webappsec-permissions-policy#11 (9 comments by @clelland, @igrigorik, @marcoscaceres, @stefhak)
-
Clearly define how the policies of embedded documents combine/interact w3c/webappsec-permissions-policy#28 (8 comments by @clelland, @igrigorik, @raymeskhoury)
-
Spec "disable: webrtc" enforcement w3c/webappsec-permissions-policy#5 (6 comments by @alvestrand, @foolip, @igrigorik)
-
Provide lots of use case examples, explain design decision, etc., in introduction w3c/webappsec-permissions-policy#29 (5 comments by @igrigorik, @intchloe, @slightlyoff)
-
Mailing list information needs updating w3c/webappsec-permissions-policy#31 (4 comments by @igrigorik, @marcoscaceres)
-
What is the purpose of being able to specify the target? w3c/webappsec-permissions-policy#37 (3 comments by @igrigorik, @sebastiannielsen)
-
Relationship with permissions spec w3c/webappsec-permissions-policy#27 (3 comments by @alvestrand, @foolip, @igrigorik)
-
sync-xhr, async attribute "false" w3c/webappsec-permissions-policy#36 (2 comments by @clelland, @igrigorik)
-
Send feature policy in sub-resource request headers w3c/webappsec-permissions-policy#20 (2 comments by @igrigorik)
-
Add information about scope of policy to the Introduction w3c/webappsec-permissions-policy#32 (1 comment by @igrigorik)
-
Spec "enable/disable: web-payments" policy w3c/webappsec-permissions-policy#18 (1 comment by @igrigorik)
-
Spec "disable: notifications" enforcement w3c/webappsec-permissions-policy#3 (1 comment by @igrigorik)
-
Understand relationship of OriginPolicy with FeaturePolicy/ContentSecurityPolicy w3c/webappsec-permissions-policy#35 (1 comment by @igrigorik)
-
3.2.1 is not a valid example - conflicting with SameSite w3c/webappsec-permissions-policy#30 (1 comment by @igrigorik)
-
target: "self" doesn't help defend against XSS. w3c/webappsec-permissions-policy#12 (1 comment by @igrigorik)
-
Spec "disable: geolocation" enforcement w3c/webappsec-permissions-policy#1 (1 comment by @igrigorik)
-
-
2 pull requests opened.
-
Use CG-Draft status (closes #31) w3c/webappsec-permissions-policy#34, by @marcoscaceres.
-
[WIP] Use IDL to control if feature is exposed w3c/webappsec-permissions-policy#33, by @igrigorik.
-
-
2 pull requests merged.
-
[WIP] Use IDL to control if feature is exposed w3c/webappsec-permissions-policy#33.
-
Use CG-Draft status (closes #31) w3c/webappsec-permissions-policy#34.
-
-
2 pull requests received 7 new comments.
-
[WIP] Use IDL to control if feature is exposed w3c/webappsec-permissions-policy#33 (6 comments by @clelland, @foolip, @igrigorik, @stefhak)
-
w3c/permissions
-
3 issues opened.
-
query() / events and system permission state w3c/permissions#124, by @ShijunS.
-
deploy.sh doesn't fail for patches with bikeshed errors w3c/permissions#123, by @jyasskin.
-
Use HTML's new "allowed to use" algorithm w3c/permissions#121, by @foolip.
-
-
1 issue closed.
-
Move the Permissions registry w3c/permissions#103.
-
-
2 issues reopened.
-
Allow query with a DOMString value w3c/permissions#42, by @jyasskin.
-
Consider removing Permissions.revoke(). w3c/permissions#46, by @marcoscaceres.
-
-
6 issues received 72 new comments.
-
Drop .request() w3c/permissions#83 (26 comments by @alvestrand, @annevk, @jan-ivar, @jyasskin, @ShijunS, @slightlyoff)
-
Consider removing Permissions.revoke(). w3c/permissions#46 (18 comments by @annevk, @jan-ivar, @jyasskin, @marcoscaceres, @martinthomson, @npdoty, @ShijunS)
-
Allow query with a DOMString value w3c/permissions#42 (16 comments by @alvestrand, @annevk, @jan-ivar, @jyasskin, @marcoscaceres)
-
query() / events and system permission state w3c/permissions#124 (5 comments by @jan-ivar, @jyasskin, @ShijunS)
-
-
6 pull requests opened.
-
Pass objects instead of PermissionDescriptors to the Permissions interface. w3c/permissions#125, by @jyasskin.
-
refactor(media devices): use "allowed to use" w3c/permissions#122, by @jyasskin.
-
Resolve TODOs on media type permissions w3c/permissions#120, by @alvestrand.
-
Resolve "issue-media-granted" w3c/permissions#119, by @alvestrand.
-
refactor: move permissions registry (closes #103) w3c/permissions#118, by @marcoscaceres.
-
feat(state): delegate to features for constraints w3c/permissions#117, by @jyasskin.
-
-
4 pull requests merged.
-
Resolve TODOs on media type permissions w3c/permissions#120.
-
Resolve "issue-media-granted" w3c/permissions#119.
-
refactor: move permissions registry (closes #103) w3c/permissions#118.
-
feat(algorithms): allow calling with a PermissionName w3c/permissions#115.
-
-
6 pull requests received 22 new comments.
-
feat(algorithms): allow calling with a PermissionName w3c/permissions#115 (4 comments by @annevk, @jyasskin, @marcoscaceres)
-
feat(prompts): allow UAs to deny non-gesture prompts w3c/permissions#107 (3 comments by @annevk, @jyasskin)
w3c/webappsec-subresource-integrity
-
3 issues closed.
-
Bug: examples 5 and 6 have the wrong sha384 value; should match example 4 w3c/webappsec-subresource-integrity#52.
-
Ensure that bad bikeshed markup is still picked up by Travis w3c/webappsec-subresource-integrity#46.
-
Convert to Bikeshed w3c/webappsec-subresource-integrity#12.
-
-
2 issues received 2 new comments.
-
3 pull requests opened.
-
errors in bikeshed should fail loudly (fixes #46) w3c/webappsec-subresource-integrity#55, by @mozfreddyb.
-
Change hash value in Example 5 & 6 (fixes #52) w3c/webappsec-subresource-integrity#54, by @mozfreddyb.
-
Fix compile w3c/webappsec-subresource-integrity#53, by @joelweinberger.
-
-
3 pull requests merged.
-
Change hash value in Example 5 & 6 (fixes #52) w3c/webappsec-subresource-integrity#54.
-
errors in bikeshed should fail loudly (fixes #46) w3c/webappsec-subresource-integrity#55.
-
Fix compile w3c/webappsec-subresource-integrity#53.
-
-
1 pull request closed.
-
Example of adding integrity attributes in JavaScript w3c/webappsec-subresource-integrity#25.
-
-
3 pull requests received 4 new comments.
-
errors in bikeshed should fail loudly (fixes #46) w3c/webappsec-subresource-integrity#55 (2 comments by @mozfreddyb)
-
Example of adding integrity attributes in JavaScript w3c/webappsec-subresource-integrity#25 (1 comment by @mozfreddyb)
-
Change hash value in Example 5 & 6 (fixes #52) w3c/webappsec-subresource-integrity#54 (1 comment by @mozfreddyb)
-
w3c/webappsec-suborigins
-
1 issue opened.
-
Create a reserved prefix or delimiter for serialization of typed suborigins w3c/webappsec-suborigins#40, by @hillbrad.
-
-
3 issues received 18 new comments.
-
Underscore should not be used for serialization. w3c/webappsec-suborigins#38 (16 comments by @annevk, @arturjanc, @joelweinberger, @mikewest, @sleevi)
-
Create a reserved prefix or delimiter for serialization of typed suborigins w3c/webappsec-suborigins#40 (1 comment by @devd)
-
-
2 pull requests opened.
-
Change serialization to use $suborigin$host format w3c/webappsec-suborigins#42, by @joelweinberger.
-
Fix compilation w3c/webappsec-suborigins#41, by @joelweinberger.
-
-
2 pull requests merged.
-
Change serialization to use $suborigin$host format w3c/webappsec-suborigins#42.
-
Fix compilation w3c/webappsec-suborigins#41.
-
-
2 pull requests received 3 new comments.
-
Change serialization to use $suborigin$host format w3c/webappsec-suborigins#42 (2 comments by @devd, @joelweinberger)
-
w3c/webappsec-secure-contexts
-
3 issues opened.
-
Section "Is origin potentially trustworthy?", step 8 of algorithm returns "Not Trusted" w3c/webappsec-secure-contexts#45, by @dbates-wk.
-
Section "Is origin potentially trustworthy?", second paragraph, second sentence does not read well w3c/webappsec-secure-contexts#44, by @dbates-wk.
-
Allow "localhost" as long as it actually resolves to a localhost address w3c/webappsec-secure-contexts#43, by @enygren.
-
-
2 issues closed.
-
Section "Is origin potentially trustworthy?", second paragraph, second sentence does not read well w3c/webappsec-secure-contexts#44.
-
Section "Is origin potentially trustworthy?", step 8 of algorithm returns "Not Trusted" w3c/webappsec-secure-contexts#45.
-
-
1 issue reopened.
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42, by @mikewest.
-
-
5 issues received 11 new comments.
-
Allow "localhost" as long as it actually resolves to a localhost address w3c/webappsec-secure-contexts#43 (5 comments by @mikewest, @sleevi)
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42 (3 comments by @jakearchibald, @mikewest)
-
Section "Is origin potentially trustworthy?", second paragraph, second sentence does not read well w3c/webappsec-secure-contexts#44 (1 comment by @mikewest)
-
Section "Is origin potentially trustworthy?", step 8 of algorithm returns "Not Trusted" w3c/webappsec-secure-contexts#45 (1 comment by @mikewest)
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9 (1 comment by @mikewest)
-
w3c/webcrypto
-
8 issues closed.
-
ECDSA import does not specify the hash algorithm w3c/webcrypto#111.
-
Introduce HKDF as an algorithm based on RFC 5869 w3c/webcrypto#27.
-
HMAC Sign and Verify algorithms do not support trucated HMACs w3c/webcrypto#110.
-
Bug 27814 - Section A.2 - the usage mapping of "enc" is incorrect w3c/webcrypto#77.
-
Several algorithms unnecessarily check that a provided hash is supported w3c/webcrypto#119.
-
-
8 issues received 21 new comments.
-
ECDSA import does not specify the hash algorithm w3c/webcrypto#111 (6 comments by @ghost, @jimsch, @mwatson2)
-
Please require a secure origin (Bug 25972) w3c/webcrypto#28 (4 comments by @ghost, @mwatson2, @vijaybh)
-
HMAC Sign and Verify algorithms do not support trucated HMACs w3c/webcrypto#110 (3 comments by @ghost, @jimsch, @mwatson2)
-
Change order when BufferSources are read in verify() w3c/webcrypto#124 (3 comments by @ghost, @mwatson2)
-
Bug 27814 - Section A.2 - the usage mapping of "enc" is incorrect w3c/webcrypto#77 (1 comment by @ghost)
-
Bug 27255 - Inconsistent handling of SPKI / PKCS#8 data between implementations w3c/webcrypto#26 (1 comment by @vgalindo)
-
-
2 pull requests opened.
-
Fix #124: Take copies of parameters before algorithm normalization w3c/webcrypto#132, by @mwatson2.
-
Fix #28: Require a secure origin using [SecureContext] annotation w3c/webcrypto#131, by @mwatson2.
-
-
4 pull requests merged.
-
Changes to switch from NIST to IETF version of HKDF w3c/webcrypto#16.
-
Fix #77: Allow JWK use to be enc for ECDH import w3c/webcrypto#114.
-
Fix #87: Require JSON.parse to be executed in a clean global w3c/webcrypto#115.
-
Fix #119: Remove redundant checks that hash algorithm is supported w3c/webcrypto#123.
-
-
2 pull requests closed.
-
Fix #110: Supported truncated MACs in HMAC verify w3c/webcrypto#118.
-
Fix #28: Require a secure context w3c/webcrypto#122.
-
-
2 pull requests received 5 new comments.
-
Changes to switch from NIST to IETF version of HKDF w3c/webcrypto#16 (4 comments by @ghost, @jimsch, @mwatson2)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
What's the scope of mixed content tainting? w3c/webappsec-mixed-content#7, by @jakearchibald.
-
-
1 issue closed.
-
Republish CR. w3c/webappsec-mixed-content#6.
-
-
2 issues received 5 new comments.
-
What's the scope of mixed content tainting? w3c/webappsec-mixed-content#7 (3 comments by @annevk, @delapuente, @jakearchibald)
-
w3c/webappsec
-
1 issue received 2 new comments.
-
Way to disown window.opener and become a secure context w3c/webappsec#517 (2 comments by @yoavweiss)
-
TR publications
-
4 documents published.
-
Clear Site Data published as a Working Draft. History of Clear Site Data
-
Secure Contexts published 3 times as a Working Draft. History of Secure Contexts
-
Participants
-
1 organization joined.
-
China Academy of Information and Communications Technology (CAICT) joined.
-
GitHub
w3c/webappsec-csp
-
3 issues opened.
-
Permit blocking of certain hosts w3c/webappsec-csp#100, by @yoavweiss.
-
Sandboxing and fullscreen w3c/webappsec-csp#99, by @annevk.
-
Prevent nonce stealing by looking for "<script" in attributes of nonced scripts w3c/webappsec-csp#98, by @arturjanc.
-
-
1 issue closed.
-
Sandboxing and fullscreen w3c/webappsec-csp#99.
-
-
3 issues received 13 new comments.
-
Permit blocking of certain hosts w3c/webappsec-csp#100 (6 comments by @dveditz, @hillbrad, @mikewest, @yoavweiss)
-
Instruct user agents to report invalid policies w3c/webappsec-csp#96 (5 comments by @dveditz, @hillbrad, @neilstuartcraig)
-
-
3 pull requests opened.
-
Transition Cookie Controls and Pinning to NOTE status w3c/webappsec-csp#103, by @hillbrad.
-
Update index.src.html: fix typo w3c/webappsec-csp#102, by @extg.
-
Add frame-src, worker-src to default-src examples w3c/webappsec-csp#101, by @aviat.
-
-
1 pull request merged.
-
Add frame-src, worker-src to default-src examples w3c/webappsec-csp#101.
-
-
1 pull request reopened.
-
Transition Cookie Controls and Pinning to NOTE status w3c/webappsec-csp#103, by @hillbrad.
-
-
2 pull requests received 5 new comments.
-
Add frame-src, worker-src to default-src examples w3c/webappsec-csp#101 (4 comments by @aviat, @mikewest, @wseltzer)
-
w3c/webappsec-secure-contexts
-
12 issues opened.
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42, by @jakearchibald.
-
opener browsing context is not checked in normative text w3c/webappsec-secure-contexts#41, by @domenic.
-
Examples shouldn't rely on red/green. w3c/webappsec-secure-contexts#40, by @mikewest.
-
Transition to CR. w3c/webappsec-secure-contexts#39, by @mikewest.
-
"creator `Document`" doesn't exist anymore. w3c/webappsec-secure-contexts#37, by @mikewest.
-
isSecureContext definition seems wrong in multi-global situations w3c/webappsec-secure-contexts#36, by @domenic.
-
Missing ""s when referring to results of "Is origin potentially trustworthy? w3c/webappsec-secure-contexts#35, by @domenic.
-
Missing " in "Is origin potentially trustworthy?" w3c/webappsec-secure-contexts#34, by @domenic.
-
Broken links and wrong definitions used w3c/webappsec-secure-contexts#33, by @domenic.
-
rendering bug: <a>s around [SecureContext] w3c/webappsec-secure-contexts#32, by @domenic.
-
Upstream shared worker modifications to HTML w3c/webappsec-secure-contexts#31, by @domenic.
-
Use WindowOrWorkerGlobalScope instead of separate Window and Worker partial interfaces w3c/webappsec-secure-contexts#30, by @domenic.
-
-
16 issues closed.
-
Examples shouldn't rely on red/green. w3c/webappsec-secure-contexts#40.
-
opener browsing context is not checked in normative text w3c/webappsec-secure-contexts#41.
-
For sandboxed content, allow UAs to use the origin that would have been used if not sandboxed w3c/webappsec-secure-contexts#27.
-
Broken links and wrong definitions used w3c/webappsec-secure-contexts#33.
-
Request to participate w3c/webappsec-secure-contexts#29.
-
"creator `Document`" doesn't exist anymore. w3c/webappsec-secure-contexts#37.
-
Upstream shared worker modifications to HTML w3c/webappsec-secure-contexts#31.
-
Specification does not justify its necessity for existence w3c/webappsec-secure-contexts#2.
-
Public Key Pinning with Overrides breaks the presumptions of Secure Contexts w3c/webappsec-secure-contexts#13.
-
SecureContext on attributes produces prototype mutations during realm creation w3c/webappsec-secure-contexts#23.
-
Use WindowOrWorkerGlobalScope instead of separate Window and Worker partial interfaces w3c/webappsec-secure-contexts#30.
-
Missing ""s when referring to results of "Is origin potentially trustworthy? w3c/webappsec-secure-contexts#35.
-
rendering bug: <a>s around [SecureContext] w3c/webappsec-secure-contexts#32.
-
Missing " in "Is origin potentially trustworthy?" w3c/webappsec-secure-contexts#34.
-
isSecureContext definition seems wrong in multi-global situations w3c/webappsec-secure-contexts#36.
-
Check that 'incumbent' is the right settings object. w3c/webappsec-secure-contexts#15.
-
-
19 issues received 48 new comments.
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42 (10 comments by @annevk, @jakearchibald, @mikewest, @travisleithead)
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26 (7 comments by @bzbarsky, @mikewest)
-
Consider whether sandboxed content should automatically be a secure context w3c/webappsec-secure-contexts#28 (7 comments by @bzbarsky, @johnwilander, @mikewest)
-
opener browsing context is not checked in normative text w3c/webappsec-secure-contexts#41 (2 comments by @domenic, @mikewest)
-
For sandboxed content, allow UAs to use the origin that would have been used if not sandboxed w3c/webappsec-secure-contexts#27 (2 comments by @mikewest)
-
Check that 'incumbent' is the right settings object. w3c/webappsec-secure-contexts#15 (2 comments by @domenic, @mikewest)
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9 (1 comment by @mikewest)
-
Specification does not justify its necessity for existence w3c/webappsec-secure-contexts#2 (1 comment by @mikewest)
-
Public Key Pinning with Overrides breaks the presumptions of Secure Contexts w3c/webappsec-secure-contexts#13 (1 comment by @mikewest)
-
SecureContext on attributes produces prototype mutations during realm creation w3c/webappsec-secure-contexts#23 (1 comment by @mikewest)
-
Use WindowOrWorkerGlobalScope instead of separate Window and Worker partial interfaces w3c/webappsec-secure-contexts#30 (1 comment by @mikewest)
-
Missing ""s when referring to results of "Is origin potentially trustworthy? w3c/webappsec-secure-contexts#35 (1 comment by @mikewest)
-
rendering bug: <a>s around [SecureContext] w3c/webappsec-secure-contexts#32 (1 comment by @mikewest)
-
Missing " in "Is origin potentially trustworthy?" w3c/webappsec-secure-contexts#34 (1 comment by @mikewest)
-
isSecureContext definition seems wrong in multi-global situations w3c/webappsec-secure-contexts#36 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Export the definition of non-secure context. w3c/webappsec-secure-contexts#38, by @jyasskin.
-
-
1 pull request closed.
-
Export the definition of non-secure context. w3c/webappsec-secure-contexts#38.
-
-
1 pull request received 1 new comment.
-
Export the definition of non-secure context. w3c/webappsec-secure-contexts#38 (1 comment by @mikewest)
-
w3c/webappsec
-
1 issue opened.
-
Way to disown window.opener and become a secure context w3c/webappsec#517, by @jakearchibald.
-
-
2 issues received 5 new comments.
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139 (3 comments by @danielstjules, @jakearchibald, @mikewest)
-
Way to disown window.opener and become a secure context w3c/webappsec#517 (2 comments by @delapuente, @jakearchibald)
-
-
1 pull request closed.
-
Explore automatic publication with Travis & Echidna w3c/webappsec#459.
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
3.2.1 is not a valid example - conflicting with SameSite w3c/webappsec-permissions-policy#30, by @intchloe.
-
Provide lots of use case examples, explain design decision, etc., in introduction w3c/webappsec-permissions-policy#29, by @slightlyoff.
-
-
2 issues closed.
-
Feature-Policy ∪ Permission Delegation ∪ Origin Trials w3c/webappsec-permissions-policy#9.
-
Allow setting via meta http-equiv w3c/webappsec-permissions-policy#25.
-
-
7 issues received 24 new comments.
-
Should we support `<meta http-equiv>` mechanism to set the policy? w3c/webappsec-permissions-policy#15 (12 comments by @clelland, @igrigorik, @michael-oneill, @yoavweiss)
-
Support for enable/disable attribute on iframes w3c/webappsec-permissions-policy#11 (7 comments by @benfredwells, @foolip, @igrigorik, @raymeskhoury, @yoavweiss)
-
Send feature policy in sub-resource request headers w3c/webappsec-permissions-policy#20 (1 comment by @igrigorik)
-
Feature-Policy ∪ Permission Delegation ∪ Origin Trials w3c/webappsec-permissions-policy#9 (1 comment by @igrigorik)
-
Clearly define how the policies of embedded documents combine/interact w3c/webappsec-permissions-policy#28 (1 comment by @igrigorik)
-
w3c/permissions
-
9 issues opened.
-
Guidance on whether to add a permissions to the platform w3c/permissions#116, by @jyasskin.
-
Check request() polyfill and update spec to match w3c/permissions#113, by @jyasskin.
-
Flesh out request("geolocation") w3c/permissions#112, by @jyasskin.
-
Flesh out request("push") w3c/permissions#111, by @jyasskin.
-
Guidance on where to put permission related stuff in other specs w3c/permissions#110, by @marcoscaceres.
-
Add 'webvr' to "Permission Registry" enum w3c/permissions#108, by @cvan.
-
Move the Permissions registry w3c/permissions#103, by @marcoscaceres.
-
Exceptions in promise using algorithms w3c/permissions#102, by @marcoscaceres.
-
how to tidy? w3c/permissions#98, by @marcoscaceres.
-
-
15 issues closed.
-
Add "fullscreen" w3c/permissions#26.
-
Why is "retrieve the permission storage" not in "Permission store"? w3c/permissions#84.
-
Add persistent storage w3c/permissions#39.
-
Permissions may change status in other ways than "trying to access" w3c/permissions#43.
-
Add "pointerlock" to enum PermissionName w3c/permissions#50.
-
Don't assume implicit grant from getUserMedia. w3c/permissions#78.
-
Permission API has terminology issues one could drive a truck through. w3c/permissions#85.
-
Model temporary permissions better w3c/permissions#86.
-
Specify how request and revoke work on push and midi permissions. w3c/permissions#90.
-
Separate "request access" from "request permission"? w3c/permissions#94.
-
how to tidy? w3c/permissions#98.
-
Exceptions in promise using algorithms w3c/permissions#102.
-
Add screen sharing permissions w3c/permissions#45.
-
Faking permissions w3c/permissions#54.
-
Add terms to Shepherd w3c/permissions#64.
-
-
27 issues received 51 new comments.
-
Add pointerlock to the permissions enum? w3c/permissions#67 (4 comments by @annevk, @jyasskin, @raymeskhoury)
-
Guidance on where to put permission related stuff in other specs w3c/permissions#110 (3 comments by @annevk, @jyasskin)
-
Exceptions in promise using algorithms w3c/permissions#102 (2 comments by @jyasskin, @marcoscaceres)
-
Why is "retrieve the permission storage" not in "Permission store"? w3c/permissions#84 (1 comment by @jyasskin)
-
Permissions may change status in other ways than "trying to access" w3c/permissions#43 (1 comment by @jyasskin)
-
Permission API has terminology issues one could drive a truck through. w3c/permissions#85 (1 comment by @jyasskin)
-
Specify how request and revoke work on push and midi permissions. w3c/permissions#90 (1 comment by @jyasskin)
-
What should "retrieve the permission state" do for pickers? w3c/permissions#8 (1 comment by @marcoscaceres)
-
10 pull requests opened.
-
feat(algorithms): allow calling with a PermissionName w3c/permissions#115, by @jyasskin.
-
refactor(permission state): pass the settings object explicitly w3c/permissions#114, by @jyasskin.
-
feat(registry): features require a secure context by default, with opt-out w3c/permissions#109, by @jyasskin.
-
feat(prompts): allow UAs to deny non-gesture prompts w3c/permissions#107, by @jyasskin.
-
docs(contributing): improve the guidelines for changes w3c/permissions#106, by @jyasskin.
-
chore(editors): add W3C editor IDs w3c/permissions#105, by @jyasskin.
-
chore(navigator-and-workernavigator-extension): remove redudant text w3c/permissions#104, by @marcoscaceres.
-
chore(examples): Modernize JS examples w3c/permissions#101, by @marcoscaceres.
-
Editorial fixes w3c/permissions#100, by @marcoscaceres.
-
feat(travis): autopublish with echidna (closes #24) w3c/permissions#99, by @marcoscaceres.
-
-
6 pull requests merged.
-
Editorial fixes w3c/permissions#100.
-
feat(registry): features require a secure context by default, with opt-out w3c/permissions#109.
-
docs(contributing): improve the guidelines for changes w3c/permissions#106.
-
chore(editors): add W3C editor IDs w3c/permissions#105.
-
chore(navigator-and-workernavigator-extension): remove redudant text w3c/permissions#104.
-
chore(examples): Modernize JS examples w3c/permissions#101.
-
-
7 pull requests received 105 new comments.
-
feat(prompts): allow UAs to deny non-gesture prompts w3c/permissions#107 (18 comments by @annevk, @jan-ivar, @jyasskin, @marcoscaceres)
-
feat(travis): autopublish with echidna (closes #24) w3c/permissions#99 (12 comments by @jyasskin, @marcoscaceres)
-
chore(examples): Modernize JS examples w3c/permissions#101 (12 comments by @jyasskin, @marcoscaceres)
-
feat(registry): features require a secure context by default, with opt-out w3c/permissions#109 (4 comments by @jyasskin, @martinthomson)
-
docs(contributing): improve the guidelines for changes w3c/permissions#106 (1 comment by @marcoscaceres)
w3c/webappsec-credential-management
-
1 issue opened.
-
Allow a site to specify a JSON template with a placeholder for the credential w3c/webappsec-credential-management#21, by @vabr-g.
-
w3c/webappsec-referrer-policy
-
3 issues opened.
-
Travis config is broken w3c/webappsec-referrer-policy#61, by @estark37.
-
Fetch integration is incorrect w3c/webappsec-referrer-policy#59, by @jdm.
-
Update web-platform-tests w3c/webappsec-referrer-policy#57, by @estark37.
-
-
2 issues closed.
-
Fetch integration is incorrect w3c/webappsec-referrer-policy#59.
-
"determine request's referrer" algorithm should consult request's referrer policy w3c/webappsec-referrer-policy#26.
-
-
1 issue reopened.
-
Add the non-downgrading versions of origin and origin-when-cross-origin w3c/webappsec-referrer-policy#50, by @fmarier.
-
-
7 issues received 22 new comments.
-
Srcdoc referrer policies don't interact well with <meta referrer> w3c/webappsec-referrer-policy#31 (10 comments by @bzbarsky, @domenic, @estark37)
-
Travis config is broken w3c/webappsec-referrer-policy#61 (3 comments by @jdm, @mikewest, @tabatkins)
-
Add the non-downgrading versions of origin and origin-when-cross-origin w3c/webappsec-referrer-policy#50 (2 comments by @annevk, @fmarier)
-
Use of "active document" in determining the referrer looks wrong w3c/webappsec-referrer-policy#29 (1 comment by @domenic)
-
"determine request's referrer" algorithm should consult request's referrer policy w3c/webappsec-referrer-policy#26 (1 comment by @estark37)
-
-
2 pull requests opened.
-
Update Integration with Fetch section w3c/webappsec-referrer-policy#60, by @estark37.
-
Fix referrer calculation to not refer to "API referrer source" w3c/webappsec-referrer-policy#58, by @domenic.
-
-
3 pull requests merged.
-
Update Integration with Fetch section w3c/webappsec-referrer-policy#60.
-
Fix referrer calculation to not refer to "API referrer source" w3c/webappsec-referrer-policy#58.
-
Add strict-origin and strict-origin-when-cross-origin policy states (fixes #50) w3c/webappsec-referrer-policy#56.
-
-
3 pull requests received 8 new comments.
-
Fix referrer calculation to not refer to "API referrer source" w3c/webappsec-referrer-policy#58 (4 comments by @domenic, @estark37)
-
Update Integration with Fetch section w3c/webappsec-referrer-policy#60 (2 comments by @estark37, @jdm)
-
Add strict-origin and strict-origin-when-cross-origin policy states (fixes #50) w3c/webappsec-referrer-policy#56 (2 comments by @estark37)
-
w3c/webappsec-subresource-integrity
-
3 issues opened.
-
Bug: examples 5 and 6 have the wrong sha384 value; should match example 4 w3c/webappsec-subresource-integrity#52, by @manger.
-
Consider require integrity metadata for Fetch w3c/webappsec-subresource-integrity#51, by @shekyan.
-
SRI is a Rec! What next? w3c/webappsec-subresource-integrity#49, by @wseltzer.
-
-
1 issue closed.
-
Add an `Integrity:` request header w3c/webappsec-subresource-integrity#47.
-
-
2 issues received 8 new comments.
-
Consider require integrity metadata for Fetch w3c/webappsec-subresource-integrity#51 (5 comments by @annevk, @shekyan)
-
Add an `Integrity:` request header w3c/webappsec-subresource-integrity#47 (3 comments by @hillbrad, @yoavweiss)
-
-
2 pull requests opened.
-
Update README to mention that Bikeshed is the default w3c/webappsec-subresource-integrity#50, by @joelweinberger.
-
Clarification of parsing of `require-sri-for` w3c/webappsec-subresource-integrity#48, by @shekyan.
-
-
2 pull requests merged.
-
Update README to mention that Bikeshed is the default w3c/webappsec-subresource-integrity#50.
-
Clarification of parsing of `require-sri-for` w3c/webappsec-subresource-integrity#48.
-
-
1 pull request received 2 new comments.
-
Update README to mention that Bikeshed is the default w3c/webappsec-subresource-integrity#50 (2 comments by @devd, @joelweinberger)
-
w3c/webcrypto
-
8 issues opened.
-
EC key raw import has incorrect steps w3c/webcrypto#130, by @ghost.
-
Raw format for EC keys in "raw" is under-specified (both import and export) w3c/webcrypto#129, by @ghost.
-
Consistency: "performing the XXX operation" vs "executing the XXX operation" w3c/webcrypto#128, by @ghost.
-
Text for "get key length" is missing algorithm normalization w3c/webcrypto#127, by @ghost.
-
Remove step (9) of deriveKey() w3c/webcrypto#126, by @ghost.
-
Remove step (8) of wrapKey() w3c/webcrypto#125, by @ghost.
-
Change order when BufferSources are read in verify() w3c/webcrypto#124, by @ghost.
-
Several algorithms unnecessarily check that a provided hash is supported w3c/webcrypto#119, by @mwatson2.
-
-
10 issues closed.
-
Update to 2016 stylesheet w3c/webcrypto#109.
-
Bug 27506 - Inconsistent error for AES-CTR's "get key length" operation w3c/webcrypto#45.
-
Question regarding readonly attribute in Crypto & SubtleCrypto interfaces w3c/webcrypto#107.
-
Bug 27472 - RSAHashedKeyGenParams vs. Dictionary Fields Editorial Note w3c/webcrypto#41.
-
Bug 27564 - Must conforming implementations match the order of errors? w3c/webcrypto#50.
-
Bug 27717 - Require RSA key import to validate the key parameters w3c/webcrypto#72.
-
-
19 issues received 81 new comments.
-
Bug 29514 - Need to define which globals objects created by this spec are associated with w3c/webcrypto#85 (23 comments by @annevk, @bzbarsky, @domenic, @mwatson2)
-
ECDSA import does not specify the hash algorithm w3c/webcrypto#111 (10 comments by @engelke, @ghost, @jimsch, @mwatson2)
-
HMAC Sign and Verify algorithms do not support trucated HMACs w3c/webcrypto#110 (9 comments by @engelke, @ghost, @harryhalpin, @jimsch, @mwatson2)
-
Bug 27603 - verify() can fail either by returning flase or rejecting with an error, inconsistent which is used w3c/webcrypto#66 (3 comments by @harryhalpin, @mwatson2)
-
Bug 29438 - JSON.stringify as invoked by wrapKey can have side-effects depending on what you pass it w3c/webcrypto#88 (2 comments by @ghost, @mwatson2)
-
Bug 27506 - Inconsistent error for AES-CTR's "get key length" operation w3c/webcrypto#45 (2 comments by @engelke, @mwatson2)
-
Bug 27774 - The KDFs either shouldn't allow importing extractable keys, or should support exportKey() w3c/webcrypto#76 (2 comments by @engelke, @mwatson2)
-
Text for "get key length" is missing algorithm normalization w3c/webcrypto#127 (1 comment by @mwatson2)
-
Several algorithms unnecessarily check that a provided hash is supported w3c/webcrypto#119 (1 comment by @mwatson2)
-
Bug 28551 - TODO: create example utility function that converts text -> ArrayBufferView w3c/webcrypto#81 (1 comment by @mwatson2)
-
Bug 27471 - Provide even more informative text over key wrapping? w3c/webcrypto#40 (1 comment by @mwatson2)
-
Bug 29437 - Parsing a JWK can have side-effects if not done very carefully w3c/webcrypto#87 (1 comment by @mwatson2)
-
Bug 27814 - Section A.2 - the usage mapping of "enc" is incorrect w3c/webcrypto#77 (1 comment by @mwatson2)
-
Question regarding readonly attribute in Crypto & SubtleCrypto interfaces w3c/webcrypto#107 (1 comment by @mwatson2)
-
-
11 pull requests opened.
-
Fix #119: Remove redundant checks that hash algorithm is supported w3c/webcrypto#123, by @mwatson2.
-
Fix #28: Require a secure context w3c/webcrypto#122, by @mwatson2.
-
Fix #109: Update for 2016 stylesheet w3c/webcrypto#121, by @mwatson2.
-
Fix #111: Specify hash algorithm for ECDSA at generate/import w3c/webcrypto#120, by @mwatson2.
-
Fix #110: Supported truncated MACs in HMAC verify w3c/webcrypto#118, by @mwatson2.
-
Fix #66: Return false in all cases except valid signature for RSASSA … w3c/webcrypto#117, by @mwatson2.
-
Fix #81: Use TextEncoder in examples to encode text to ArrayBuffer w3c/webcrypto#116, by @mwatson2.
-
Fix #87: Require JSON.parse to be executed in a clean global w3c/webcrypto#115, by @mwatson2.
-
Fix #77: Allow JWK use to be enc for ECDH import w3c/webcrypto#114, by @mwatson2.
-
Fix #76: Require extractable=false for KDF import w3c/webcrypto#113, by @mwatson2.
-
Fix #45: AES-CTR get key length returns OperationError on invalid key… w3c/webcrypto#112, by @mwatson2.
-
-
6 pull requests merged.
-
Fix #109: Update for 2016 stylesheet w3c/webcrypto#121.
-
Fix #45: AES-CTR get key length returns OperationError on invalid key… w3c/webcrypto#112.
-
Fix #76: Require extractable=false for KDF import w3c/webcrypto#113.
-
Fix #66: Return false in all cases except valid signature for RSASSA … w3c/webcrypto#117.
-
Fix #81: Use TextEncoder in examples to encode text to ArrayBuffer w3c/webcrypto#116.
-
Fix #72: Validate RSA keys according to RFC3447 on import w3c/webcrypto#104.
-
-
1 pull request closed.
-
Fix #66: Allow ECDSA sign/verify to throw an OperationError w3c/webcrypto#102.
-
-
5 pull requests received 9 new comments.
-
Changes to switch from NIST to IETF version of HKDF w3c/webcrypto#16 (4 comments by @engelke, @ghost, @mwatson2)
-
Fix #119: Remove redundant checks that hash algorithm is supported w3c/webcrypto#123 (2 comments by @engelke, @ghost)
-
Fix #66: Return false in all cases except valid signature for RSASSA … w3c/webcrypto#117 (1 comment by @engelke)
-
Fix #81: Use TextEncoder in examples to encode text to ArrayBuffer w3c/webcrypto#116 (1 comment by @engelke)
-
w3c/webappsec-clear-site-data
-
1 issue closed.
-
Clear cookies for origin is inaccurate w3c/webappsec-clear-site-data#3.
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Republish CR. w3c/webappsec-mixed-content#6, by @mikewest.
-
-
1 issue closed.
-
Allow `http://127.0.0.1`. w3c/webappsec-mixed-content#4.
-
-
1 pull request closed.
-
Carve out `http://127.0.0.1` from mixed content checks. w3c/webappsec-mixed-content#5.
-
-
1 pull request received 1 new comment.
-
Carve out `http://127.0.0.1` from mixed content checks. w3c/webappsec-mixed-content#5 (1 comment by @mikewest)
-
w3c/webappsec-uisecurity
-
2 pull requests opened.
-
Fix WebIDL typo w3c/webappsec-uisecurity#10, by @dontcallmedom.
-
Fix URL of editors draft w3c/webappsec-uisecurity#9, by @dontcallmedom.
-
-
2 pull requests merged.
-
Fix URL of editors draft w3c/webappsec-uisecurity#9.
-
Fix WebIDL typo w3c/webappsec-uisecurity#10.
-
TR publications
-
4 documents published.
-
Subresource Integrity published as a Recommendation. History of Subresource Integrity
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
User Interface Security and the Visibility API published as a Working Draft. History of User Interface Security and the Visibility API
-
Referrer Policy published as a Working Draft. History of Referrer Policy
-
GitHub
w3c/webappsec-referrer-policy
-
2 issues opened.
-
Examples table w3c/webappsec-referrer-policy#54, by @craigfrancis.
-
What is the motivation for "legacy keywords" in the header? w3c/webappsec-referrer-policy#53, by @domenic.
-
-
1 issue received 7 new comments.
-
What is the motivation for "legacy keywords" in the header? w3c/webappsec-referrer-policy#53 (7 comments by @domenic, @estark37, @fmarier)
-
-
2 pull requests opened.
-
Add strict-origin and strict-origin-when-cross-origin policy states (fixes #50) w3c/webappsec-referrer-policy#56, by @fmarier.
-
Add a missing "a" w3c/webappsec-referrer-policy#55, by @fmarier.
-
-
1 pull request merged.
-
Add a missing "a" w3c/webappsec-referrer-policy#55.
-
-
1 pull request closed.
-
Add the policy states safe-origin and safe-origin-when-cross-origin. w3c/webappsec-referrer-policy#52.
-
-
3 pull requests received 21 new comments.
-
Add the policy states safe-origin and safe-origin-when-cross-origin. w3c/webappsec-referrer-policy#52 (17 comments by @estark37, @fmarier, @mozfreddyb)
-
Add strict-origin and strict-origin-when-cross-origin policy states (fixes #50) w3c/webappsec-referrer-policy#56 (3 comments by @estark37, @fmarier)
-
w3c/webappsec-csp
-
5 issues opened.
-
Instruct user agents to report invalid policies w3c/webappsec-csp#96, by @neilstuartcraig.
-
Add "disposition" attribute to SecurityPolicyViolationEvent w3c/webappsec-csp#94, by @shekyan.
-
WebRTC can be used for exfiltration w3c/webappsec-csp#92, by @annevk.
-
Consider providing a way to tighten source-expressions that contain `self` w3c/webappsec-csp#91, by @shekyan.
-
4 issues received 4 new comments.
-
Add a note about 'strict-dynamic' allowing injections into non-parser-inserted script URIs to be exploitable w3c/webappsec-csp#97 (1 comment by @arturjanc)
-
Consider providing a way to tighten source-expressions that contain `self` w3c/webappsec-csp#91 (1 comment by @shekyan)
-
-
2 pull requests opened.
-
Added "policyDisposition" property on SecurityPolicyViolationEvent w3c/webappsec-csp#95, by @shekyan.
-
reference `require-sri-for` in SRI specification w3c/webappsec-csp#93, by @shekyan.
-
-
1 pull request merged.
-
reference `require-sri-for` in SRI specification w3c/webappsec-csp#93.
-
-
2 pull requests received 2 new comments.
-
Make the example for multiple policies a little clearer w3c/webappsec-csp#76 (1 comment by @plehegar)
w3c/webappsec-permissions-policy
-
12 issues opened.
-
Clearly define how the policies of embedded documents combine/interact w3c/webappsec-permissions-policy#28, by @raymeskhoury.
-
Relationship with permissions spec w3c/webappsec-permissions-policy#27, by @benfredwells.
-
Defaults aren't clear to me w3c/webappsec-permissions-policy#26, by @benfredwells.
-
Allow setting via meta http-equiv w3c/webappsec-permissions-policy#25, by @AshleyScirra.
-
More feature policy ideas w3c/webappsec-permissions-policy#24, by @AshleyScirra.
-
Don't forbid document.domain getter w3c/webappsec-permissions-policy#23, by @annevk.
-
Policy to set maximum content size and other constraints w3c/webappsec-permissions-policy#21, by @jkarlin.
-
Send feature policy in sub-resource request headers w3c/webappsec-permissions-policy#20, by @jkarlin.
-
A policy to force temporary permissions w3c/webappsec-permissions-policy#19, by @jyasskin.
-
Spec "enable/disable: web-payments" policy w3c/webappsec-permissions-policy#18, by @igrigorik.
-
Feature Policy ~v1 w3c/webappsec-permissions-policy#17, by @igrigorik.
-
Disable Set-Cookie also + other storage w3c/webappsec-permissions-policy#16, by @michael-oneill.
-
-
5 issues closed.
-
Policy to set maximum content size and other constraints w3c/webappsec-permissions-policy#21.
-
Spec "Trials Policy" to expose experimental features to specific origin (Origin Trials) w3c/webappsec-permissions-policy#8.
-
Limit reporting to same-origin? w3c/webappsec-permissions-policy#6.
-
Emit feature policy on subrequests & validate reflected policy w3c/webappsec-permissions-policy#7.
-
Should `target` accept a list of origins? w3c/webappsec-permissions-policy#13.
-
-
15 issues received 43 new comments.
-
Send feature policy in sub-resource request headers w3c/webappsec-permissions-policy#20 (6 comments by @clelland, @igrigorik, @ojanvafai)
-
A policy to force temporary permissions w3c/webappsec-permissions-policy#19 (6 comments by @igrigorik, @jyasskin, @raymeskhoury)
-
target: "self" doesn't help defend against XSS. w3c/webappsec-permissions-policy#12 (5 comments by @igrigorik, @jkarlin, @jyasskin)
-
Should we support `<meta http-equiv>` mechanism to set the policy? w3c/webappsec-permissions-policy#15 (5 comments by @clelland, @igrigorik, @michael-oneill)
-
Support for enable/disable attribute on iframes w3c/webappsec-permissions-policy#11 (4 comments by @benfredwells, @igrigorik, @raymeskhoury)
-
Defaults aren't clear to me w3c/webappsec-permissions-policy#26 (3 comments by @benfredwells, @clelland, @raymeskhoury)
-
Allow setting via meta http-equiv w3c/webappsec-permissions-policy#25 (3 comments by @AshleyScirra, @igrigorik)
-
Relationship with permissions spec w3c/webappsec-permissions-policy#27 (2 comments by @jyasskin, @raymeskhoury)
-
Disable Set-Cookie also + other storage w3c/webappsec-permissions-policy#16 (2 comments by @igrigorik, @intchloe)
-
Policy to set maximum content size and other constraints w3c/webappsec-permissions-policy#21 (2 comments by @jkarlin, @ojanvafai)
-
Spec "Trials Policy" to expose experimental features to specific origin (Origin Trials) w3c/webappsec-permissions-policy#8 (1 comment by @igrigorik)
-
Emit feature policy on subrequests & validate reflected policy w3c/webappsec-permissions-policy#7 (1 comment by @igrigorik)
-
-
1 pull request opened.
-
Request is not needed to define policy w3c/webappsec-permissions-policy#22, by @clelland.
-
-
1 pull request merged.
-
Request is not needed to define policy w3c/webappsec-permissions-policy#22.
-
-
1 pull request received 1 new comment.
-
Request is not needed to define policy w3c/webappsec-permissions-policy#22 (1 comment by @igrigorik)
-
w3c/webappsec-subresource-integrity
-
4 issues opened.
-
Add an `Integrity:` request header w3c/webappsec-subresource-integrity#47, by @yoavweiss.
-
Ensure that bad bikeshed markup is still picked up by Travis w3c/webappsec-subresource-integrity#46, by @fmarier.
-
Extend SRI to support integrity metadata on inline script/style blocks w3c/webappsec-subresource-integrity#44, by @shekyan.
-
[CORS] reference is wrong w3c/webappsec-subresource-integrity#41, by @domenic.
-
-
4 issues received 13 new comments.
-
Extend SRI to support integrity metadata on inline script/style blocks w3c/webappsec-subresource-integrity#44 (4 comments by @devd, @mikewest, @shekyan)
-
Checking the integrity of resources pulled in from within CSS stylesheets w3c/webappsec-subresource-integrity#40 (4 comments by @annevk, @mozfreddyb)
-
Add an `Integrity:` request header w3c/webappsec-subresource-integrity#47 (3 comments by @annevk, @yoavweiss)
-
Ensure that bad bikeshed markup is still picked up by Travis w3c/webappsec-subresource-integrity#46 (2 comments by @devd, @fmarier)
-
-
3 pull requests opened.
-
Add IANA considerations section referencing `require-sri-for` w3c/webappsec-subresource-integrity#45, by @shekyan.
-
Make the bikeshed spec the editors' draft w3c/webappsec-subresource-integrity#43, by @fmarier.
-
Update spec status and fix spelling of my name w3c/webappsec-subresource-integrity#42, by @fmarier.
-
-
4 pull requests merged.
-
Add IANA considerations section referencing `require-sri-for` w3c/webappsec-subresource-integrity#45.
-
Make the bikeshed spec the editors' draft w3c/webappsec-subresource-integrity#43.
-
Update spec status and fix spelling of my name w3c/webappsec-subresource-integrity#42.
-
attempt to write down `require-sri-for` directive as part of SRI w3c/webappsec-subresource-integrity#32.
-
-
1 pull request closed.
-
Move to Proposed Recommendation w3c/webappsec-subresource-integrity#28.
-
-
5 pull requests received 31 new comments.
-
attempt to write down `require-sri-for` directive as part of SRI w3c/webappsec-subresource-integrity#32 (23 comments by @devd, @joelweinberger, @mikewest, @mozfreddyb, @ptoomey3, @shekyan)
-
Add IANA considerations section referencing `require-sri-for` w3c/webappsec-subresource-integrity#45 (5 comments by @devd, @fmarier, @shekyan)
-
Make the bikeshed spec the editors' draft w3c/webappsec-subresource-integrity#43 (1 comment by @fmarier)
-
Update spec status and fix spelling of my name w3c/webappsec-subresource-integrity#42 (1 comment by @fmarier)
-
w3c/webappsec-clear-site-data
-
3 issues opened.
-
Clear cookies for origin is inaccurate w3c/webappsec-clear-site-data#3, by @annevk.
-
Deal with TLS client certificates and HTTP authentication w3c/webappsec-clear-site-data#2, by @annevk.
-
Service workers w3c/webappsec-clear-site-data#1, by @annevk.
-
-
1 issue received 1 new comment.
w3c/webappsec-suborigins
-
2 issues opened.
-
Understanding the syntax w3c/webappsec-suborigins#39, by @intchloe.
-
Underscore should not be used for serialization. w3c/webappsec-suborigins#38, by @naskooskov.
-
-
1 issue closed.
-
Understanding the syntax w3c/webappsec-suborigins#39.
-
-
2 issues received 18 new comments.
-
Underscore should not be used for serialization. w3c/webappsec-suborigins#38 (16 comments by @bsittler, @devd, @joelweinberger, @sleevi)
-
w3c/webcrypto
-
5 issues opened.
-
ECDSA import does not specify the hash algorithm w3c/webcrypto#111, by @jimsch.
-
HMAC Sign and Verify algorithms do not support trucated HMACs w3c/webcrypto#110, by @jimsch.
-
Update to 2016 stylesheet w3c/webcrypto#109, by @mwatson2.
-
Question regarding readonly attribute in Crypto & SubtleCrypto interfaces w3c/webcrypto#107, by @cphoton.
-
Update acknowledgments w3c/webcrypto#106, by @wseltzer.
-
-
17 issues closed.
-
Bug 29359 - Make the "exceptions" section clearer w3c/webcrypto#84.
-
Bug 27486 - RsaHashedImportParams does not extend Algorithm w3c/webcrypto#44.
-
Clean up left over pieces of change of JWK from string to object w3c/webcrypto#21.
-
Remove the generate key operation for PBKDF2 w3c/webcrypto#23.
-
Bug 29545 from bugzilla - ECDSA 'alg' names for JWK: ES512 vs ES521 w3c/webcrypto#24.
-
Bug 27447 - Inconsistent use of "raw" format for EC keys w3c/webcrypto#36.
-
Bug 27617 - Remove Section 4.3 "Operations" from the spec w3c/webcrypto#67.
-
Possible inconsistency in crypto.subtle.generateKey errors w3c/webcrypto#22.
-
-
1 issue reopened.
-
25 issues received 42 new comments.
-
Bug 27403 - Should PBKDF2 be allowed on non-multiple of 8 lengths for consistency? w3c/webcrypto#32 (4 comments by @jimsch, @mwatson2)
-
Bug 27717 - Require RSA key import to validate the key parameters w3c/webcrypto#72 (3 comments by @hhalpin, @jimsch, @mwatson2)
-
Bug 27814 - Section A.2 - the usage mapping of "enc" is incorrect w3c/webcrypto#77 (3 comments by @hhalpin, @jimsch, @mwatson2)
-
HMAC Sign and Verify algorithms do not support trucated HMACs w3c/webcrypto#110 (2 comments by @hhalpin, @jimsch)
-
Bug 27255 - Inconsistent handling of SPKI / PKCS#8 data between implementations w3c/webcrypto#26 (2 comments by @hhalpin)
-
Bug 27471 - Provide even more informative text over key wrapping? w3c/webcrypto#40 (2 comments by @hhalpin)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @hhalpin)
-
Bug 28551 - TODO: create example utility function that converts text -> ArrayBufferView w3c/webcrypto#81 (2 comments by @engelke, @ttaubert)
-
Bug 27562 - Odd wording of section "2.7. Javascript Object Signing and Encryption (JOSE)" w3c/webcrypto#48 (2 comments by @bdhess, @hhalpin)
-
Bug 27564 - Must conforming implementations match the order of errors? w3c/webcrypto#50 (2 comments by @jimsch, @mwatson2)
-
Bug 27603 - verify() can fail either by returning flase or rejecting with an error, inconsistent which is used w3c/webcrypto#66 (2 comments by @jimsch, @mwatson2)
-
Bug 27472 - RSAHashedKeyGenParams vs. Dictionary Fields Editorial Note w3c/webcrypto#41 (1 comment by @mwatson2)
-
Bug 27486 - RsaHashedImportParams does not extend Algorithm w3c/webcrypto#44 (1 comment by @hhalpin)
-
Bug 27816 - IANA considerations review for definition of algorithms w3c/webcrypto#79 (1 comment by @hhalpin)
-
Bug 27602 - ECDSA's Sign operation is not explicit about how r and s are concatenated (padding) w3c/webcrypto#65 (1 comment by @engelke)
-
Bug 27601 - Inconsistent enforcement of JWK's "use" versus "key_ops" during public key import w3c/webcrypto#64 (1 comment by @mwatson2)
-
Bug 27774 - The KDFs either shouldn't allow importing extractable keys, or should support exportKey() w3c/webcrypto#76 (1 comment by @bdhess)
-
Question regarding readonly attribute in Crypto & SubtleCrypto interfaces w3c/webcrypto#107 (1 comment by @jimsch)
-
Bug 27587 - Section 19, Algorithm Overview, does not mention verify() or deriveBits() methods w3c/webcrypto#59 (1 comment by @engelke)
-
-
1 pull request opened.
-
Fix #48: Make use cases internally consistent, and clean up language w3c/webcrypto#108, by @bdhess.
-
-
13 pull requests merged.
-
Fix #44: RsaHashedImportParams should be derived from Algorithm w3c/webcrypto#98.
-
Fix #21: Clarify handling of JWK keyData in Import Key operations w3c/webcrypto#90.
-
Fix #23: Remove generateKey for PBKDF2 w3c/webcrypto#91.
-
Fix #24: s/ES521/ES512/ w3c/webcrypto#92.
-
Fix #25: Check for algorithm name match between keys on ECDH deriveBits w3c/webcrypto#93.
-
Fix #31: Pad bit string with zeros when returned as octets w3c/webcrypto#95.
-
Fix #36: Provide raw inport / export for ECDSA w3c/webcrypto#96.
-
Fix #37: Require hash to be specified for HMAC ImportKey w3c/webcrypto#97.
-
Fix #64: Ignore 'use' field in JWK import with empty usages w3c/webcrypto#100.
-
Fix #65: Specify how ECDSA signature results are concatenated w3c/webcrypto#101.
-
Fix #67: Remove section 4.3 (Operations) w3c/webcrypto#103.
-
Fix #74: Throw an OperationError in HKDF derive bits if length is null w3c/webcrypto#105.
-
Fix #59: Add importKey, exportKey and deriveBits to Section 19 w3c/webcrypto#99.
-
-
2 pull requests received 2 new comments.
-
Fix #66: Allow ECDSA sign/verify to throw an OperationError w3c/webcrypto#102 (1 comment by @engelke)
w3c/permissions
-
1 issue received 17 new comments.
-
Only allow permissions.request() during user interaction w3c/permissions#77 (17 comments by @benfredwells, @jan-ivar, @jyasskin, @martinthomson, @mnoorenberghe, @noncombatant, @raymeskhoury)
-
-
1 pull request merged.
-
Give the UA permission to return anything it wants from query(). w3c/permissions#97.
-
-
3 pull requests closed.
-
Describe the permission store using constraints instead of a full model. w3c/permissions#96.
-
Define an algorithm to update the permission storage. w3c/permissions#91.
-
Allow UAs to maintain zero or multiple permission stores. w3c/permissions#95.
-
-
4 pull requests received 4 new comments.
-
Describe the permission store using constraints instead of a full model. w3c/permissions#96 (1 comment by @jyasskin)
-
Allow UAs to maintain zero or multiple permission stores. w3c/permissions#95 (1 comment by @jyasskin)
-
Give the UA permission to return anything it wants from query(). w3c/permissions#97 (1 comment by @martinthomson)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Request to participate w3c/webappsec-secure-contexts#29, by @rapcatcher801.
-
w3c/webappsec-uisecurity
-
2 pull requests opened.
-
Move .src.html to .bs, update to WD for publication w3c/webappsec-uisecurity#8, by @hillbrad.
-
update to .bs extension, set status to WD w3c/webappsec-uisecurity#7, by @hillbrad.
-
-
1 pull request merged.
-
Move .src.html to .bs, update to WD for publication w3c/webappsec-uisecurity#8.
-
-
1 pull request closed.
-
update to .bs extension, set status to WD w3c/webappsec-uisecurity#7.
-
TR publications
-
1 document published.
-
Subresource Integrity published as a Proposed Recommendation. History of Subresource Integrity
-
Participants
-
1 participant joined.
-
Niklas Andreasson (W3C Invited Experts) joined.
-
GitHub
w3c/webappsec-referrer-policy
-
5 issues opened.
-
Add the non-downgrading versions of origin and origin-when-cross-origin w3c/webappsec-referrer-policy#50, by @fmarier.
-
Clarify priority of Referrer Policy Delivery w3c/webappsec-referrer-policy#48, by @tungnh28.
-
Clarify that "Unknown Policy Values" applies to Document policies w3c/webappsec-referrer-policy#46, by @estark37.
-
Reference WHATWG DOM w3c/webappsec-referrer-policy#45, by @annevk.
-
Reference WHATWG URL w3c/webappsec-referrer-policy#44, by @annevk.
-
-
6 issues closed.
-
Clarify priority of Referrer Policy Delivery w3c/webappsec-referrer-policy#48.
-
Please work with the HTML spec to not monkeypatch browsing context creation w3c/webappsec-referrer-policy#30.
-
Verbiage about creating nested browsing contexts for particular URLs does not make sense w3c/webappsec-referrer-policy#32.
-
Add appropriate [CEReactions] annotation w3c/webappsec-referrer-policy#27.
-
Reference WHATWG URL w3c/webappsec-referrer-policy#44.
-
Reference WHATWG DOM w3c/webappsec-referrer-policy#45.
-
-
4 issues received 20 new comments.
-
Clarify priority of Referrer Policy Delivery w3c/webappsec-referrer-policy#48 (12 comments by @domenic, @estark37, @jeisinger, @tungnh28)
-
Add the non-downgrading versions of origin and origin-when-cross-origin w3c/webappsec-referrer-policy#50 (3 comments by @fmarier)
-
-
4 pull requests opened.
-
Add the policy states safe-origin and safe-origin-when-cross-origin. w3c/webappsec-referrer-policy#52, by @mozfreddyb.
-
Remove a superfluous "any" w3c/webappsec-referrer-policy#51, by @fmarier.
-
Integrate with HTML, part 2 of n w3c/webappsec-referrer-policy#49, by @domenic.
-
Change "origin-only" to "origin" w3c/webappsec-referrer-policy#47, by @domenic.
-
-
5 pull requests merged.
-
Integrate with HTML, part 2 of n w3c/webappsec-referrer-policy#49.
-
Introduce a "Same-Origin Only" policy state w3c/webappsec-referrer-policy#19.
-
Remove a superfluous "any" w3c/webappsec-referrer-policy#51.
-
Change "origin-only" to "origin" w3c/webappsec-referrer-policy#47.
-
Integrate with HTML, part 1 of n w3c/webappsec-referrer-policy#42.
-
-
5 pull requests received 52 new comments.
-
Integrate with HTML, part 1 of n w3c/webappsec-referrer-policy#42 (30 comments by @domenic, @estark37, @jdm, @jeisinger, @mikewest, @Ms2ger, @tabatkins)
-
Add the policy states safe-origin and safe-origin-when-cross-origin. w3c/webappsec-referrer-policy#52 (6 comments by @domenic, @fmarier)
-
Integrate with HTML, part 2 of n w3c/webappsec-referrer-policy#49 (5 comments by @annevk, @domenic, @estark37)
-
w3c/webappsec-subresource-integrity
-
4 issues opened.
-
Checking the integrity of resources pulled in from within CSS stylesheets w3c/webappsec-subresource-integrity#40, by @baloo.
-
Consider feature detection w3c/webappsec-subresource-integrity#37, by @joelweinberger.
-
Consider alternative src value for integrity supported resources w3c/webappsec-subresource-integrity#36, by @joelweinberger.
-
note about data: URLs always returning opaque responses seems not quite right w3c/webappsec-subresource-integrity#35, by @wanderview.
-
-
1 issue closed.
-
note about data: URLs always returning opaque responses seems not quite right w3c/webappsec-subresource-integrity#35.
-
-
5 issues received 19 new comments.
-
note about data: URLs always returning opaque responses seems not quite right w3c/webappsec-subresource-integrity#35 (7 comments by @bzbarsky, @devd, @fmarier, @wanderview)
-
Consider alternative src value for integrity supported resources w3c/webappsec-subresource-integrity#36 (5 comments by @annevk, @joelweinberger, @mozfreddyb)
-
Checking the integrity of resources pulled in from within CSS stylesheets w3c/webappsec-subresource-integrity#40 (4 comments by @baloo, @fmarier)
-
Consider feature detection w3c/webappsec-subresource-integrity#37 (2 comments by @joelweinberger, @mozfreddyb)
-
-
5 pull requests opened.
-
Set spec status w3c/webappsec-subresource-integrity#39, by @fmarier.
-
Remove the note about data: and blob URLs (fixes #35) w3c/webappsec-subresource-integrity#38, by @fmarier.
-
update CI to build both v.1 and current w3c/webappsec-subresource-integrity#34, by @shekyan.
-
use bikeshed instead of kramdown w3c/webappsec-subresource-integrity#33, by @shekyan.
-
attempt to write down `require-sri-for` directive as part of SRI w3c/webappsec-subresource-integrity#32, by @shekyan.
-
-
3 pull requests merged.
-
Set spec status w3c/webappsec-subresource-integrity#39.
-
Remove the note about data: and blob URLs (fixes #35) w3c/webappsec-subresource-integrity#38.
-
update CI to build both v.1 and current w3c/webappsec-subresource-integrity#34.
-
-
1 pull request closed.
-
use bikeshed instead of kramdown w3c/webappsec-subresource-integrity#33.
-
-
5 pull requests received 56 new comments.
-
attempt to write down `require-sri-for` directive as part of SRI w3c/webappsec-subresource-integrity#32 (42 comments by @joelweinberger, @mikewest, @mozfreddyb, @shekyan)
-
use bikeshed instead of kramdown w3c/webappsec-subresource-integrity#33 (8 comments by @fmarier, @joelweinberger, @shekyan)
-
Remove the note about data: and blob URLs (fixes #35) w3c/webappsec-subresource-integrity#38 (2 comments by @fmarier, @mozfreddyb)
-
update CI to build both v.1 and current w3c/webappsec-subresource-integrity#34 (2 comments by @fmarier, @mozfreddyb)
-
w3c/webappsec-credential-management
-
6 issues opened.
-
Documentation for `unmediated` option unclear w3c/webappsec-credential-management#20, by @ithinkihaveacat.
-
Consider assigning an `HTMLFormElement` to `.additionalData` w3c/webappsec-credential-management#19, by @mikewest.
-
Note that a UA may create a new credential from the selection UI w3c/webappsec-credential-management#18, by @mnoorenberghe.
-
Support programmatically filling a `<form>` with a PasswordCredential w3c/webappsec-credential-management#17, by @mnoorenberghe.
-
Remove the `PasswordCredential` constructor taking a `PasswordCredentialData` in favour of the form version w3c/webappsec-credential-management#16, by @mnoorenberghe.
-
Some example code don't work w3c/webappsec-credential-management#15, by @agektmr.
-
-
1 issue closed.
-
storeCredentials() method on HTMLFormElement w3c/webappsec-credential-management#13.
-
-
3 issues received 5 new comments.
-
storeCredentials() method on HTMLFormElement w3c/webappsec-credential-management#13 (3 comments by @mnoorenberghe)
-
Support programmatically filling a `<form>` with a PasswordCredential w3c/webappsec-credential-management#17 (1 comment by @jmalonzo)
-
CREDENTIAL: requestAutocomplete can already provide local credentials w3c/webappsec-credential-management#2 (1 comment by @mnoorenberghe)
-
w3c/webappsec-permissions-policy
-
15 issues opened.
-
Should we support `<meta http-equiv>` mechanism to set the policy? w3c/webappsec-permissions-policy#15, by @igrigorik.
-
Define disable policy for Permissions API? w3c/webappsec-permissions-policy#14, by @igrigorik.
-
Should `target` accept a list of origins? w3c/webappsec-permissions-policy#13, by @igrigorik.
-
target: "self" doesn't help defend against XSS. w3c/webappsec-permissions-policy#12, by @jyasskin.
-
Support for enable/disable attribute on iframes w3c/webappsec-permissions-policy#11, by @igrigorik.
-
Mechanisms to "disable" a feature w3c/webappsec-permissions-policy#10, by @igrigorik.
-
Feature-Policy ∪ Permission Delegation ∪ Origin Trials w3c/webappsec-permissions-policy#9, by @igrigorik.
-
Spec "Trials Policy" to expose experimental features to specific origin (Origin Trials) w3c/webappsec-permissions-policy#8, by @igrigorik.
-
Emit feature policy on subrequests & validate reflected policy w3c/webappsec-permissions-policy#7, by @igrigorik.
-
Limit reporting to same-origin? w3c/webappsec-permissions-policy#6, by @igrigorik.
-
Spec "disable: webrtc" enforcement w3c/webappsec-permissions-policy#5, by @igrigorik.
-
Spec "disable: push" enforcement w3c/webappsec-permissions-policy#4, by @igrigorik.
-
Spec "disable: notifications" enforcement w3c/webappsec-permissions-policy#3, by @igrigorik.
-
Spec "disable: MIDI" enforcement w3c/webappsec-permissions-policy#2, by @igrigorik.
-
Spec "disable: geolocation" enforcement w3c/webappsec-permissions-policy#1, by @igrigorik.
-
-
5 issues received 15 new comments.
-
Feature-Policy ∪ Permission Delegation ∪ Origin Trials w3c/webappsec-permissions-policy#9 (4 comments by @igrigorik, @ojanvafai, @raymeskhoury)
-
Mechanisms to "disable" a feature w3c/webappsec-permissions-policy#10 (4 comments by @igrigorik, @jyasskin)
-
Define disable policy for Permissions API? w3c/webappsec-permissions-policy#14 (3 comments by @igrigorik, @jyasskin, @raymeskhoury)
-
target: "self" doesn't help defend against XSS. w3c/webappsec-permissions-policy#12 (2 comments by @igrigorik, @ojanvafai)
-
Spec "Trials Policy" to expose experimental features to specific origin (Origin Trials) w3c/webappsec-permissions-policy#8 (2 comments by @igrigorik, @jpchase)
-
w3c/permissions
-
2 issues received 8 new comments.
-
Requesting permissions needs to be able to ask for multiple things w3c/permissions#92 (5 comments by @alvestrand, @annevk, @domenic, @mounirlamouri)
-
Only allow permissions.request() during user interaction w3c/permissions#77 (3 comments by @jyasskin, @martinthomson, @TanviHacks)
-
-
2 pull requests opened.
-
Give the UA permission to return anything it wants from query(). w3c/permissions#97, by @jyasskin.
-
Describe the permission store using constraints instead of a full model. w3c/permissions#96, by @jyasskin.
-
-
4 pull requests received 65 new comments.
-
Give the UA permission to return anything it wants from query(). w3c/permissions#97 (53 comments by @jyasskin, @marcoscaceres, @tabatkins)
-
Describe the permission store using constraints instead of a full model. w3c/permissions#96 (9 comments by @alvestrand, @annevk, @jyasskin, @martinthomson)
-
Allow UAs to maintain zero or multiple permission stores. w3c/permissions#95 (2 comments by @annevk, @jan-ivar)
-
w3c/webcrypto
-
69 issues opened.
-
Fix WebIDL indentation w3c/webcrypto#94, by @mwatson2.
-
Update front page boilerplate with GitHub URLs w3c/webcrypto#89, by @mwatson2.
-
Bug 29437 - Parsing a JWK can have side-effects if not done very carefully w3c/webcrypto#87, by @mwatson2.
-
Bug 29539 - Invalid algorithm OID for ECDH w3c/webcrypto#86, by @mwatson2.
-
Bug 29359 - Make the "exceptions" section clearer w3c/webcrypto#84, by @mwatson2.
-
Bug 29139 - Allow specifying numbers in place of BigInteger? w3c/webcrypto#83, by @mwatson2.
-
Bug 29005 - Add support for secp256k1 curve w3c/webcrypto#82, by @mwatson2.
-
Bug 27946 - getRandomValues should mention Uint8ClampedArray w3c/webcrypto#80, by @mwatson2.
-
Bug 27816 - IANA considerations review for definition of algorithms w3c/webcrypto#79, by @mwatson2.
-
Bug 27815 - IANA Considerations for "ext" w3c/webcrypto#78, by @mwatson2.
-
Bug 27814 - Section A.2 - the usage mapping of "enc" is incorrect w3c/webcrypto#77, by @mwatson2.
-
Bug 27773 - Clarification of unwrapKey method parameters w3c/webcrypto#75, by @mwatson2.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73, by @mwatson2.
-
Bug 27717 - Require RSA key import to validate the key parameters w3c/webcrypto#72, by @mwatson2.
-
Bug 27689 - Is PBKDF2's generateKey() UI step worthwhile? w3c/webcrypto#71, by @mwatson2.
-
Bug 27685 - References link to PKCS3 is broken w3c/webcrypto#70, by @mwatson2.
-
Bug 27622 - Typo: "Import key" -> "importKey" in section 34.2, 35.2 w3c/webcrypto#69, by @mwatson2.
-
Bug 27621 - Inconsistent name for getLength operation w3c/webcrypto#68, by @mwatson2.
-
Bug 27617 - Remove Section 4.3 "Operations" from the spec w3c/webcrypto#67, by @mwatson2.
-
Bug 27600 - Inconsistent formatting (indentation) of WebIDL blocks w3c/webcrypto#63, by @mwatson2.
-
Bug 27588 - Typo "myst" --> "must" w3c/webcrypto#60, by @mwatson2.
-
Bug 27586 - Incorrect link to "decrypt" w3c/webcrypto#58, by @mwatson2.
-
Bug 27585 - Extraneous "the" in description of wrapKey w3c/webcrypto#57, by @mwatson2.
-
Bug 27584 - Wording: "subtlecrypto methods" --> "SubtleCrypto methods" w3c/webcrypto#56, by @mwatson2.
-
Bug 27580 - "case sensitive" --> "case insensitive" w3c/webcrypto#54, by @mwatson2.
-
Bug 27579 - Inconsistent spelling of "[[ This Document]]" w3c/webcrypto#53, by @mwatson2.
-
Bug 27578 - Outdated reference to JWK spec w3c/webcrypto#52, by @mwatson2.
-
Bug 27577 - Remove unreferenced exceptions w3c/webcrypto#51, by @mwatson2.
-
Bug 27564 - Must conforming implementations match the order of errors? w3c/webcrypto#50, by @mwatson2.
-
Bug 27561 - Reword RTCWEB --> WebRTC? w3c/webcrypto#47, by @mwatson2.
-
Bug 27560 - Remove reference to "events" in the introduction w3c/webcrypto#46, by @mwatson2.
-
Bug 27506 - Inconsistent error for AES-CTR's "get key length" operation w3c/webcrypto#45, by @mwatson2.
-
Bug 27486 - RsaHashedImportParams does not extend Algorithm w3c/webcrypto#44, by @mwatson2.
-
Bug 27474 - Editorial Note from Appendix A: Additional JWK->Algorithm conversions w3c/webcrypto#43, by @mwatson2.
-
Bug 27473 - Explicit salts for the algorithm formerly known as HKDF w3c/webcrypto#42, by @mwatson2.
-
Bug 27472 - RSAHashedKeyGenParams vs. Dictionary Fields Editorial Note w3c/webcrypto#41, by @mwatson2.
-
Bug 27471 - Provide even more informative text over key wrapping? w3c/webcrypto#40, by @mwatson2.
-
Bug 27465 - Update references from X9.63 to SECG w3c/webcrypto#39, by @mwatson2.
-
Bug 27447 - Inconsistent use of "raw" format for EC keys w3c/webcrypto#36, by @mwatson2.
-
Bug 27439 - Inconsistent naming of the "Get key length" operation w3c/webcrypto#35, by @mwatson2.
-
Bug 27404 - Should check the publicKey's algorithm.name for ECDH's deriveBits()? w3c/webcrypto#33, by @mwatson2.
-
Bug 27403 - Should PBKDF2 be allowed on non-multiple of 8 lengths for consistency? w3c/webcrypto#32, by @mwatson2.
-
Bug 27374 - Please remove older Editorial Notes from spec w3c/webcrypto#30, by @mwatson2.
-
Bug 27298 - Reference IDL rather than define a "clone the data" algorithm w3c/webcrypto#29, by @mwatson2.
-
Please require a secure origin (Bug 25972) w3c/webcrypto#28, by @mwatson2.
-
Introduce HKDF as an algorithm based on RFC 5869 w3c/webcrypto#27, by @vgalindo.
-
Bug 27255 - Inconsistent handling of SPKI / PKCS#8 data between implementations w3c/webcrypto#26, by @vgalindo.
-
ECDH's deriveBits() to test "publicKey.algorithm.name == baseKey.algorithm.name" w3c/webcrypto#25, by @vgalindo.
-
Bug 29545 from bugzilla - ECDSA 'alg' names for JWK: ES512 vs ES521 w3c/webcrypto#24, by @vgalindo.
-
Remove the generate key operation for PBKDF2 w3c/webcrypto#23, by @vgalindo.
-
Possible inconsistency in crypto.subtle.generateKey errors w3c/webcrypto#22, by @engelke.
-
-
29 issues closed.
-
Bug 29139 - Allow specifying numbers in place of BigInteger? w3c/webcrypto#83.
-
Bug 27439 - Inconsistent naming of the "Get key length" operation w3c/webcrypto#35.
-
Fix WebIDL indentation w3c/webcrypto#94.
-
Bug 29539 - Invalid algorithm OID for ECDH w3c/webcrypto#86.
-
Bug 27946 - getRandomValues should mention Uint8ClampedArray w3c/webcrypto#80.
-
Bug 27773 - Clarification of unwrapKey method parameters w3c/webcrypto#75.
-
Bug 27689 - Is PBKDF2's generateKey() UI step worthwhile? w3c/webcrypto#71.
-
Bug 27621 - Inconsistent name for getLength operation w3c/webcrypto#68.
-
Bug 27586 - Incorrect link to "decrypt" w3c/webcrypto#58.
-
Bug 27578 - Outdated reference to JWK spec w3c/webcrypto#52.
-
Bug 27560 - Remove reference to "events" in the introduction w3c/webcrypto#46.
-
Bug 27585 - Extraneous "the" in description of wrapKey w3c/webcrypto#57.
-
Bug 27622 - Typo: "Import key" -> "importKey" in section 34.2, 35.2 w3c/webcrypto#69.
-
Bug 27561 - Reword RTCWEB --> WebRTC? w3c/webcrypto#47.
-
Bug 27577 - Remove unreferenced exceptions w3c/webcrypto#51.
-
Bug 27579 - Inconsistent spelling of "[[ This Document]]" w3c/webcrypto#53.
-
Bug 27580 - "case sensitive" --> "case insensitive" w3c/webcrypto#54.
-
Bug 27584 - Wording: "subtlecrypto methods" --> "SubtleCrypto methods" w3c/webcrypto#56.
-
Bug 27685 - References link to PKCS3 is broken w3c/webcrypto#70.
-
Bug 27600 - Inconsistent formatting (indentation) of WebIDL blocks w3c/webcrypto#63.
-
Bug 27588 - Typo "myst" --> "must" w3c/webcrypto#60.
-
Update front page boilerplate with GitHub URLs w3c/webcrypto#89.
-
ECDH and ECDSA using wrong JWK algorithm - s/ES521/ES512/ w3c/webcrypto#18.
-
-
1 issue reopened.
-
Bug 27578 - Outdated reference to JWK spec w3c/webcrypto#52, by @mwatson2.
-
-
48 issues received 100 new comments.
-
Bug 29437 - Parsing a JWK can have side-effects if not done very carefully w3c/webcrypto#87 (7 comments by @bzbarsky, @mwatson2)
-
Bug 27598 - Clarification: Can NotSupportedError be thrown in places where the spec uses an OperationError? w3c/webcrypto#62 (6 comments by @jimsch, @mwatson2)
-
Bug 27774 - The KDFs either shouldn't allow importing extractable keys, or should support exportKey() w3c/webcrypto#76 (5 comments by @jimsch, @mwatson2, @sleevi)
-
Bug 27564 - Must conforming implementations match the order of errors? w3c/webcrypto#50 (4 comments by @jimsch, @mwatson2)
-
Bug 29514 - Need to define which globals objects created by this spec are associated with w3c/webcrypto#85 (4 comments by @annevk, @bzbarsky, @mwatson2)
-
Bug 27717 - Require RSA key import to validate the key parameters w3c/webcrypto#72 (4 comments by @jimsch, @mwatson2)
-
Bug 27814 - Section A.2 - the usage mapping of "enc" is incorrect w3c/webcrypto#77 (3 comments by @jimsch, @mwatson2)
-
Bug 27591 - Must the reflected "publicExponent" for generated RSA keys exactly match input? w3c/webcrypto#61 (3 comments by @jimsch, @mwatson2)
-
Bug 27298 - Reference IDL rather than define a "clone the data" algorithm w3c/webcrypto#29 (3 comments by @annevk, @mwatson2)
-
Bug 29359 - Make the "exceptions" section clearer w3c/webcrypto#84 (2 comments by @mwatson2, @wseltzer)
-
Bug 27587 - Section 19, Algorithm Overview, does not mention verify() or deriveBits() methods w3c/webcrypto#59 (2 comments by @mwatson2, @wseltzer)
-
Bug 27506 - Inconsistent error for AES-CTR's "get key length" operation w3c/webcrypto#45 (2 comments by @jimsch, @mwatson2)
-
Bug 29139 - Allow specifying numbers in place of BigInteger? w3c/webcrypto#83 (2 comments by @jimsch, @mwatson2)
-
Bug 29438 - JSON.stringify as invoked by wrapKey can have side-effects depending on what you pass it w3c/webcrypto#88 (2 comments by @bzbarsky, @mwatson2)
-
Bug 27603 - verify() can fail either by returning flase or rejecting with an error, inconsistent which is used w3c/webcrypto#66 (2 comments by @mwatson2)
-
Bug 27602 - ECDSA's Sign operation is not explicit about how r and s are concatenated (padding) w3c/webcrypto#65 (2 comments by @mwatson2)
-
Bug 27601 - Inconsistent enforcement of JWK's "use" versus "key_ops" during public key import w3c/webcrypto#64 (2 comments by @mwatson2)
-
Bug 27560 - Remove reference to "events" in the introduction w3c/webcrypto#46 (2 comments by @mwatson2)
-
Bug 27473 - Explicit salts for the algorithm formerly known as HKDF w3c/webcrypto#42 (2 comments by @mwatson2)
-
Bug 27472 - RSAHashedKeyGenParams vs. Dictionary Fields Editorial Note w3c/webcrypto#41 (2 comments by @mwatson2)
-
Possible inconsistency in crypto.subtle.generateKey errors w3c/webcrypto#22 (2 comments by @engelke, @mwatson2)
-
Change return value for unsupported crv to be NotSupportedError rather than DataError w3c/webcrypto#20 (2 comments by @mwatson2)
-
Bug 27474 - Editorial Note from Appendix A: Additional JWK->Algorithm conversions w3c/webcrypto#43 (1 comment by @jimsch)
-
Bug 27771 - Should HKDF's derive bits operation throw OperationError if length is null? w3c/webcrypto#74 (1 comment by @mwatson2)
-
Bug 27581 - Wording: Algorithm names must be unique when compared case-insensitively w3c/webcrypto#55 (1 comment by @mwatson2)
-
Bug 27562 - Odd wording of section "2.7. Javascript Object Signing and Encryption (JOSE)" w3c/webcrypto#48 (1 comment by @mwatson2)
-
Bug 27486 - RsaHashedImportParams does not extend Algorithm w3c/webcrypto#44 (1 comment by @mwatson2)
-
Bug 27448 - HmacImportParams having a non-required hash is inconsistent with other algorithms w3c/webcrypto#37 (1 comment by @mwatson2)
-
Bug 27404 - Should check the publicKey's algorithm.name for ECDH's deriveBits()? w3c/webcrypto#33 (1 comment by @mwatson2)
-
Bug 27402 - Specify the behavior when returning an octet string with a particular _bit_ length w3c/webcrypto#31 (1 comment by @mwatson2)
-
Bug 29545 from bugzilla - ECDSA 'alg' names for JWK: ES512 vs ES521 w3c/webcrypto#24 (1 comment by @mwatson2)
-
Clean up left over pieces of change of JWK from string to object w3c/webcrypto#21 (1 comment by @mwatson2)
-
Bug 27600 - Inconsistent formatting (indentation) of WebIDL blocks w3c/webcrypto#63 (1 comment by @mwatson2)
-
Bug 27946 - getRandomValues should mention Uint8ClampedArray w3c/webcrypto#80 (1 comment by @jimsch)
-
Bug 27439 - Inconsistent naming of the "Get key length" operation w3c/webcrypto#35 (1 comment by @mwatson2)
-
15 pull requests opened.
-
Fix #74: Throw an OperationError in HKDF derive bits if length is null w3c/webcrypto#105, by @mwatson2.
-
Fix #72: Validate RSA keys according to RFC3447 on import w3c/webcrypto#104, by @mwatson2.
-
Fix #67: Remove section 4.3 (Operations) w3c/webcrypto#103, by @mwatson2.
-
Fix #66: Allow ECDSA sign/verify to throw an OperationError w3c/webcrypto#102, by @mwatson2.
-
Fix #65: Specify how ECDSA signature results are concatenated w3c/webcrypto#101, by @mwatson2.
-
Fix #64: Ignore 'use' field in JWK import with empty usages w3c/webcrypto#100, by @mwatson2.
-
Fix #59: Add importKey, exportKey and deriveBits to Section 19 w3c/webcrypto#99, by @mwatson2.
-
Fix #44: RsaHashedImportParams should be derived from Algorithm w3c/webcrypto#98, by @mwatson2.
-
Fix #37: Require hash to be specified for HMAC ImportKey w3c/webcrypto#97, by @mwatson2.
-
Fix #36: Provide raw inport / export for ECDSA w3c/webcrypto#96, by @mwatson2.
-
Fix #31: Pad bit string with zeros when returned as octets w3c/webcrypto#95, by @mwatson2.
-
Fix #25: Check for algorithm name match between keys on ECDH deriveBits w3c/webcrypto#93, by @mwatson2.
-
Fix #24: s/ES521/ES512/ w3c/webcrypto#92, by @mwatson2.
-
Fix #23: Remove generateKey for PBKDF2 w3c/webcrypto#91, by @mwatson2.
-
Fix #21: Clarify handling of JWK keyData in Import Key operations w3c/webcrypto#90, by @mwatson2.
-
-
1 pull request merged.
-
Fix #35: Change "get length" to "get key length" in all locations w3c/webcrypto#15.
-
-
2 pull requests received 5 new comments.
-
Fix #74: Throw an OperationError in HKDF derive bits if length is null w3c/webcrypto#105 (1 comment by @liliakai)
w3c/webappsec-suborigins
-
4 issues opened.
-
<meta http-equiv="Set-Cookie" content="..."> should be ignored w3c/webappsec-suborigins#36, by @bsittler.
-
document.suborigin or something should allow JS to detect if in suborigin w3c/webappsec-suborigins#35, by @devd.
-
How to treat localStorage and sessionStorage w3c/webappsec-suborigins#34, by @joelweinberger.
-
Default to withCredentials=true for CORS requests w3c/webappsec-suborigins#33, by @arturjanc.
-
-
4 issues received 28 new comments.
-
Default to withCredentials=true for CORS requests w3c/webappsec-suborigins#33 (16 comments by @annevk, @arturjanc, @devd, @joelweinberger, @mikewest)
-
How to treat localStorage and sessionStorage w3c/webappsec-suborigins#34 (8 comments by @annevk, @arturjanc, @devd, @joelweinberger, @mitar)
-
document.suborigin or something should allow JS to detect if in suborigin w3c/webappsec-suborigins#35 (3 comments by @annevk, @devd)
-
-
1 pull request opened.
-
Basic cookie-averse definition w3c/webappsec-suborigins#37, by @joelweinberger.
-
-
1 pull request merged.
-
Basic cookie-averse definition w3c/webappsec-suborigins#37.
-
w3c/webappsec
-
1 issue closed.
-
[CSP] path-part should be represented by path-abempty w3c/webappsec#361.
-
-
2 issues received 3 new comments.
-
[CSP] Enforcing CSP for Service Workers w3c/webappsec#350 (2 comments by @jonathanKingston, @mikewest)
-
w3c/webappsec-csp
-
5 issues opened.
-
Clarify the target for `SecurityPolicyViolationEvent` w3c/webappsec-csp#90, by @shekyan.
-
path-part should be represented by path-abempty w3c/webappsec-csp#89, by @shekyan.
-
Allow dynamically enabling/disabling nonce as a source w3c/webappsec-csp#88, by @devd.
-
Allow dynamically enabling/disabling unsafe-eval w3c/webappsec-csp#87, by @devd.
-
CSP Violation Reports for redirects should include full original URI and origins in the redirect URIs w3c/webappsec-csp#86, by @devd.
-
-
3 issues received 12 new comments.
-
Clarify the target for `SecurityPolicyViolationEvent` w3c/webappsec-csp#90 (6 comments by @annevk, @mikewest, @shekyan)
-
path-part should be represented by path-abempty w3c/webappsec-csp#89 (4 comments by @annevk, @mikewest, @shekyan)
-
Consider applying both `child-src` and `script-src` to workers. w3c/webappsec-csp#31 (2 comments by @arturjanc)
-
-
3 pull requests opened.
-
Block all non sri resources 2 w3c/webappsec-csp#85, by @shekyan.
-
Add missing request destination for request type "script" w3c/webappsec-csp#84, by @shekyan.
-
Minor grammar fixes in 'unsafe-dynamic'. w3c/webappsec-csp#83, by @mikispag.
-
-
3 pull requests merged.
-
Add missing request destination for request type "script" w3c/webappsec-csp#84.
-
Fix up the logic in source list matching w3c/webappsec-csp#74.
-
Minor grammar fixes in 'unsafe-dynamic'. w3c/webappsec-csp#83.
-
-
2 pull requests closed.
-
Block all non sri resources 2 w3c/webappsec-csp#85.
-
Block all non sri resources w3c/webappsec-csp#64.
-
-
6 pull requests received 20 new comments.
-
Block all non sri resources 2 w3c/webappsec-csp#85 (11 comments by @fmarier, @joelweinberger, @mikewest, @shekyan)
-
Make the example for multiple policies a little clearer w3c/webappsec-csp#76 (3 comments by @april, @mikewest)
-
Fix up the logic in source list matching w3c/webappsec-csp#74 (3 comments by @michaelficarra, @mikewest)
-
Add missing request destination for request type "script" w3c/webappsec-csp#84 (1 comment by @mikewest)
-
w3c/webappsec-cowl
-
7 issues opened.
-
Overly conservative check in step 8.4 of Algorithm 4.9 w3c/webappsec-cowl#66, by @deian.
-
Specify how COWL deals with WebRTC w3c/webappsec-cowl#65, by @deian.
-
Extend for Server-Sent Events w3c/webappsec-cowl#64, by @NAndreasson.
-
Set top-level navigation sandbox flag w3c/webappsec-cowl#63, by @NAndreasson.
-
Leaks via DNS prefetching w3c/webappsec-cowl#62, by @deian.
-
Specify how COWL deals with websockets w3c/webappsec-cowl#61, by @deian.
-
iFrame resizing as covert channel w3c/webappsec-cowl#60, by @NAndreasson.
-
-
9 issues closed.
-
Set top-level navigation sandbox flag w3c/webappsec-cowl#63.
-
Overly conservative check in step 8.4 of Algorithm 4.9 w3c/webappsec-cowl#66.
-
Specify how COWL integrates with ServiceWorkers w3c/webappsec-cowl#36.
-
Specify how to deal with notifications w3c/webappsec-cowl#41.
-
Specify how to deal with permissions w3c/webappsec-cowl#42.
-
Specify how COWL deals with push w3c/webappsec-cowl#37.
-
Clarify why both labeled data and labeled context directives are needed w3c/webappsec-cowl#55.
-
Add sandboxed auxiliary navigation flag for confinement w3c/webappsec-cowl#58.
-
Fix wording for structured cloning of privileges w3c/webappsec-cowl#59.
-
-
1 issue reopened.
-
Specify how COWL deals with websockets w3c/webappsec-cowl#61, by @deian.
-
-
6 issues received 11 new comments.
-
Fix receiving labeled objects in XHR extension w3c/webappsec-cowl#57 (3 comments by @annevk, @deian)
-
Clarify why both labeled data and labeled context directives are needed w3c/webappsec-cowl#55 (2 comments by @deian)
-
w3c/webappsec-upgrade-insecure-requests
-
2 issues opened.
-
Upstream relevant bits and pieces to HTML. w3c/webappsec-upgrade-insecure-requests#5, by @mikewest.
-
Upgrade frames? w3c/webappsec-upgrade-insecure-requests#4, by @mikewest.
-
-
1 issue closed.
-
Upgrade frames? w3c/webappsec-upgrade-insecure-requests#4.
-
-
2 issues received 3 new comments.
-
Upstream relevant bits and pieces to HTML. w3c/webappsec-upgrade-insecure-requests#5 (1 comment by @mikewest)
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Consider whether sandboxed content should automatically be a secure context w3c/webappsec-secure-contexts#28, by @jwatt.
-
-
1 issue received 1 new comment.
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26 (1 comment by @mikewest)
-
TR publications
-
4 documents published.
-
Secure Contexts published twice as a Working Draft. History of Secure Contexts
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
GitHub
w3c/webappsec-referrer-policy
-
11 issues opened.
-
HTML integration plan w3c/webappsec-referrer-policy#43, by @domenic.
-
Define HTML integration for referrerpolicy attributes w3c/webappsec-referrer-policy#40, by @estark37.
-
Use concept-request in algorithms w3c/webappsec-referrer-policy#39, by @estark37.
-
Clarify that the referrer policy does not affect CSP reports... w3c/webappsec-referrer-policy#38, by @jeisinger.
-
Should the referrerPolicy attribute be part of the "relevant mutations" for HTMLImageElement? w3c/webappsec-referrer-policy#33, by @jdm.
-
Verbiage about creating nested browsing contexts for particular URLs does not make sense w3c/webappsec-referrer-policy#32, by @bzbarsky.
-
Srcdoc referrer policies don't interact well with <meta referrer> w3c/webappsec-referrer-policy#31, by @bzbarsky.
-
Please work with the HTML spec to not monkeypatch browsing context creation w3c/webappsec-referrer-policy#30, by @bzbarsky.
-
Use of "active document" in determining the referrer looks wrong w3c/webappsec-referrer-policy#29, by @bzbarsky.
-
"a priori insecure origin" definition is missing w3c/webappsec-referrer-policy#28, by @jdm.
-
Add appropriate [CEReactions] annotation w3c/webappsec-referrer-policy#27, by @domenic.
-
-
6 issues closed.
-
Clarify that the referrer policy does not affect CSP reports... w3c/webappsec-referrer-policy#38.
-
Should the referrerPolicy attribute be part of the "relevant mutations" for HTMLImageElement? w3c/webappsec-referrer-policy#33.
-
"a priori insecure origin" definition is missing w3c/webappsec-referrer-policy#28.
-
Dynamically inserted \<meta name="referrer"\> may slow down speculative loadings w3c/webappsec-referrer-policy#25.
-
Consider using a dedicated header instead of CSP for referrer policy delivery w3c/webappsec-referrer-policy#6.
-
null -> "the empty string" w3c/webappsec-referrer-policy#21.
-
-
8 issues received 13 new comments.
-
Please work with the HTML spec to not monkeypatch browsing context creation w3c/webappsec-referrer-policy#30 (4 comments by @annevk, @bzbarsky, @domenic, @mikewest)
-
Add appropriate [CEReactions] annotation w3c/webappsec-referrer-policy#27 (2 comments by @domenic, @jeisinger)
-
"determine request's referrer" algorithm should consult request's referrer policy w3c/webappsec-referrer-policy#26 (1 comment by @domenic)
-
Clarify that the referrer policy does not affect CSP reports... w3c/webappsec-referrer-policy#38 (1 comment by @estark37)
-
Dynamically inserted \<meta name="referrer"\> may slow down speculative loadings w3c/webappsec-referrer-policy#25 (1 comment by @jeisinger)
-
Should the referrerPolicy attribute be part of the "relevant mutations" for HTMLImageElement? w3c/webappsec-referrer-policy#33 (1 comment by @annevk)
-
Consider using a dedicated header instead of CSP for referrer policy delivery w3c/webappsec-referrer-policy#6 (1 comment by @estark37)
-
-
6 pull requests opened.
-
Integrate with HTML, part 1 of n w3c/webappsec-referrer-policy#42, by @domenic.
-
Clarify that controlling the referrer isn't enough to stop capability URLs to leak w3c/webappsec-referrer-policy#41, by @jeisinger.
-
Update referenes to MIXED to match new language w3c/webappsec-referrer-policy#37, by @jeisinger.
-
Rewrite Fetch integration, especially around redirects w3c/webappsec-referrer-policy#36, by @estark37.
-
Clarify that modifying img.referrerPolicy is not a relevant mutation w3c/webappsec-referrer-policy#35, by @jeisinger.
-
Add a paragraph talking about how to integrate with CSS w3c/webappsec-referrer-policy#34, by @jeisinger.
-
-
5 pull requests merged.
-
Clarify that controlling the referrer isn't enough to stop capability URLs to leak w3c/webappsec-referrer-policy#41.
-
Rewrite Fetch integration, especially around redirects w3c/webappsec-referrer-policy#36.
-
Clarify that modifying img.referrerPolicy is not a relevant mutation w3c/webappsec-referrer-policy#35.
-
Update referenes to MIXED to match new language w3c/webappsec-referrer-policy#37.
-
Consistency fixes w3c/webappsec-referrer-policy#16.
-
-
1 pull request closed.
-
Add a paragraph talking about how to integrate with CSS w3c/webappsec-referrer-policy#34.
-
-
7 pull requests received 50 new comments.
-
Clarify that modifying img.referrerPolicy is not a relevant mutation w3c/webappsec-referrer-policy#35 (17 comments by @annevk, @jeisinger, @tungnh28, @yoavweiss, @zcorpan)
-
Add a paragraph talking about how to integrate with CSS w3c/webappsec-referrer-policy#34 (11 comments by @annevk, @jeisinger, @tabatkins)
-
Rewrite Fetch integration, especially around redirects w3c/webappsec-referrer-policy#36 (10 comments by @annevk, @estark37, @jeisinger, @yutakahirano)
-
Update referenes to MIXED to match new language w3c/webappsec-referrer-policy#37 (6 comments by @estark37, @mikewest)
-
Add referrerpolicy attribute on link elements w3c/webappsec-referrer-policy#22 (3 comments by @foolip, @jeisinger)
-
Clarify that controlling the referrer isn't enough to stop capability URLs to leak w3c/webappsec-referrer-policy#41 (1 comment by @estark37)
-
w3c/permissions
-
13 issues opened.
-
Separate "request access" from "request permission"? w3c/permissions#94, by @alvestrand.
-
Requesting permission shouldn't imply storing it. w3c/permissions#93, by @alvestrand.
-
Requesting permissions needs to be able to ask for multiple things w3c/permissions#92, by @alvestrand.
-
Specify how request and revoke work on push and midi permissions. w3c/permissions#90, by @jyasskin.
-
Switch to having TravisCI build the spec w3c/permissions#89, by @jyasskin.
-
Model temporary permissions better w3c/permissions#86, by @jyasskin.
-
Permission API has terminology issues one could drive a truck through. w3c/permissions#85, by @jan-ivar.
-
Why is "retrieve the permission storage" not in "Permission store"? w3c/permissions#84, by @g-ortuno.
-
Drop .request() w3c/permissions#83, by @martinthomson.
-
Don't assume implicit grant from getUserMedia. w3c/permissions#78, by @jan-ivar.
-
Only allow permissions.request() during user interaction w3c/permissions#77, by @mnoorenberghe.
-
Support minimizable request UI with permissions.request() w3c/permissions#76, by @mnoorenberghe.
-
Review of jyasskin's draft w3c/permissions#74, by @annevk.
-
-
3 issues closed.
-
Requesting permission shouldn't imply storing it. w3c/permissions#93.
-
Switch to having TravisCI build the spec w3c/permissions#89.
-
Add permissions.request() w3c/permissions#41.
-
-
15 issues received 122 new comments.
-
Model temporary permissions better w3c/permissions#86 (21 comments by @alvestrand, @annevk, @jan-ivar, @jyasskin, @raymeskhoury)
-
Requesting permission shouldn't imply storing it. w3c/permissions#93 (15 comments by @alvestrand, @jan-ivar, @jyasskin, @mounirlamouri)
-
Drop .request() w3c/permissions#83 (15 comments by @alvestrand, @jan-ivar, @jimmywarting, @jyasskin, @martinthomson, @slightlyoff)
-
Requesting permissions needs to be able to ask for multiple things w3c/permissions#92 (12 comments by @alvestrand, @jan-ivar, @jyasskin, @mounirlamouri, @raymeskhoury)
-
Consider removing Permissions.revoke(). w3c/permissions#46 (12 comments by @jan-ivar, @jyasskin, @martinthomson, @mounirlamouri, @npdoty, @raymeskhoury)
-
Support minimizable request UI with permissions.request() w3c/permissions#76 (11 comments by @jan-ivar, @jyasskin, @marcoscaceres, @mnoorenberghe, @mounirlamouri)
-
Only allow permissions.request() during user interaction w3c/permissions#77 (11 comments by @adrifelt, @annevk, @jyasskin, @mnoorenberghe, @mounirlamouri, @raymeskhoury)
-
Permission API has terminology issues one could drive a truck through. w3c/permissions#85 (6 comments by @jan-ivar, @jyasskin)
-
Don't assume implicit grant from getUserMedia. w3c/permissions#78 (6 comments by @alvestrand, @jyasskin, @mounirlamouri, @raymeskhoury)
-
Switch to having TravisCI build the spec w3c/permissions#89 (3 comments by @jyasskin, @mounirlamouri)
-
Why is "retrieve the permission storage" not in "Permission store"? w3c/permissions#84 (1 comment by @jyasskin)
-
-
9 pull requests opened.
-
Allow UAs to maintain zero or multiple permission stores. w3c/permissions#95, by @jyasskin.
-
Define an algorithm to update the permission storage. w3c/permissions#91, by @jyasskin.
-
Add the "bluetooth" permission, linked to [web-bluetooth]. w3c/permissions#88, by @jyasskin.
-
Retitle the Permissions spec to emphasize the infrastructure more. w3c/permissions#87, by @jyasskin.
-
Rename PermissionStatus to PermissionResult. w3c/permissions#82, by @jyasskin.
-
Rename the "associated PermissionDescriptor" to the "permission descriptor type". w3c/permissions#81, by @jyasskin.
-
Export dfn-type definitions that other specs should be able to use. w3c/permissions#80, by @jyasskin.
-
Convert to Bikeshed w3c/permissions#75, by @jyasskin.
-
-
9 pull requests merged.
-
Add the "bluetooth" permission, linked to [web-bluetooth]. w3c/permissions#88.
-
Retitle the Permissions spec to emphasize the infrastructure more. w3c/permissions#87.
-
Export dfn-type definitions that other specs should be able to use. w3c/permissions#80.
-
Convert to Bikeshed w3c/permissions#75.
-
Define a PermissionStorage type for each permission to store data with. w3c/permissions#73.
-
Let each permission refine its algorithms and store data. w3c/permissions#66.
-
Run Tidy and fix ReSpec errors. w3c/permissions#69.
-
-
1 pull request closed.
-
Rename PermissionStatus to PermissionResult. w3c/permissions#82.
-
-
1 pull request reopened.
-
Rename PermissionStatus to PermissionResult. w3c/permissions#82, by @mounirlamouri.
-
-
10 pull requests received 49 new comments.
-
Allow UAs to maintain zero or multiple permission stores. w3c/permissions#95 (16 comments by @annevk, @jan-ivar, @jyasskin, @martinthomson)
-
Define an algorithm to update the permission storage. w3c/permissions#91 (10 comments by @annevk, @jyasskin, @lgarron)
-
Retitle the Permissions spec to emphasize the infrastructure more. w3c/permissions#87 (9 comments by @jan-ivar, @jyasskin, @marcoscaceres, @martinthomson, @mounirlamouri)
-
Remove the incorrect paragraph about request() and revoke() having been removed from the spec. w3c/permissions#79 (4 comments by @jan-ivar, @jyasskin, @marcoscaceres)
-
Rename PermissionStatus to PermissionResult. w3c/permissions#82 (2 comments by @jyasskin, @mounirlamouri)
-
Add the "bluetooth" permission, linked to [web-bluetooth]. w3c/permissions#88 (1 comment by @annevk)
-
Rename the "associated PermissionDescriptor" to the "permission descriptor type". w3c/permissions#81 (1 comment by @mounirlamouri)
-
Export dfn-type definitions that other specs should be able to use. w3c/permissions#80 (1 comment by @marcoscaceres)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Allow `http://127.0.0.1`. w3c/webappsec-mixed-content#4, by @mikewest.
-
-
1 issue closed.
-
Editing broke document w3c/webappsec-mixed-content#3.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Carve out `http://127.0.0.1` from mixed content checks. w3c/webappsec-mixed-content#5, by @mikewest.
-
w3c/webappsec-cowl
-
4 issues opened.
-
Fix wording for structured cloning of privileges w3c/webappsec-cowl#59, by @deian.
-
Add sandboxed auxiliary navigation flag for confinement w3c/webappsec-cowl#58, by @NAndreasson.
-
Fix receiving labeled objects in XHR extension w3c/webappsec-cowl#57, by @NAndreasson.
-
Extend Fetch API for labeled objects w3c/webappsec-cowl#56, by @NAndreasson.
-
-
6 issues closed.
-
Clarify algorithm for serialization of labels w3c/webappsec-cowl#53.
-
Make LabedObject label optional w3c/webappsec-cowl#52.
-
LabeledObject specification w3c/webappsec-cowl#49.
-
Motivate why top-level contexts shouldn't get stuck w3c/webappsec-cowl#46.
-
Potential addition to context tainting algorithm w3c/webappsec-cowl#48.
-
Should top-level pages be able to navigate arbitrarily? w3c/webappsec-cowl#44.
-
-
1 issue received 1 new comment.
w3c/webappsec-csp
-
9 issues opened.
-
Inline scripting violation: add a script-sample property to the report payload w3c/webappsec-csp#81, by @romainneutron.
-
Allow `hash-source` expressions match integrity metadata for external scripts. w3c/webappsec-csp#78, by @mikewest.
-
Nested browsing context navigation to non-network schemes w3c/webappsec-csp#77, by @shekyan.
-
Allow IP or range of IPs ? w3c/webappsec-csp#75, by @nico3333fr.
-
Note somewhere that redirects are covered by fetch directives. w3c/webappsec-csp#72, by @mikewest.
-
Add `'unsafe-dynamic'` w3c/webappsec-csp#70, by @mikewest.
-
Consider treating non-special schemes like local schemes w3c/webappsec-csp#69, by @shekyan.
-
Block `setAttribute('onload', 'code code code')` on `'unsafe-eval'` w3c/webappsec-csp#67, by @mikewest.
-
Consider not exposing nonce="" to the page w3c/webappsec-csp#65, by @annevk.
-
-
3 issues closed.
-
Add `'unsafe-dynamic'` w3c/webappsec-csp#70.
-
Inline event handlers not whitelisted by hashes? w3c/webappsec-csp#13.
-
-
9 issues received 38 new comments.
-
Consider treating non-special schemes like local schemes w3c/webappsec-csp#69 (12 comments by @annevk, @hillbrad, @michaelficarra, @mikewest, @shekyan)
-
Allow `hash-source` expressions match integrity metadata for external scripts. w3c/webappsec-csp#78 (4 comments by @devd, @mikewest)
-
Further granularity of unsafe-inline styles w3c/webappsec-csp#45 (3 comments by @april, @jonathanKingston, @michaelficarra)
-
Nested browsing context navigation to non-network schemes w3c/webappsec-csp#77 (2 comments by @mikewest, @shekyan)
-
Please clarify which text encoding should be used to compute the hash value of inline script/style w3c/webappsec-csp#40 (2 comments by @duanyao, @mikewest)
-
Consider enforcing default port if expression matches only scheme-source grammar w3c/webappsec-csp#41 (1 comment by @shekyan)
-
-
9 pull requests opened.
-
Fix typo in CSP3 spec w3c/webappsec-csp#82, by @romainneutron.
-
A note clarifying "'unsafe-inline'" redundancy if hash/nonce present w3c/webappsec-csp#80, by @shekyan.
-
Fix typo in `style-src` definition w3c/webappsec-csp#79, by @shekyan.
-
Make the example for multiple policies a little clearer w3c/webappsec-csp#76, by @april.
-
Fix up the logic in source list matching w3c/webappsec-csp#74, by @shekyan.
-
Change `scheme-source` grammar w3c/webappsec-csp#73, by @shekyan.
-
change to expression matching algorithm w3c/webappsec-csp#71, by @shekyan.
-
Fixing a typo in Element Matching Algorithms w3c/webappsec-csp#68, by @shekyan.
-
Implement 'HostEnsureCanCompileStrings'. w3c/webappsec-csp#66, by @mikewest.
-
-
8 pull requests merged.
-
Update references to w3c.org to use HTTPS w3c/webappsec-csp#63.
-
Fix typo in CSP3 spec w3c/webappsec-csp#82.
-
A note clarifying "'unsafe-inline'" redundancy if hash/nonce present w3c/webappsec-csp#80.
-
Fix typo in `style-src` definition w3c/webappsec-csp#79.
-
Change `scheme-source` grammar w3c/webappsec-csp#73.
-
change to expression matching algorithm w3c/webappsec-csp#71.
-
Fixing a typo in Element Matching Algorithms w3c/webappsec-csp#68.
-
Implement 'HostEnsureCanCompileStrings'. w3c/webappsec-csp#66.
-
-
11 pull requests received 60 new comments.
-
Block all non sri resources w3c/webappsec-csp#64 (6 comments by @mikewest, @mozfreddyb, @oreoshake, @shekyan)
-
Implement 'HostEnsureCanCompileStrings'. w3c/webappsec-csp#66 (6 comments by @domenic, @mikewest, @wseltzer)
-
A note clarifying "'unsafe-inline'" redundancy if hash/nonce present w3c/webappsec-csp#80 (4 comments by @mikewest, @shekyan)
-
Make the example for multiple policies a little clearer w3c/webappsec-csp#76 (3 comments by @mikewest, @wseltzer)
w3c/webappsec-secure-contexts
-
4 issues opened.
-
For sandboxed content, allow UAs to use the origin that would have been used if not sandboxed w3c/webappsec-secure-contexts#27, by @jwatt.
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26, by @jwatt.
-
Respec reference database still lists this as "POWERFUL-FEATURES" w3c/webappsec-secure-contexts#25, by @mwatson2.
-
webappsec-secure-contexts w3c/webappsec-secure-contexts#24, by @m0ct3zum4.
-
-
5 issues closed.
-
Respec reference database still lists this as "POWERFUL-FEATURES" w3c/webappsec-secure-contexts#25.
-
webappsec-secure-contexts w3c/webappsec-secure-contexts#24.
-
Clarification of changes to WebIDL w3c/webappsec-secure-contexts#16.
-
Behavior of accessing properties in non-secure contexts w3c/webappsec-secure-contexts#8.
-
"Is origin potentially trustworthy" algorithm assumes origins have scheme and host components w3c/webappsec-secure-contexts#4.
-
-
1 issue reopened.
-
Respec reference database still lists this as "POWERFUL-FEATURES" w3c/webappsec-secure-contexts#25, by @mikewest.
-
-
6 issues received 32 new comments.
-
Respec reference database still lists this as "POWERFUL-FEATURES" w3c/webappsec-secure-contexts#25 (21 comments by @mikewest, @sideshowbarker, @tabatkins, @tobie, @wseltzer)
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26 (6 comments by @annevk, @bzbarsky, @jwatt, @mikewest)
-
For sandboxed content, allow UAs to use the origin that would have been used if not sandboxed w3c/webappsec-secure-contexts#27 (2 comments by @annevk, @jwatt)
-
SecureContext on attributes produces prototype mutations during realm creation w3c/webappsec-secure-contexts#23 (1 comment by @mikewest)
-
"Is origin potentially trustworthy" algorithm assumes origins have scheme and host components w3c/webappsec-secure-contexts#4 (1 comment by @bzbarsky)
-
w3c/webcrypto
-
2 issues opened.
-
Clean up left over pieces of change of JWK from string to object w3c/webcrypto#21, by @jimsch.
-
Change return value for unsupported crv to be NotSupportedError rather than DataError w3c/webcrypto#20, by @jimsch.
-
-
1 issue received 5 new comments.
-
Change return value for unsupported crv to be NotSupportedError rather than DataError w3c/webcrypto#20 (5 comments by @jimsch, @sleevi)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Upstream the `integrity` attribute to HTML. w3c/webappsec-subresource-integrity#31, by @mikewest.
-
-
2 issues received 11 new comments.
-
Upstream the `integrity` attribute to HTML. w3c/webappsec-subresource-integrity#31 (6 comments by @annevk, @domenic, @fmarier, @mikewest, @mozfreddyb)
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (5 comments by @btrask, @joelweinberger, @mozfreddyb)
-
w3c/webappsec-suborigins
-
1 pull request opened.
-
Fix typo In -> If w3c/webappsec-suborigins#32, by @adob.
-
-
1 pull request merged.
-
Fix typo In -> If w3c/webappsec-suborigins#32.
-
w3c/webappsec
-
3 issues opened.
-
CSP3: The effect of multiple policies w3c/webappsec#515, by @april.
-
CSP2: Default value of default-src is incorrect w3c/webappsec#514, by @april.
-
CSP: Consider dot-prefix domains for wildcard matching w3c/webappsec#513, by @007.
-
-
2 issues received 14 new comments.
-
CSP2: Default value of default-src is incorrect w3c/webappsec#514 (11 comments by @april, @hillbrad, @mikewest)
-
-
2 pull requests opened.
-
Fix Broken Link for Credential Management L1 TR w3c/webappsec#516, by @JamesMilazzo.
-
Update csp impl report w3c/webappsec#512, by @hillbrad.
-
-
2 pull requests merged.
-
Fix Broken Link for Credential Management L1 TR w3c/webappsec#516.
-
Update csp impl report w3c/webappsec#512.
-
-
2 pull requests received 3 new comments.
w3c/webappsec-credential-management
-
1 issue opened.
-
`SiteBoundCredential::name` should be `DOMString`. w3c/webappsec-credential-management#14, by @mikewest.
-
-
1 issue closed.
-
`SiteBoundCredential::name` should be `DOMString`. w3c/webappsec-credential-management#14.
-
-
2 issues received 6 new comments.
-
`SiteBoundCredential::name` should be `DOMString`. w3c/webappsec-credential-management#14 (5 comments by @annevk, @mikewest)
-
unify with existing fetch credential system w3c/webappsec-credential-management#11 (1 comment by @jakearchibald)
-
Participants
-
2 organizations joined.
-
Apple Inc. joined.
-
Deutsche Telekom AG joined.
-
GitHub
w3c/permissions
-
5 issues opened.
-
Add pointerlock to the permissions enum? w3c/permissions#67, by @marcoscaceres.
-
delete plz w3c/permissions#65, by @tabatkins.
-
Add terms to Shepherd w3c/permissions#64, by @jyasskin.
-
Need information about whether a permission is persistent or temporary w3c/permissions#63, by @alvestrand.
-
Need a procedure reference for "request permission" w3c/permissions#62, by @alvestrand.
-
-
5 issues closed.
-
Need a procedure reference for "request permission" w3c/permissions#62.
-
Add 'background-sync' permission w3c/permissions#60.
-
Add getUserMedia permissions w3c/permissions#10.
-
Need information about whether a permission is persistent or temporary w3c/permissions#63.
-
delete plz w3c/permissions#65.
-
-
7 issues received 15 new comments.
-
Consider removing Permissions.revoke(). w3c/permissions#46 (5 comments by @martinthomson, @ndoty, @npdoty)
-
Need information about whether a permission is persistent or temporary w3c/permissions#63 (2 comments by @alvestrand, @KOLANICH)
-
Add pointerlock to the permissions enum? w3c/permissions#67 (2 comments by @marcoscaceres, @mounirlamouri)
-
Need a procedure reference for "request permission" w3c/permissions#62 (1 comment by @mounirlamouri)
-
-
7 pull requests opened.
-
Define a PermissionStorage type for each permission to store data with. w3c/permissions#73, by @jyasskin.
-
Make Permissions.request() only take a single descriptor. w3c/permissions#72, by @jyasskin.
-
Define the 'get a permission storage identifier' algorithm. w3c/permissions#71, by @jyasskin.
-
Name the query, request, and revoke a permission algorithms. w3c/permissions#70, by @jyasskin.
-
Run Tidy and fix ReSpec errors. w3c/permissions#69, by @jyasskin.
-
Re-entering agreed fixes to Media permissions w3c/permissions#68, by @alvestrand.
-
Let each permission refine its algorithms and store data. w3c/permissions#66, by @jyasskin.
-
-
5 pull requests merged.
-
Make Permissions.request() only take a single descriptor. w3c/permissions#72.
-
Name the query, request, and revoke a permission algorithms. w3c/permissions#70.
-
Define the 'get a permission storage identifier' algorithm. w3c/permissions#71.
-
Add background-sync permission. w3c/permissions#61.
-
Re-entering agreed fixes to Media permissions w3c/permissions#68.
-
-
8 pull requests received 62 new comments.
-
Let each permission refine its algorithms and store data. w3c/permissions#66 (31 comments by @domenic, @jyasskin, @mounirlamouri, @raymeskhoury, @tobie)
-
Name the query, request, and revoke a permission algorithms. w3c/permissions#70 (10 comments by @jyasskin, @mounirlamouri, @tobie)
-
Define a PermissionStorage type for each permission to store data with. w3c/permissions#73 (9 comments by @annevk, @jyasskin, @raymeskhoury)
-
Run Tidy and fix ReSpec errors. w3c/permissions#69 (8 comments by @dontcallmedom, @jyasskin, @marcoscaceres, @mounirlamouri)
-
Make Permissions.request() only take a single descriptor. w3c/permissions#72 (1 comment by @mounirlamouri)
-
Define the 'get a permission storage identifier' algorithm. w3c/permissions#71 (1 comment by @mounirlamouri)
-
w3c/webappsec-referrer-policy
-
3 issues opened.
-
"determine request's referrer" algorithm should consult request's referrer policy w3c/webappsec-referrer-policy#26, by @yutakahirano.
-
Dynamically inserted \<meta name="referrer"\> may slow down speculative loadings w3c/webappsec-referrer-policy#25, by @tzik.
-
Feature request: Disown window.opener w3c/webappsec-referrer-policy#23, by @hillbrad.
-
-
2 issues closed.
-
Allow referrerpolicy attribute on <link> w3c/webappsec-referrer-policy#15.
-
Feature request: Disown window.opener w3c/webappsec-referrer-policy#23.
-
-
4 issues received 8 new comments.
-
Dynamically inserted \<meta name="referrer"\> may slow down speculative loadings w3c/webappsec-referrer-policy#25 (2 comments by @annevk, @franziskuskiefer)
-
Allow referrerpolicy attribute on <link> w3c/webappsec-referrer-policy#15 (2 comments by @igrigorik, @jeisinger)
-
Feature request: Disown window.opener w3c/webappsec-referrer-policy#23 (2 comments by @annevk, @hillbrad)
-
-
2 pull requests opened.
-
Use empty string instead of null for lack of policy w3c/webappsec-referrer-policy#24, by @estark37.
-
Add referrerpolicy attribute on link elements w3c/webappsec-referrer-policy#22, by @estark37.
-
-
4 pull requests merged.
-
Use empty string instead of null for lack of policy w3c/webappsec-referrer-policy#24.
-
Fix typo w3c/webappsec-referrer-policy#18.
-
Copy Travis config from CSP repo (MERGE FIRST!) w3c/webappsec-referrer-policy#17.
-
Add referrerpolicy attribute on link elements w3c/webappsec-referrer-policy#22.
-
-
1 pull request closed.
-
'null' should be set as Origin header if referrer-policy is "no-referrer" w3c/webappsec-referrer-policy#20.
-
-
6 pull requests received 23 new comments.
-
Add referrerpolicy attribute on link elements w3c/webappsec-referrer-policy#22 (9 comments by @annevk, @estark37, @jeisinger)
-
Use empty string instead of null for lack of policy w3c/webappsec-referrer-policy#24 (5 comments by @annevk, @estark37, @jeisinger)
-
Introduce a "Same-Origin Only" policy state w3c/webappsec-referrer-policy#19 (3 comments by @estark37, @fmarier)
-
Copy Travis config from CSP repo (MERGE FIRST!) w3c/webappsec-referrer-policy#17 (2 comments by @estark37, @fmarier)
-
w3c/webappsec-cowl
-
3 issues opened.
-
Clarify why both labeled data and labeled context directives are needed w3c/webappsec-cowl#55, by @NAndreasson.
-
Allow header to omit integrity label w3c/webappsec-cowl#54, by @deian.
-
Clarify algorithm for serialization of labels w3c/webappsec-cowl#53, by @NAndreasson.
-
-
2 issues received 4 new comments.
-
Should top-level pages be able to navigate arbitrarily? w3c/webappsec-cowl#44 (3 comments by @deian, @jonathanKingston)
-
w3c/webcrypto
-
1 issue opened.
-
ECDH and ECDSA using wrong JWK algorithm - s/ES521/ES512/ w3c/webcrypto#18, by @jimsch.
-
-
3 pull requests opened.
-
Odds and ends w3c/webcrypto#17, by @jimsch.
-
Changes to switch from NIST to IETF version of HKDF w3c/webcrypto#16, by @jimsch.
-
Fix #35: Change "get length" to "get key length" in all locations w3c/webcrypto#15, by @jimsch.
-
-
1 pull request received 1 new comment.
w3c/webappsec-credential-management
-
3 issues opened.
-
storeCredentials() method on HTMLFormElement w3c/webappsec-credential-management#13, by @mnoorenberghe.
-
Credential terminology and Fetch w3c/webappsec-credential-management#12, by @annevk.
-
unify with existing fetch credential system w3c/webappsec-credential-management#11, by @wanderview.
-
-
5 issues received 58 new comments.
-
storeCredentials() method on HTMLFormElement w3c/webappsec-credential-management#13 (26 comments by @annevk, @AxelNennker, @mikewest, @mnoorenberghe)
-
unify with existing fetch credential system w3c/webappsec-credential-management#11 (21 comments by @annevk, @mikewest, @wanderview)
-
Credential terminology and Fetch w3c/webappsec-credential-management#12 (8 comments by @annevk, @mikewest, @wanderview)
-
CREDENTIAL: requestAutocomplete can already provide local credentials w3c/webappsec-credential-management#2 (2 comments by @AxelNennker, @mnoorenberghe)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Need a way to detect upgrading w3c/webappsec-upgrade-insecure-requests#3, by @takenspc.
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
SecureContext on attributes produces prototype mutations during realm creation w3c/webappsec-secure-contexts#23, by @esprehn.
-
-
3 issues closed.
-
Remove the risk of `document.domain`. w3c/webappsec-secure-contexts#10.
-
<iframe sandbox srcdoc="foo"> on a secure page should be secure w3c/webappsec-secure-contexts#5.
-
Checking the opener browsing context is broken w3c/webappsec-secure-contexts#18.
-
-
6 issues received 28 new comments.
-
Checking the opener browsing context is broken w3c/webappsec-secure-contexts#18 (14 comments by @annevk, @bzbarsky, @jwatt, @mikewest)
-
SecureContext on attributes produces prototype mutations during realm creation w3c/webappsec-secure-contexts#23 (5 comments by @bzbarsky, @mikewest, @travisleithead)
-
Remove the risk of `document.domain`. w3c/webappsec-secure-contexts#10 (5 comments by @annevk, @bholley, @jwatt, @mikewest)
-
<iframe sandbox srcdoc="foo"> on a secure page should be secure w3c/webappsec-secure-contexts#5 (2 comments by @jwatt, @mikewest)
-
"Is origin potentially trustworthy" algorithm assumes origins have scheme and host components w3c/webappsec-secure-contexts#4 (1 comment by @jwatt)
-
-
4 pull requests opened.
-
Various fixes/improvements to the notes on the algorithms w3c/webappsec-secure-contexts#22, by @jwatt.
-
Remove the section on document.domain w3c/webappsec-secure-contexts#21, by @jwatt.
-
Rewrite and simpify algorithms to avoid iteration w3c/webappsec-secure-contexts#20, by @jwatt.
-
Update generated markup to that produced by the latest bikeshed w3c/webappsec-secure-contexts#19, by @jwatt.
-
-
4 pull requests merged.
-
Various fixes/improvements to the notes on the algorithms w3c/webappsec-secure-contexts#22.
-
Remove the section on document.domain w3c/webappsec-secure-contexts#21.
-
Rewrite and simpify algorithms to avoid iteration w3c/webappsec-secure-contexts#20.
-
Update generated markup to that produced by the latest bikeshed w3c/webappsec-secure-contexts#19.
-
-
3 pull requests received 8 new comments.
-
Rewrite and simpify algorithms to avoid iteration w3c/webappsec-secure-contexts#20 (6 comments by @annevk, @jwatt, @mikewest)
-
Various fixes/improvements to the notes on the algorithms w3c/webappsec-secure-contexts#22 (1 comment by @mikewest)
-
w3c/webappsec-suborigins
-
8 issues opened.
-
Think through the suborigin is more trusted than the parent scenario w3c/webappsec-suborigins#29, by @devd.
-
Behavior of Host prefix in the presence of unsafe-cookies option w3c/webappsec-suborigins#28, by @devd.
-
set-cookie with suborigin header should set cookie in new cookie jar w3c/webappsec-suborigins#27, by @devd.
-
postMessage extra argument for suborigin w3c/webappsec-suborigins#26, by @devd.
-
think through fetch modifications w3c/webappsec-suborigins#25, by @devd.
-
Unsafe Opt-outs for postMessage w3c/webappsec-suborigins#24, by @devd.
-
Define syntax for unsafe optouts w3c/webappsec-suborigins#23, by @devd.
-
Make workers (including service workers) work w3c/webappsec-suborigins#21, by @mitar.
-
-
3 issues closed.
-
Define syntax for unsafe optouts w3c/webappsec-suborigins#23.
-
Are suborigins case sensitive or not? w3c/webappsec-suborigins#9.
-
Suborigin header should only use the last header, not any of the first ones w3c/webappsec-suborigins#19.
-
-
1 issue reopened.
-
Make workers (including service workers) work w3c/webappsec-suborigins#21, by @mitar.
-
-
9 issues received 18 new comments.
-
postMessage extra argument for suborigin w3c/webappsec-suborigins#26 (6 comments by @annevk, @devd, @joelweinberger)
-
Think through the suborigin is more trusted than the parent scenario w3c/webappsec-suborigins#29 (2 comments by @devd, @joelweinberger)
-
think through fetch modifications w3c/webappsec-suborigins#25 (2 comments by @devd, @joelweinberger)
-
Suborigin header should only use the last header, not any of the first ones w3c/webappsec-suborigins#19 (2 comments by @devd, @joelweinberger)
-
set-cookie with suborigin header should set cookie in new cookie jar w3c/webappsec-suborigins#27 (1 comment by @joelweinberger)
-
Behavior of Host prefix in the presence of unsafe-cookies option w3c/webappsec-suborigins#28 (1 comment by @joelweinberger)
-
-
3 pull requests opened.
-
Unsafe syntax w3c/webappsec-suborigins#31, by @joelweinberger.
-
Add ALPHA to exported dfn references. w3c/webappsec-suborigins#30, by @joelweinberger.
-
Modify header grammar to use lowercase only w3c/webappsec-suborigins#22, by @joelweinberger.
-
-
3 pull requests merged.
-
Unsafe syntax w3c/webappsec-suborigins#31.
-
Add ALPHA to exported dfn references. w3c/webappsec-suborigins#30.
-
Modify header grammar to use lowercase only w3c/webappsec-suborigins#22.
-
-
1 pull request closed.
-
Use last suborigin header w3c/webappsec-suborigins#20.
-
-
2 pull requests received 19 new comments.
w3c/webappsec-csp
-
3 pull requests opened.
-
Block all non sri resources w3c/webappsec-csp#64, by @oreoshake.
-
Update references to w3c.org to use HTTPS w3c/webappsec-csp#63, by @shekyan.
-
Use example.com instead of a.com per RFC 2606 w3c/webappsec-csp#62, by @mathiasbynens.
-
-
2 pull requests merged.
-
Use example.com instead of a.com per RFC 2606 w3c/webappsec-csp#62.
-
Fix copypasta in "Version History" URL w3c/webappsec-csp#56.
-
-
2 pull requests closed.
-
Restrict valid sandbox values to keywords in HTML w3c/webappsec-csp#57.
-
Make "sandbox" directive-value an enumerated list w3c/webappsec-csp#55.
-
-
5 pull requests received 29 new comments.
-
Block all non sri resources w3c/webappsec-csp#64 (22 comments by @devd, @fmarier, @joelweinberger, @michaelficarra, @mikewest, @mozfreddyb, @oreoshake, @ptoomey3, @shekyan)
-
Use example.com instead of a.com per RFC 2606 w3c/webappsec-csp#62 (2 comments by @mikewest, @wseltzer)
-
Update references to w3c.org to use HTTPS w3c/webappsec-csp#63 (2 comments by @annevk, @michaelficarra)
-
Restrict valid sandbox values to keywords in HTML w3c/webappsec-csp#57 (2 comments by @hillbrad, @sideshowbarker)
-
Make "sandbox" directive-value an enumerated list w3c/webappsec-csp#55 (1 comment by @sideshowbarker)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Clarify term "Secure Context" w3c/webappsec-subresource-integrity#29, by @jwatt.
-
-
1 issue closed.
-
Clarify term "Secure Context" w3c/webappsec-subresource-integrity#29.
-
-
2 issues received 4 new comments.
-
Clarify term "Secure Context" w3c/webappsec-subresource-integrity#29 (3 comments by @jwatt, @mozfreddyb)
-
-
1 pull request opened.
-
Removing 'should' from an informal note w3c/webappsec-subresource-integrity#30, by @mozfreddyb.
-
-
1 pull request merged.
-
Removing 'should' from an informal note w3c/webappsec-subresource-integrity#30.
-
-
1 pull request reopened.
-
Removing 'should' from an informal note w3c/webappsec-subresource-integrity#30, by @mozfreddyb.
-
-
1 pull request received 1 new comment.
-
Removing 'should' from an informal note w3c/webappsec-subresource-integrity#30 (1 comment by @fmarier)
-
w3c/webappsec-uisecurity
-
1 issue closed.
-
Typo: "Visiblity" w3c/webappsec-uisecurity#5.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
address @noncombatant comments in issue 5 w3c/webappsec-uisecurity#6, by @hillbrad.
-
-
1 pull request merged.
-
address @noncombatant comments in issue 5 w3c/webappsec-uisecurity#6.
-
w3c/webappsec
-
1 issue opened.
-
Usage of referrerpolicy="no-referrer" for DoS attacks w3c/webappsec#511, by @Yaffle.
-
-
1 issue received 11 new comments.
-
CSP: Consider a flag to turn off console logging for Report-Only w3c/webappsec#508 (11 comments by @jacobbednarz, @jonathanKingston, @millisecond, @mozfreddyb)
-
Participants
-
1 participant left.
-
Jonathan Kingston (Duck Duck Go, Inc.) left.
-
GitHub
w3c/webappsec
-
1 pull request opened.
-
Mark plugin-types as a non-default source w3c/webappsec#510, by @oreoshake.
-
-
1 pull request closed.
-
Mark plugin-types as a non-default source w3c/webappsec#510.
-
-
1 pull request received 2 new comments.
w3c/webappsec-suborigins
-
2 issues opened.
-
Suborigin header should only use the last header, not any of the first ones w3c/webappsec-suborigins#19, by @joelweinberger.
-
Define 'physical origin' w3c/webappsec-suborigins#17, by @joelweinberger.
-
-
4 issues closed.
-
Origins in the spec have trailing / w3c/webappsec-suborigins#7.
-
Spec contains invalid syntax w3c/webappsec-suborigins#14.
-
Allow . in the suborigin w3c/webappsec-suborigins#8.
-
Do suborigins work with META tag w3c/webappsec-suborigins#10.
-
-
7 issues received 11 new comments.
-
Why having both serialized origins and finerorigin/suborigin w3c/webappsec-suborigins#6 (1 comment by @devd)
-
3 pull requests opened.
-
Use last suborigin header w3c/webappsec-suborigins#20, by @devd.
-
Cleanup by removing bad syntax and fixing some origin examples. w3c/webappsec-suborigins#18, by @joelweinberger.
-
Updates based on genius.it discussion w3c/webappsec-suborigins#16, by @devd.
-
-
2 pull requests merged.
-
Updates based on genius.it discussion w3c/webappsec-suborigins#16.
-
Cleanup by removing bad syntax and fixing some origin examples. w3c/webappsec-suborigins#18.
-
-
2 pull requests received 21 new comments.
-
Updates based on genius.it discussion w3c/webappsec-suborigins#16 (20 comments by @devd, @joelweinberger)
-
Cleanup by removing bad syntax and fixing some origin examples. w3c/webappsec-suborigins#18 (1 comment by @joelweinberger)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
null -> "the empty string" w3c/webappsec-referrer-policy#21, by @annevk.
-
-
1 issue received 2 new comments.
-
Allow referrerpolicy attribute on <link> w3c/webappsec-referrer-policy#15 (2 comments by @annevk, @igrigorik)
-
-
1 pull request opened.
-
'null' should be set as Origin header if referrer-policy is "no-referrer" w3c/webappsec-referrer-policy#20, by @jeisinger.
-
-
1 pull request received 20 new comments.
-
'null' should be set as Origin header if referrer-policy is "no-referrer" w3c/webappsec-referrer-policy#20 (20 comments by @annevk, @estark37, @franziskuskiefer, @jeisinger, @mikewest)
-
w3c/webcrypto
-
2 pull requests opened.
-
Fix #143: Correct OID for rsaEncryption in the document. w3c/webcrypto#14, by @jimsch.
-
Correct reference for SHA-2 w/ RSA algorithm w3c/webcrypto#13, by @jimsch.
-
w3c/webappsec-cowl
-
5 issues opened.
-
Make LabedObject label optional w3c/webappsec-cowl#52, by @deian.
-
LabeledObject specification w3c/webappsec-cowl#49, by @NAndreasson.
-
Potential addition to context tainting algorithm w3c/webappsec-cowl#48, by @NAndreasson.
-
Specify same-origin IPC vs. shared memory edgecase w3c/webappsec-cowl#47, by @NAndreasson.
-
Motivate why top-level contexts shouldn't get stuck w3c/webappsec-cowl#46, by @NAndreasson.
-
-
3 issues received 4 new comments.
-
Specify same-origin IPC vs. shared memory edgecase w3c/webappsec-cowl#47 (2 comments by @deian, @NAndreasson)
-
-
2 pull requests opened.
-
Add a Gitter chat badge to README.md w3c/webappsec-cowl#51, by @gitter-badger.
-
Add a Gitter chat badge to README.md w3c/webappsec-cowl#50, by @gitter-badger.
-
-
1 pull request merged.
-
Add a Gitter chat badge to README.md w3c/webappsec-cowl#51.
-
-
1 pull request closed.
-
Add a Gitter chat badge to README.md w3c/webappsec-cowl#50.
-
w3c/webappsec-secure-contexts
-
2 issues opened.
-
Checking the opener browsing context is broken w3c/webappsec-secure-contexts#18, by @jwatt.
-
Example describing window.opener is garbled. w3c/webappsec-secure-contexts#17, by @jyasskin.
-
-
1 issue closed.
-
Example describing window.opener is garbled. w3c/webappsec-secure-contexts#17.
-
-
1 issue reopened.
-
Remove the risk of `document.domain`. w3c/webappsec-secure-contexts#10, by @annevk.
-
-
4 issues received 18 new comments.
-
Remove the risk of `document.domain`. w3c/webappsec-secure-contexts#10 (13 comments by @annevk, @bholley, @hillbrad, @mikewest)
-
Checking the opener browsing context is broken w3c/webappsec-secure-contexts#18 (2 comments by @bzbarsky, @mikewest)
-
Check that 'incumbent' is the right settings object. w3c/webappsec-secure-contexts#15 (2 comments by @domenic, @mikewest)
-
Example describing window.opener is garbled. w3c/webappsec-secure-contexts#17 (1 comment by @mikewest)
-
w3c/webappsec-csp
-
1 issue received 5 new comments.
-
Inline event handlers not whitelisted by hashes? w3c/webappsec-csp#13 (5 comments by @michaelficarra, @mikewest)
-
-
3 pull requests opened.
-
Update Section 4.1 to follow the latest Fetch's spec w3c/webappsec-csp#61, by @hashedhyphen.
-
Add manifest-src to the default-src examples w3c/webappsec-csp#60, by @shekyan.
-
Add manifest-src to the default-src examples w3c/webappsec-csp#59, by @shekyan.
-
-
2 pull requests merged.
-
Update Section 4.1 to follow the latest Fetch's spec w3c/webappsec-csp#61.
-
Add manifest-src to the default-src examples w3c/webappsec-csp#59.
-
-
1 pull request closed.
-
Add manifest-src to the default-src examples w3c/webappsec-csp#60.
-
-
3 pull requests received 3 new comments.
w3c/permissions
-
2 issues opened.
-
Add 'background-sync' permission w3c/permissions#60, by @nsatragno.
-
Passing base dictionary wont work. w3c/permissions#59, by @jan-ivar.
-
-
2 issues closed.
-
Add "wakeLock" to enum PermissionName w3c/permissions#53.
-
Options for "double-keying" permissions w3c/permissions#55.
-
-
1 issue reopened.
-
Faking permissions w3c/permissions#54, by @KOLANICH.
-
-
4 issues received 18 new comments.
-
Add 'background-sync' permission w3c/permissions#60 (3 comments by @beverloo, @mkruisselbrink, @mounirlamouri)
-
1 pull request opened.
-
Add background-sync permission. w3c/permissions#61, by @nsatragno.
-
-
2 pull requests merged.
-
Mediacapture permissions w3c/permissions#57.
-
Minor editorial fixes w3c/permissions#44.
-
-
2 pull requests received 12 new comments.
-
Mediacapture permissions w3c/permissions#57 (11 comments by @alvestrand, @joeberkovitz, @mounirlamouri)
-
TR publications
-
1 document published.
-
Content Security Policy Level 3 published as a First Public Working Draft. History of Content Security Policy Level 3
-
Participants
-
1 organization joined.
-
GitStar joined.
-
GitHub
w3c/webappsec-suborigins
-
1 issue opened.
-
Spec contains invalid syntax w3c/webappsec-suborigins#14, by @mitar.
-
-
4 pull requests opened.
-
Major updates to match implementation w3c/webappsec-suborigins#15, by @joelweinberger.
-
Allow dots in origins w3c/webappsec-suborigins#13, by @mitar.
-
Cleanups in second half of spec w3c/webappsec-suborigins#12, by @joelweinberger.
-
Cleanups for first half of spec w3c/webappsec-suborigins#11, by @joelweinberger.
-
-
3 pull requests merged.
-
Major updates to match implementation w3c/webappsec-suborigins#15.
-
Cleanups in second half of spec w3c/webappsec-suborigins#12.
-
Cleanups for first half of spec w3c/webappsec-suborigins#11.
-
-
1 pull request closed.
-
Allow dots in origins w3c/webappsec-suborigins#13.
-
-
4 pull requests received 7 new comments.
w3c/webappsec-secure-contexts
-
4 issues opened.
-
Clarification of changes to WebIDL w3c/webappsec-secure-contexts#16, by @deian.
-
Check that 'incumbent' is the right settings object. w3c/webappsec-secure-contexts#15, by @jyasskin.
-
Threat Model missing a treatment of user phishing w3c/webappsec-secure-contexts#14, by @noloader.
-
Public Key Pinning with Overrides breaks the presumptions of Secure Contexts w3c/webappsec-secure-contexts#13, by @noloader.
-
-
1 issue closed.
-
Threat Model missing a treatment of user phishing w3c/webappsec-secure-contexts#14.
-
-
6 issues received 18 new comments.
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9 (4 comments by @annevk, @mikewest, @wseltzer)
-
Public Key Pinning with Overrides breaks the presumptions of Secure Contexts w3c/webappsec-secure-contexts#13 (4 comments by @dveditz, @jonathanKingston, @mikewest)
-
Check that 'incumbent' is the right settings object. w3c/webappsec-secure-contexts#15 (4 comments by @annevk, @bholley, @mikewest)
-
Clarification of changes to WebIDL w3c/webappsec-secure-contexts#16 (2 comments by @annevk, @mikewest)
-
"Is origin potentially trustworthy" algorithm assumes origins have scheme and host components w3c/webappsec-secure-contexts#4 (2 comments by @bzbarsky, @jwatt)
-
Threat Model missing a treatment of user phishing w3c/webappsec-secure-contexts#14 (2 comments by @jonathanKingston, @mikewest)
-
-
1 pull request merged.
-
Fix non-secure schemes from https to http w3c/webappsec-secure-contexts#12.
-
-
1 pull request received 2 new comments.
-
Fix non-secure schemes from https to http w3c/webappsec-secure-contexts#12 (2 comments by @hashedhyphen, @mikewest)
-
w3c/permissions
-
1 issue opened.
-
contributing.md file says webapps is the WG to call, while document says webappsec w3c/permissions#56, by @alvestrand.
-
-
1 issue closed.
-
1 issue received 1 new comment.
-
contributing.md file says webapps is the WG to call, while document says webappsec w3c/permissions#56 (1 comment by @mounirlamouri)
-
-
2 pull requests opened.
-
Update contributing.md w3c/permissions#58, by @mounirlamouri.
-
Mediacapture permissions w3c/permissions#57, by @alvestrand.
-
-
1 pull request merged.
-
Update contributing.md w3c/permissions#58.
-
-
1 pull request received 20 new comments.
-
Mediacapture permissions w3c/permissions#57 (20 comments by @adam-be, @alvestrand, @martinthomson, @mounirlamouri, @stefhak)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Editing broke document w3c/webappsec-mixed-content#3, by @jwatt.
-
-
1 issue closed.
-
Clarify the fetch integration points w3c/webappsec-mixed-content#2.
-
-
1 issue received 1 new comment.
w3c/webappsec
-
1 issue opened.
-
CSP: Consider a flag to turn off console logging for Report-Only w3c/webappsec#508, by @millisecond.
-
-
1 issue closed.
-
CSP: frame-ancestors should check origins, not URLs w3c/webappsec#311.
-
-
2 issues received 4 new comments.
-
CSP: frame-ancestors should check origins, not URLs w3c/webappsec#311 (2 comments by @mikewest, @sigkate)
-
CREDENTIAL: Credential scope should not be limited to login w3c/webappsec#256 (2 comments by @dlongley)
-
-
1 pull request opened.
-
Improving preventDefault implementation w3c/webappsec#509, by @paul-matthews.
-
w3c/webappsec-cowl
-
5 issues opened.
-
Make FreshPrivilege a NamedConstructor w3c/webappsec-cowl#45, by @deian.
-
Should top-level pages be able to navigate arbitrarily? w3c/webappsec-cowl#44, by @deian.
-
Restrict COWL to secure contexts w3c/webappsec-cowl#43, by @deian.
-
Specify how to deal with permissions w3c/webappsec-cowl#42, by @deian.
-
Specify how to deal with notifications w3c/webappsec-cowl#41, by @deian.
-
-
5 issues closed.
-
Make sure COWL's request header doesn't reintroduce referrer leaks w3c/webappsec-cowl#39.
-
Don't allow over-tainting a top-level context w3c/webappsec-cowl#34.
-
Parsing headers should fail close w3c/webappsec-cowl#35.
-
Don't use origins for app-specific principals w3c/webappsec-cowl#38.
-
Change label format in headers w3c/webappsec-cowl#40.
-
-
1 issue received 1 new comment.
-
Make sure COWL's request header doesn't reintroduce referrer leaks w3c/webappsec-cowl#39 (1 comment by @deian)
-
w3c/webcrypto
-
1 issue opened.
-
Update the Algorith Interop Table w3c/webcrypto#12, by @hhalpin.
-
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
Extend SRI to apply to <link rel=preload> w3c/webappsec-subresource-integrity#26, by @joelweinberger.
-
JavaScript crossorigin vs crossOrigin attribute w3c/webappsec-subresource-integrity#24, by @kravietz.
-
-
3 issues received 6 new comments.
-
Extend SRI to apply to <link rel=preload> w3c/webappsec-subresource-integrity#26 (3 comments by @fmarier, @igrigorik, @joelweinberger)
-
Add an SRI control as either a CSP directive or a new header w3c/webappsec-subresource-integrity#23 (2 comments by @joelweinberger, @mozfreddyb)
-
JavaScript crossorigin vs crossOrigin attribute w3c/webappsec-subresource-integrity#24 (1 comment by @mozfreddyb)
-
-
3 pull requests opened.
-
Move to Proposed Recommendation w3c/webappsec-subresource-integrity#28, by @joelweinberger.
-
Basic bikeshed conversion w3c/webappsec-subresource-integrity#27, by @joelweinberger.
-
Example of adding integrity attributes in JavaScript w3c/webappsec-subresource-integrity#25, by @kravietz.
-
-
1 pull request merged.
-
Basic bikeshed conversion w3c/webappsec-subresource-integrity#27.
-
-
3 pull requests received 14 new comments.
-
Basic bikeshed conversion w3c/webappsec-subresource-integrity#27 (9 comments by @devd, @joelweinberger, @mozfreddyb)
-
Move to Proposed Recommendation w3c/webappsec-subresource-integrity#28 (3 comments by @joelweinberger, @mikewest, @mozfreddyb)
-
Example of adding integrity attributes in JavaScript w3c/webappsec-subresource-integrity#25 (2 comments by @fmarier, @hillbrad)
-
w3c/webappsec-csp
-
3 issues opened.
-
[document] plugin-types clarification w3c/webappsec-csp#58, by @jonathanKingston.
-
"null" disposition has no explanation w3c/webappsec-csp#53, by @terriko.
-
`report-to` overrides `report-uri`. w3c/webappsec-csp#51, by @mikewest.
-
-
2 issues closed.
-
`report-to` overrides `report-uri`. w3c/webappsec-csp#51.
-
"null" disposition has no explanation w3c/webappsec-csp#53.
-
-
5 issues received 8 new comments.
-
[embedded] Is the `csp` attribute policy applied recursively? w3c/webappsec-csp#50 (3 comments by @jonathanKingston, @shekyan)
-
Consider applying both `child-src` and `script-src` to workers. w3c/webappsec-csp#31 (2 comments by @annevk, @igrigorik)
-
-
5 pull requests opened.
-
Restrict valid sandbox values to keywords in HTML w3c/webappsec-csp#57, by @sideshowbarker.
-
Fix copypasta in "Version History" URL w3c/webappsec-csp#56, by @sideshowbarker.
-
Make "sandbox" directive-value an enumerated list w3c/webappsec-csp#55, by @sideshowbarker.
-
Some smaller wording nits w3c/webappsec-csp#54, by @jonathanKingston.
-
Typo fix: ancilliary->ancillary w3c/webappsec-csp#52, by @terriko.
-
-
2 pull requests merged.
-
Some smaller wording nits w3c/webappsec-csp#54.
-
Typo fix: ancilliary->ancillary w3c/webappsec-csp#52.
-
-
3 pull requests received 17 new comments.
-
Make "sandbox" directive-value an enumerated list w3c/webappsec-csp#55 (8 comments by @mikewest, @shekyan, @sideshowbarker)
-
Some smaller wording nits w3c/webappsec-csp#54 (5 comments by @jonathanKingston, @mikewest, @wseltzer)
-
w3c/webappsec-referrer-policy
-
1 issue received 15 new comments.
-
Allow referrerpolicy attribute on <link> w3c/webappsec-referrer-policy#15 (15 comments by @annevk, @davidillsley, @jeisinger, @mikewest)
-
-
4 pull requests opened.
-
Introduce a "Same-Origin Only" policy state w3c/webappsec-referrer-policy#19, by @fmarier.
-
Copy Travis config from CSP repo (MERGE FIRST!) w3c/webappsec-referrer-policy#17, by @fmarier.
-
Consistency fixes w3c/webappsec-referrer-policy#16, by @fmarier.
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Use of the Vary: Header. w3c/webappsec-upgrade-insecure-requests#2, by @ylafon.
-