Web Application Security Working Group - Activity in 2019
No matches.
GitHub
w3c/trusted-types
-
5 issues opened.
-
Specify no Trusted Type Policies allowed w3c/trusted-types#253, by @craigfrancis.
-
Set slot values when called directly by the parser w3c/trusted-types#252, by @koto.
-
Alternative Options for Default Policy. w3c/trusted-types#248, by @otherdaniel.
-
How to bless asset references w3c/trusted-types#247, by @mikesamuel.
-
"require-trusted-types-for Pre-Navigation check" versus "Get Trusted Type compliant string" w3c/trusted-types#246, by @otherdaniel.
-
-
3 issues closed.
-
Consider adding TT.emptyScript w3c/trusted-types#218.
-
How does this work when you have a dependency included twice? w3c/trusted-types#222.
-
Allow future extensions to the API without breaking compatibility w3c/trusted-types#241.
-
-
8 issues received 22 new comments.
-
Alternative Options for Default Policy. w3c/trusted-types#248 (11 comments by @annevk, @domenic, @koto, @mikewest, @otherdaniel)
-
Allow future extensions to the API without breaking compatibility w3c/trusted-types#241 (2 comments by @koto, @mikewest)
-
"require-trusted-types-for Pre-Navigation check" versus "Get Trusted Type compliant string" w3c/trusted-types#246 (1 comment by @koto)
-
Possible trustedTypes bypass when assigning to script.innerHTML w3c/trusted-types#238 (1 comment by @koto)
-
How does this work when you have a dependency included twice? w3c/trusted-types#222 (1 comment by @koto)
-
-
5 pull requests opened.
-
Add trustedTypes.emptyScript. w3c/trusted-types#251, by @koto.
-
Editorial: Simplify the pre-navigation check algorithm. w3c/trusted-types#250, by @koto.
-
Bugifx: Allow all policies in the enforcing polyfill if trusted-types… w3c/trusted-types#249, by @koto.
-
Added support for 'allow-duplicates' keyword. w3c/trusted-types#245, by @koto.
-
Added require-trusted-types-for directive. w3c/trusted-types#244, by @koto.
-
-
6 pull requests merged.
-
Add trustedTypes.emptyScript. w3c/trusted-types#251.
-
Editorial: Simplify the pre-navigation check algorithm. w3c/trusted-types#250.
-
Bugifx: Allow all policies in the enforcing polyfill if trusted-types… w3c/trusted-types#249.
-
Added support for 'allow-duplicates' keyword. w3c/trusted-types#245.
-
Added require-trusted-types-for directive. w3c/trusted-types#244.
-
Fix #240. Attributes, by default, are not namespaced. w3c/trusted-types#243.
-
-
1 pull request closed.
-
Allow for prefix wildcards. w3c/trusted-types#220.
-
w3c/webcrypto
-
1 issue opened.
-
Please add support for SM series algorithms. w3c/webcrypto#231, by @smx-gotoweb.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Add missing adjective: "cryptographically strong" w3c/webcrypto#230, by @ctavan.
-
w3c/webappsec-cors-for-developers
-
1 issue opened.
-
Wrong header name in section 6.1 w3c/webappsec-cors-for-developers#10, by @amangano-privy.
-
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
Consideration: Allow integrity-check based on signature instead of actual hash w3c/webappsec-subresource-integrity#85, by @NL-William.
-
The algorithm for parsing metadata should be described in more detail w3c/webappsec-subresource-integrity#84, by @baek9.
-
-
3 issues received 11 new comments.
-
The algorithm for parsing metadata should be described in more detail w3c/webappsec-subresource-integrity#84 (7 comments by @annevk, @baek9, @domfarolino, @yutakahirano)
-
Relationship to Digest header w3c/webappsec-subresource-integrity#83 (3 comments by @LPardue, @mikewest)
-
Extend SRI to support integrity metadata on inline script/style blocks w3c/webappsec-subresource-integrity#44 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Apply integrity checks to inline script and style blocks. w3c/webappsec-subresource-integrity#86, by @mikewest.
-
-
1 pull request received 3 new comments.
-
Apply integrity checks to inline script and style blocks. w3c/webappsec-subresource-integrity#86 (3 comments by @mikewest, @mozfreddyb)
-
w3c/webappsec-csp
-
1 issue opened.
-
Add version number to allow 'non-backwards compatible' CSP[version]-mode w3c/webappsec-csp#416, by @NL-William.
-
-
1 issue closed.
-
CSP: connect-src 'self' and websockets w3c/webappsec-csp#7.
-
-
1 issue received 2 new comments.
-
CSP: connect-src 'self' and websockets w3c/webappsec-csp#7 (2 comments by @mikewest, @MoxxiManagarm)
-
-
1 pull request opened.
-
Drop mention of obsolete require-sri-for directive w3c/webappsec-csp#417, by @sideshowbarker.
-
w3c/permissions
-
1 issue received 5 new comments.
-
Consider making `request-permission-to-use` aware of user activation w3c/permissions#194 (5 comments by @beaufortfrancois, @dbaron, @mustaqahmed)
-
-
1 pull request received 4 new comments.
-
Add periodic-background-sync enum and description. w3c/permissions#202 (4 comments by @hober, @marcoscaceres, @mugdhalakhani)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Renaming Feature Policy w3c/webappsec-permissions-policy#359, by @annevk.
-
Feature Policy shouldn't be overridable w3c/webappsec-permissions-policy#357, by @shhnjk.
-
-
6 issues received 27 new comments.
-
Renaming Feature Policy w3c/webappsec-permissions-policy#359 (18 comments by @annevk, @clelland, @foolip, @jan-ivar)
-
Feature Policy shouldn't be overridable w3c/webappsec-permissions-policy#357 (4 comments by @bershanskiy, @clelland, @shhnjk)
-
Where is https://github.com/WICG/feature-policy/blob/gh-pages/features.md#sensor-features w3c/webappsec-permissions-policy#183 (1 comment by @rajktariya)
-
Possible race in feature policy in multiprocess implementations w3c/webappsec-permissions-policy#256 (1 comment by @clelland)
-
-
2 pull requests opened.
-
Fix navigation race w3c/webappsec-permissions-policy#358, by @clelland.
-
Add document policy w3c/webappsec-permissions-policy#353, by @clelland.
-
-
5 pull requests merged.
-
Create decoding-image-default-sync.md w3c/webappsec-permissions-policy#332.
-
Add `navigation-override` to standardized features w3c/webappsec-permissions-policy#347.
-
Move `encrypted-media` to standardized features w3c/webappsec-permissions-policy#350.
-
Add `focus-without-user-activation` to experimental features w3c/webappsec-permissions-policy#346.
-
Add document policy w3c/webappsec-permissions-policy#353.
-
-
1 pull request closed.
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#259.
-
-
3 pull requests received 3 new comments.
-
Add `document-access` to proposed features w3c/webappsec-permissions-policy#351 (1 comment by @clelland)
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#259 (1 comment by @clelland)
-
w3c/webappsec
-
2 issues opened.
-
CSP: Allow precise control of cookies w3c/webappsec#561, by @sindastra.
-
New permission to access a resource even when CORS headers are not set in the response w3c/webappsec#560, by @jarrodek.
-
-
2 issues received 3 new comments.
-
CSP: Provide a way to restrict domain of document.cookie w3c/webappsec#432 (2 comments by @sindastra)
-
-
1 pull request opened.
-
Make redirect for SRI spec include fragment ID w3c/webappsec#559, by @sideshowbarker.
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Header name "destination" may confuse developers w3c/webappsec-fetch-metadata#51, by @jugglinmike.
-
-
1 issue closed.
-
Header name "destination" may confuse developers w3c/webappsec-fetch-metadata#51.
-
-
2 issues received 15 new comments.
-
Header name "destination" may confuse developers w3c/webappsec-fetch-metadata#51 (13 comments by @annevk, @dveditz, @jugglinmike, @mikewest, @zcorpan)
-
-
2 pull requests opened.
-
Add reference for term "break" w3c/webappsec-fetch-metadata#52, by @jugglinmike.
-
Use HTML's same site w3c/webappsec-fetch-metadata#50, by @annevk.
-
-
2 pull requests merged.
-
Add reference for term "break" w3c/webappsec-fetch-metadata#52.
-
Use HTML's same site w3c/webappsec-fetch-metadata#50.
-
w3c/webappsec-change-password-url
-
1 issue opened.
-
Who supports this? w3c/webappsec-change-password-url#16, by @marcoscaceres.
-
-
1 issue received 2 new comments.
-
Who supports this? w3c/webappsec-change-password-url#16 (2 comments by @marcoscaceres, @tschoffelen)
-
w3c/webappsec-credential-management
-
1 pull request received 4 new comments.
-
Add Feature Policy support for WebAuthn w3c/webappsec-credential-management#138 (4 comments by @mikewest)
-
w3c/webappsec-mixed-content
-
4 issues opened.
-
Level 2 story for <form> w3c/webappsec-mixed-content#28, by @annevk.
-
WebSocket section needs updating w3c/webappsec-mixed-content#27, by @annevk.
-
Mixed content in the Cache API w3c/webappsec-mixed-content#26, by @annevk.
-
Move MIX2 to FPWD w3c/webappsec-mixed-content#25, by @carlosjoan91.
-
-
4 issues received 7 new comments.
-
1 pull request opened.
-
Add FPWD document for MIX2 w3c/webappsec-mixed-content#24, by @carlosjoan91.
-
-
1 pull request received 4 new comments.
w3c/webappsec-upgrade-insecure-requests
-
2 issues opened.
-
Response type w3c/webappsec-upgrade-insecure-requests#20, by @annevk.
-
w3c/webappsec-referrer-policy
-
1 issue received 3 new comments.
-
Inconsistencies with "same-origin" requests w3c/webappsec-referrer-policy#123 (3 comments by @mikewest, @yutakahirano)
-
-
2 pull requests opened.
-
Add Dominic Farolino as an editor w3c/webappsec-referrer-policy#130, by @domfarolino.
-
Stop using environment and request's origin in referrer calculation w3c/webappsec-referrer-policy#129, by @yutakahirano.
-
-
1 pull request received 4 new comments.
-
Stop using environment and request's origin in referrer calculation w3c/webappsec-referrer-policy#129 (4 comments by @domfarolino, @jeisinger, @yutakahirano)
-
TR publications
-
1 document published.
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
GitHub
w3c/webappsec-referrer-policy
-
1 issue opened.
-
same-origin request definition around A->B->A redirects w3c/webappsec-referrer-policy#128, by @hiroshige-g.
-
-
1 issue closed.
-
same-origin request definition around A->B->A redirects w3c/webappsec-referrer-policy#128.
-
-
2 issues received 7 new comments.
-
Inconsistencies with "same-origin" requests w3c/webappsec-referrer-policy#123 (5 comments by @domfarolino, @jeisinger, @mikewest)
-
same-origin request definition around A->B->A redirects w3c/webappsec-referrer-policy#128 (2 comments by @domfarolino, @hiroshige-g)
-
-
1 pull request received 1 new comment.
-
Default to 'strict-origin-when-cross-origin'. w3c/webappsec-referrer-policy#125 (1 comment by @annevk)
-
w3c/trusted-types
-
6 issues opened.
-
Ascertain in-realm documents are indeed covered in the spec w3c/trusted-types#242, by @koto.
-
Allow future extensions to the API without breaking compatibility w3c/trusted-types#241, by @koto.
-
getAttributeType is wrong about namespaces w3c/trusted-types#240, by @annevk.
-
Possible trustedTypes bypass when assigning to script.innerHTML w3c/trusted-types#238, by @securityMB.
-
Consider removing getPolicyNames() w3c/trusted-types#235, by @koto.
-
Navigating to plugins w3c/trusted-types#234, by @annevk.
-
-
4 issues closed.
-
getAttributeType is wrong about namespaces w3c/trusted-types#240.
-
Attribute change steps should not throw w3c/trusted-types#229.
-
Overriding innerText and textContent does not work w3c/trusted-types#227.
-
Ascertain in-realm documents are indeed covered in the spec w3c/trusted-types#242.
-
-
11 issues received 59 new comments.
-
How does this work when you have a dependency included twice? w3c/trusted-types#222 (20 comments by @bakkot, @koto, @otherdaniel, @Siegrift, @Sora2455, @xtofian)
-
Allow future extensions to the API without breaking compatibility w3c/trusted-types#241 (18 comments by @koto, @mikewest, @otherdaniel)
-
Figure out if we need `'trusted-script'` in `script-src` w3c/trusted-types#221 (2 comments by @koto, @mikewest)
-
Ascertain in-realm documents are indeed covered in the spec w3c/trusted-types#242 (1 comment by @koto)
-
Possible trustedTypes bypass when assigning to script.innerHTML w3c/trusted-types#238 (1 comment by @koto)
-
-
5 pull requests opened.
-
Fix #240. Attributes, by default, are not namespaced. w3c/trusted-types#243, by @koto.
-
Restricting characters that can be used in policy names w3c/trusted-types#237, by @koto.
-
Alternate take for script enforcement. w3c/trusted-types#236, by @koto.
-
Added attribute validate steps w3c/trusted-types#233, by @koto.
-
-
3 pull requests merged.
-
Alternate take for script enforcement. w3c/trusted-types#236.
-
Fix #221. w3c/trusted-types#239.
-
Restricting characters that can be used in policy names w3c/trusted-types#237.
-
-
1 pull request received 3 new comments.
w3c/permissions
-
1 issue opened.
-
Remove "device-info" permission w3c/permissions#203, by @youennf.
-
-
1 pull request opened.
-
Add periodic-background-sync enum and description. w3c/permissions#202, by @mugdhalakhani.
-
-
2 pull requests received 9 new comments.
-
Add periodic-background-sync enum and description. w3c/permissions#202 (7 comments by @marcoscaceres, @mounirlamouri, @mugdhalakhani)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Disable DOM clobbering. w3c/webappsec-permissions-policy#349, by @mikewest.
-
-
2 issues received 9 new comments.
-
Disable DOM clobbering. w3c/webappsec-permissions-policy#349 (8 comments by @annevk, @bzbarsky, @koto, @terjanq)
-
-
3 pull requests opened.
-
Editorial: Align with Web IDL specification w3c/webappsec-permissions-policy#352, by @autokagami.
-
Add `document-access` to proposed features w3c/webappsec-permissions-policy#351, by @Malvoz.
-
Move `encrypted-media` to standardized features w3c/webappsec-permissions-policy#350, by @Malvoz.
-
-
1 pull request merged.
-
Editorial: Align with Web IDL specification w3c/webappsec-permissions-policy#352.
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
`Sec-Fetch-Site` for requests from extension background pages w3c/webappsec-fetch-metadata#47, by @arturjanc.
-
-
1 issue closed.
-
Is `Sec-Fetch-Dest` necessary? w3c/webappsec-fetch-metadata#16.
-
-
3 issues received 11 new comments.
-
`Sec-Fetch-Site` for requests from extension background pages w3c/webappsec-fetch-metadata#47 (7 comments by @anforowicz, @iVanlIsh, @mikewest)
-
Is `Sec-Fetch-Dest` necessary? w3c/webappsec-fetch-metadata#16 (3 comments by @Jack-Works, @Malvoz, @mikewest)
-
Sending `Sec-Fetch-Site: none` after redirects from directly user-initiated requests w3c/webappsec-fetch-metadata#39 (1 comment by @mikewest)
-
-
2 pull requests opened.
-
Fix minor typos in README.md w3c/webappsec-fetch-metadata#49, by @sideshowbarker.
-
Explicitly set the Sec-Fetch-User header value w3c/webappsec-fetch-metadata#48, by @jugglinmike.
-
-
2 pull requests merged.
-
Fix minor typos in README.md w3c/webappsec-fetch-metadata#49.
-
Explicitly set the Sec-Fetch-User header value w3c/webappsec-fetch-metadata#48.
-
w3c/webappsec-mixed-content
-
4 issues closed.
-
Track being the only media type that is blocked w3c/webappsec-mixed-content#13.
-
Move "Mixed Content" to PR. w3c/webappsec-mixed-content#15.
-
`cors-with-forced-preflight` is not a mode. w3c/webappsec-mixed-content#23.
-
What's the scope of mixed content tainting? w3c/webappsec-mixed-content#7.
-
-
5 issues received 5 new comments.
-
Track being the only media type that is blocked w3c/webappsec-mixed-content#13 (1 comment by @mikewest)
-
Clarify mixed content behavior for access to origins in CIDR 127.0.0.0/8 or ::1/128 w3c/webappsec-mixed-content#17 (1 comment by @mikewest)
-
w3c/webappsec-uisecurity
-
1 pull request merged.
-
Use pr-review tool w3c/webappsec-uisecurity#11.
-
w3c/webappsec-csp
-
1 issue opened.
-
Spec is inconsistent about which strings are valid CSPs w3c/webappsec-csp#414, by @bakkot.
-
-
2 pull requests opened.
-
Fix typo (missing comma) in Directives intro w3c/webappsec-csp#415, by @sideshowbarker.
-
-
1 pull request merged.
-
Fix typo (missing comma) in Directives intro w3c/webappsec-csp#415.
-
-
1 pull request closed.
-
Typo fix w3c/webappsec-csp#413.
-
-
2 pull requests received 3 new comments.
w3c/webcrypto
-
1 issue opened.
-
Update references w3c/webcrypto#229, by @plehegar.
-
-
3 issues closed.
-
Use [SameObject] for the crypto attribute w3c/webcrypto#179.
-
Typo in examples (33.2. Symmetric Encryption) w3c/webcrypto#186.
-
SHA use of "section 6.1" should add "of [FIPS PUB 180-4]" w3c/webcrypto#182.
-
-
1 pull request opened.
-
A few more EnforceRange to move w3c/webcrypto#228, by @plehegar.
-
-
6 pull requests merged.
-
window.crypto returns the same object w3c/webcrypto#206.
-
Update in 33.2. Symmetric Encryption example - w3c/webcrypto#204.
-
SHA algorithms aren't defined in this spec w3c/webcrypto#205.
-
A few more EnforceRange to move w3c/webcrypto#228.
-
Fix Web IDL extended attribute usage: [EnforceRange] now applies to types w3c/webcrypto#218.
-
Fix some typos in the specification w3c/webcrypto#224.
-
w3c/webappsec-subresource-integrity
-
1 issue closed.
-
Extend SRI to apply to <link rel=preload> w3c/webappsec-subresource-integrity#26.
-
-
2 issues received 7 new comments.
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (5 comments by @annevk, @jeffkaufman, @mozfreddyb, @troglotit)
-
Extend SRI to apply to <link rel=preload> w3c/webappsec-subresource-integrity#26 (2 comments by @annevk, @littledan)
-
w3c/webappsec
-
1 issue received 1 new comment.
w3c/webappsec-credential-management
-
1 issue opened.
-
Username/ID hint for navigator.credentials.get() w3c/webappsec-credential-management#144, by @oreoshake.
-
Participants
-
1 organization left.
-
SEEROO Information Co., Ltd left.
-
GitHub
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Remove "*" from allow="" w3c/webappsec-permissions-policy#348, by @jan-ivar.
-
Request infomation on the serial proposal w3c/webappsec-permissions-policy#342, by @ghost.
-
-
1 issue closed.
-
Remove [NoInterfaceObject] w3c/webappsec-permissions-policy#341.
-
-
2 issues received 3 new comments.
-
Request infomation on the serial proposal w3c/webappsec-permissions-policy#342 (2 comments by @ghost, @Malvoz)
-
Architecture discussion: Permissions w3c/webappsec-permissions-policy#298 (1 comment by @equalsJeffH)
-
-
5 pull requests opened.
-
Add `navigation-override` to standardized features w3c/webappsec-permissions-policy#347, by @Malvoz.
-
Add `focus-without-user-activation` to experimental features w3c/webappsec-permissions-policy#346, by @Malvoz.
-
Add `battery` feature identifier for the Battery Status API w3c/webappsec-permissions-policy#345, by @Malvoz.
-
Move `publickey-credentials` from proposed to standardized feature w3c/webappsec-permissions-policy#344, by @Malvoz.
-
Update features.md with latest WebXR changes w3c/webappsec-permissions-policy#343, by @toji.
-
-
3 pull requests merged.
-
Add `battery` feature identifier for the Battery Status API w3c/webappsec-permissions-policy#345.
-
Update features.md with latest WebXR changes w3c/webappsec-permissions-policy#343.
-
Move `publickey-credentials` from proposed to standardized feature w3c/webappsec-permissions-policy#344.
-
-
2 pull requests received 2 new comments.
-
Add `battery` feature identifier for the Battery Status API w3c/webappsec-permissions-policy#345 (1 comment by @clelland)
-
Move `publickey-credentials` from proposed to standardized feature w3c/webappsec-permissions-policy#344 (1 comment by @clelland)
-
w3c/trusted-types
-
6 issues opened.
-
Handle non-DOM APIs of loading scripts comprehensively. w3c/trusted-types#232, by @koto.
-
Attribute change steps should not throw w3c/trusted-types#229, by @koto.
-
<iframe> and data: URLs? w3c/trusted-types#228, by @domenic.
-
Overriding innerText and textContent does not work w3c/trusted-types#227, by @domenic.
-
Trusted Types - bad name? w3c/trusted-types#225, by @zcorpan.
-
Add multiple params to TrustedTypePolicyOptions callback w3c/trusted-types#224, by @koto.
-
-
6 issues closed.
-
Double check sources of IDL blocks w3c/trusted-types#154.
-
Add multiple params to TrustedTypePolicyOptions callback w3c/trusted-types#224.
-
How to handle <template>? w3c/trusted-types#42.
-
Event handler path not checking right name w3c/trusted-types#141.
-
<iframe> and data: URLs? w3c/trusted-types#228.
-
Trusted Types - bad name? w3c/trusted-types#225.
-
-
10 issues received 21 new comments.
-
Trusted Types - bad name? w3c/trusted-types#225 (6 comments by @boazsender, @koto, @rwaldron, @zcorpan)
-
How does this work when you have a dependency included twice? w3c/trusted-types#222 (2 comments by @koto)
-
-
3 pull requests opened.
-
Small spec fixes. w3c/trusted-types#230, by @koto.
-
Correct spelling mistake w3c/trusted-types#226, by @nitinsurana.
-
4 pull requests merged.
-
Fix #224. w3c/trusted-types#231.
-
Small spec fixes. w3c/trusted-types#230.
-
Add missing externs w3c/trusted-types#217.
-
Correct spelling mistake w3c/trusted-types#226.
-
-
2 pull requests received 4 new comments.
w3c/webappsec-clear-site-data
-
1 pull request opened.
-
Fix broken links to RFC 7230 w3c/webappsec-clear-site-data#62, by @Malvoz.
-
-
1 pull request received 1 new comment.
w3c/permissions
-
1 pull request opened.
-
Add nfc permission. w3c/permissions#201, by @riju.
-
-
1 pull request merged.
-
Add nfc permission. w3c/permissions#201.
-
-
3 pull requests received 11 new comments.
-
Rename 'display' permission to 'display-capture'. w3c/permissions#188 (4 comments by @jan-ivar, @marcoscaceres)
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
w3c/webappsec-csp
-
1 issue opened.
-
recapture bug w3c/webappsec-csp#412, by @Ronsekaon.
-
-
1 issue received 3 new comments.
w3c/webappsec-credential-management
-
1 pull request opened.
-
update index.html to match index.src.html w3c/webappsec-credential-management#143, by @equalsJeffH.
-
-
1 pull request merged.
-
update index.html to match index.src.html w3c/webappsec-credential-management#143.
-
-
1 pull request received 1 new comment.
-
Add Feature Policy support for WebAuthn w3c/webappsec-credential-management#138 (1 comment by @equalsJeffH)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Republish spec? w3c/webappsec-secure-contexts#68, by @marcoscaceres.
-
w3c/webappsec-change-password-url
-
1 issue opened.
-
Clarify that redirects should be followed to resolve the Change Password URL w3c/webappsec-change-password-url#15, by @rmondello.
-
-
3 issues closed.
-
Restrict redirection status codes to temporary ones w3c/webappsec-change-password-url#13.
-
Consider restricting the target of the redirect to be same-origin w3c/webappsec-change-password-url#8.
-
Punycode? w3c/webappsec-change-password-url#3.
-
-
4 issues received 8 new comments.
-
Consider ways of differentiating implementation and poor error pages w3c/webappsec-change-password-url#14 (5 comments by @groovecoder, @oliverdunk, @rmondello)
-
Restrict redirection status codes to temporary ones w3c/webappsec-change-password-url#13 (1 comment by @hober)
-
Consider restricting the target of the redirect to be same-origin w3c/webappsec-change-password-url#8 (1 comment by @hober)
-
w3c/webappsec-referrer-policy
-
1 issue received 3 new comments.
-
Inconsistencies with "same-origin" requests w3c/webappsec-referrer-policy#123 (3 comments by @domfarolino, @mikewest, @yutakahirano)
-
-
4 pull requests opened.
-
Codify user agent flexibility with regard to referrer values. w3c/webappsec-referrer-policy#127, by @mikewest.
-
Strip referrer information from non-secure requests. w3c/webappsec-referrer-policy#126, by @mikewest.
-
Default to 'strict-origin-when-cross-origin'. w3c/webappsec-referrer-policy#125, by @mikewest.
-
Make 'unsafe-url' an alias for 'no-referrer-when-downgrade' w3c/webappsec-referrer-policy#124, by @mikewest.
-
-
2 pull requests merged.
-
Limit `referer` header's value to 4k. w3c/webappsec-referrer-policy#122.
-
Codify user agent flexibility with regard to referrer values. w3c/webappsec-referrer-policy#127.
-
-
5 pull requests received 20 new comments.
-
Make 'unsafe-url' an alias for 'no-referrer-when-downgrade' w3c/webappsec-referrer-policy#124 (10 comments by @annevk, @domenic, @ericlaw1979, @mikewest)
-
Default to 'strict-origin-when-cross-origin'. w3c/webappsec-referrer-policy#125 (5 comments by @annevk, @domenic, @ehsan, @mikewest)
-
Codify user agent flexibility with regard to referrer values. w3c/webappsec-referrer-policy#127 (2 comments by @mikewest)
-
Strip referrer information from non-secure requests. w3c/webappsec-referrer-policy#126 (2 comments by @fmarier, @mikewest)
-
w3c/webappsec-fetch-metadata
-
1 issue closed.
-
Interaction with Structured Headers w3c/webappsec-fetch-metadata#40.
-
-
1 issue received 5 new comments.
-
Naming for new items in `mode`. w3c/webappsec-fetch-metadata#45 (5 comments by @annevk, @arturjanc, @mikewest)
-
w3c/webcrypto
-
1 issue opened.
-
Using Math.getRandomValues() ? w3c/webcrypto#227, by @plehegar.
-
w3c/webappsec
-
1 issue closed.
-
CSP in single-page applications w3c/webappsec#519.
-
-
1 issue received 1 new comment.
-
[upgrade-insecure-requests] doc reference to wrong document w3c/webappsec#525 (1 comment by @Malvoz)
-
-
1 pull request opened.
-
Update shortname to ui-security w3c/webappsec#558, by @Malvoz.
-
w3c/webappsec-uisecurity
-
1 pull request opened.
-
Update shortname to ui-security w3c/webappsec-uisecurity#13, by @Malvoz.
-
-
1 pull request closed.
-
Update shortname to ui-security w3c/webappsec-uisecurity#13.
-
-
1 pull request received 2 new comments.
GitHub
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Remove [NoInterfaceObject] w3c/webappsec-permissions-policy#341, by @saschanaz.
-
Add display-capture w3c/webappsec-permissions-policy#339, by @annevk.
-
-
1 issue closed.
-
Add display-capture w3c/webappsec-permissions-policy#339.
-
-
5 issues received 6 new comments.
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273 (2 comments by @clelland, @ehsan-karamad)
-
Where is https://github.com/WICG/feature-policy/blob/gh-pages/features.md#sensor-features w3c/webappsec-permissions-policy#183 (1 comment by @Sergio16T)
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (1 comment by @mikewest)
-
Need to define how 'src' works with sandboxed frames w3c/webappsec-permissions-policy#230 (1 comment by @annevk)
-
-
2 pull requests opened.
-
[webappsec-feature-policy] Align with Web IDL specification w3c/webappsec-permissions-policy#340, by @autokagami.
-
webauthn => publickey-credentials w3c/webappsec-permissions-policy#338, by @Malvoz.
-
-
4 pull requests merged.
-
Add `display-capture` feature w3c/webappsec-permissions-policy#323.
-
Explain why we need more than the `loading` attribute w3c/webappsec-permissions-policy#333.
-
Add explicit [Exposed] w3c/webappsec-permissions-policy#334.
-
webauthn => publickey-credentials w3c/webappsec-permissions-policy#338.
-
-
1 pull request closed.
-
[webappsec-feature-policy] Align with Web IDL specification w3c/webappsec-permissions-policy#340.
-
-
5 pull requests received 7 new comments.
-
[webappsec-feature-policy] Align with Web IDL specification w3c/webappsec-permissions-policy#340 (2 comments by @clelland, @jpchase)
-
Explain why we need more than the `loading` attribute w3c/webappsec-permissions-policy#333 (1 comment by @clelland)
-
add webauthn as proposed feature (FP issue #168) w3c/webappsec-permissions-policy#306 (1 comment by @equalsJeffH)
-
w3c/trusted-types
-
5 issues opened.
-
Handle innerHTML of svg in IE w3c/trusted-types#223, by @Siegrift.
-
How does this work when you have a dependency included twice? w3c/trusted-types#222, by @bakkot.
-
Figure out if we need `'trusted-script'` in `script-src` w3c/trusted-types#221, by @koto.
-
Consider adding TT.emptyScript w3c/trusted-types#218, by @koto.
-
Intent to Migrate: Trusted Types w3c/trusted-types#215, by @koto.
-
-
3 issues closed.
-
Intent to Migrate: Trusted Types w3c/trusted-types#215.
-
Support a truly report-only and debuggable default policy w3c/trusted-types#209.
-
Bypass via HTMLAnchorElement properties w3c/trusted-types#64.
-
-
5 issues received 8 new comments.
-
Expose information on status of TrustedTypes enforcement w3c/trusted-types#36 (3 comments by @koto, @Siegrift)
-
How does this work when you have a dependency included twice? w3c/trusted-types#222 (1 comment by @koto)
-
-
9 pull requests opened.
-
Allow for prefix wildcards. w3c/trusted-types#220, by @koto.
-
Add an article on tried & rejected alternatives to TT w3c/trusted-types#219, by @mikesamuel.
-
Add missing externs w3c/trusted-types#217, by @Siegrift.
-
Release new version: 1.1.0 w3c/trusted-types#216, by @koto.
-
Don't throw on policy collision when policy names = * w3c/trusted-types#214, by @Siegrift.
-
Fix default policy minification error, enable some closure flags w3c/trusted-types#213, by @Siegrift.
-
First attempt at fixing #176. w3c/trusted-types#211, by @koto.
-
Build polyfill for multiple environments w3c/trusted-types#210, by @Siegrift.
-
-
6 pull requests merged.
-
Release new version: 1.1.0 w3c/trusted-types#216.
-
Build polyfill for multiple environments w3c/trusted-types#210.
-
Don't throw on policy collision when policy names = * w3c/trusted-types#214.
-
Fix default policy minification error, enable some closure flags w3c/trusted-types#213.
-
Fix #209. w3c/trusted-types#212.
-
Replace TrustedURL with calling a default policy on navigation to javascript: URLs. w3c/trusted-types#204.
-
-
1 pull request closed.
-
Add an article on tried & rejected alternatives to TT w3c/trusted-types#219.
-
-
5 pull requests received 20 new comments.
-
Add an article on tried & rejected alternatives to TT w3c/trusted-types#219 (5 comments by @koto, @mikesamuel, @Siegrift)
-
Replace TrustedURL with calling a default policy on navigation to javascript: URLs. w3c/trusted-types#204 (5 comments by @koto, @mikewest)
-
Don't throw on policy collision when policy names = * w3c/trusted-types#214 (4 comments by @koto, @Siegrift)
-
Fix default policy minification error, enable some closure flags w3c/trusted-types#213 (3 comments by @koto, @Siegrift)
-
w3c/webappsec-fetch-metadata
-
4 issues opened.
-
`<portal>` should result in a "nested" navigation. w3c/webappsec-fetch-metadata#46, by @mikewest.
-
Naming for new items in `mode`. w3c/webappsec-fetch-metadata#45, by @mikewest.
-
Folding Sec-Same-Origin into Fetch Metadata? w3c/webappsec-fetch-metadata#43, by @deian.
-
Comparison does not seem to account for opaque origins w3c/webappsec-fetch-metadata#41, by @annevk.
-
-
4 issues closed.
-
Comparison does not seem to account for opaque origins w3c/webappsec-fetch-metadata#41.
-
Treat http://foo.com -> https://foo.com requests as `Sec-Fetch-Site: cross-site`. w3c/webappsec-fetch-metadata#34.
-
Sec-Fetch-Site for service worker update request w3c/webappsec-fetch-metadata#36.
-
Behavior for payment manifests w3c/webappsec-fetch-metadata#30.
-
-
7 issues received 36 new comments.
-
Naming for new items in `mode`. w3c/webappsec-fetch-metadata#45 (16 comments by @annevk, @arturjanc, @jerryzz0, @mikewest)
-
Folding Sec-Same-Origin into Fetch Metadata? w3c/webappsec-fetch-metadata#43 (9 comments by @annevk, @arturjanc, @deian)
-
Handling iframing via <embed> / <object> w3c/webappsec-fetch-metadata#37 (4 comments by @annevk, @arturjanc)
-
Treat http://foo.com -> https://foo.com requests as `Sec-Fetch-Site: cross-site`. w3c/webappsec-fetch-metadata#34 (4 comments by @annevk, @mikewest)
-
Sending `Sec-Fetch-Site: none` after redirects from directly user-initiated requests w3c/webappsec-fetch-metadata#39 (1 comment by @arturjanc)
-
Sec-Fetch-Site for service worker update request w3c/webappsec-fetch-metadata#36 (1 comment by @mikewest)
-
-
2 pull requests opened.
-
Update references to draft-ietf-httpbis-header-structure. w3c/webappsec-fetch-metadata#44, by @jeremyroman.
-
Sec-Fetch-Site's scheme comparison should account for opaque origins. w3c/webappsec-fetch-metadata#42, by @mikewest.
-
-
2 pull requests merged.
-
Update references to draft-ietf-httpbis-header-structure. w3c/webappsec-fetch-metadata#44.
-
Sec-Fetch-Site's scheme comparison should account for opaque origins. w3c/webappsec-fetch-metadata#42.
-
-
1 pull request received 5 new comments.
-
Sec-Fetch-Site's scheme comparison should account for opaque origins. w3c/webappsec-fetch-metadata#42 (5 comments by @annevk, @mikewest)
-
w3c/webappsec-csp
-
1 issue opened.
-
Parsing multiple sources when one of them is 'none'? w3c/webappsec-csp#411, by @mozfreddyb.
-
-
3 issues received 3 new comments.
-
1 pull request opened.
-
[CSP3] Align with Web IDL specification w3c/webappsec-csp#410, by @autokagami.
-
-
1 pull request merged.
-
[CSP3] Align with Web IDL specification w3c/webappsec-csp#410.
-
w3c/webappsec-credential-management
-
1 pull request opened.
-
[credential-management-1] Align with Web IDL specification w3c/webappsec-credential-management#142, by @autokagami.
-
-
1 pull request merged.
-
[credential-management-1] Align with Web IDL specification w3c/webappsec-credential-management#142.
-
-
1 pull request closed.
-
Update README.md w3c/webappsec-credential-management#120.
-
-
1 pull request received 1 new comment.
w3c/webappsec-secure-contexts
-
1 issue received 1 new comment.
-
Consider "potentially trustworthy" for responses w3c/webappsec-secure-contexts#63 (1 comment by @annevk)
-
-
1 pull request opened.
-
Fix typo in WebIDL header w3c/webappsec-secure-contexts#67, by @maxeonyx.
-
-
1 pull request received 1 new comment.
w3c/webcrypto
-
2 issues received 2 new comments.
w3c/webappsec-cowl
-
1 issue opened.
-
What is the status of COWL? w3c/webappsec-cowl#80, by @bblfish.
-
-
1 issue received 1 new comment.
w3c/webappsec-change-password-url
-
1 issue received 1 new comment.
w3c/permissions
-
1 issue opened.
-
Screen sharing permission "display" should be "display-capture" w3c/permissions#199, by @jan-ivar.
-
-
1 issue closed.
-
Screen sharing permission "display" should be "display-capture" w3c/permissions#199.
-
-
1 issue received 1 new comment.
-
Screen sharing permission "display" should be "display-capture" w3c/permissions#199 (1 comment by @jan-ivar)
-
-
1 pull request opened.
-
Add "gamepad" permission w3c/permissions#200, by @marcoscaceres.
-
-
1 pull request received 1 new comment.
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Ability to clear specific Storage Buckets via Clear-Site-Data w3c/webappsec-clear-site-data#61, by @asutherland.
-
-
1 issue received 1 new comment.
-
Ability to clear specific Storage Buckets via Clear-Site-Data w3c/webappsec-clear-site-data#61 (1 comment by @annevk)
-
w3c/webappsec
-
1 issue received 6 new comments.
-
TPAC 2019 Agenda. w3c/webappsec#555 (6 comments by @annevk, @arturjanc, @clelland, @cyberphone, @wjmaclean, @yoavweiss)
-
-
2 pull requests opened.
-
minor corrections to tt minutes w3c/webappsec#557, by @koto.
-
add webex link w3c/webappsec#556, by @samuelweiler.
-
-
2 pull requests merged.
-
minor corrections to tt minutes w3c/webappsec#557.
-
add webex link w3c/webappsec#556.
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Inconsistencies with "same-origin" requests w3c/webappsec-referrer-policy#123, by @domfarolino.
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Relationship to Digest header w3c/webappsec-subresource-integrity#83, by @LPardue.
-
Participants
-
1 organization joined.
-
Certus Cybersecurity Solutions LLC joined.
-
GitHub
w3c/trusted-types
-
2 issues opened.
-
Support a truly report-only and debuggable default policy w3c/trusted-types#209, by @koto.
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207, by @koto.
-
-
6 issues closed.
-
adjustments to HostEnsureCanCompileStrings discard value w3c/trusted-types#144.
-
Allow for limiting the sinks that a type can be used for w3c/trusted-types#152.
-
Handling of dependent types w3c/trusted-types#6.
-
Make default policy available to tools w3c/trusted-types#185.
-
Rename the factory as available on window to window.trustedTypes. w3c/trusted-types#177.
-
Consider implicit node / subtree adoption w3c/trusted-types#49.
-
-
1 issue reopened.
-
Put safeguards around attribute nodes w3c/trusted-types#47, by @koto.
-
-
11 issues received 19 new comments.
-
Support a truly report-only and debuggable default policy w3c/trusted-types#209 (8 comments by @koto, @otherdaniel)
-
Allow guarding (dynamic) module imports - a type for module specifiers w3c/trusted-types#117 (1 comment by @koto)
-
Rename the factory as available on window to window.trustedTypes. w3c/trusted-types#177 (1 comment by @koto)
-
-
5 pull requests opened.
-
Small changes to the spec. w3c/trusted-types#208, by @koto.
-
Add trustedTypes.defaultPolicy getter. Fixes #185. w3c/trusted-types#206, by @koto.
-
Renamed window.TrustedTypes to window.trustedTypes w3c/trusted-types#205, by @koto.
-
Replace TrustedURL with calling a default policy on navigation to javascript: URLs. w3c/trusted-types#204, by @koto.
-
Added the sink parameter to default policy call. w3c/trusted-types#203, by @koto.
-
-
4 pull requests merged.
-
Small changes to the spec. w3c/trusted-types#208.
-
Add trustedTypes.defaultPolicy getter. Fixes #185. w3c/trusted-types#206.
-
Renamed window.TrustedTypes to window.trustedTypes w3c/trusted-types#205.
-
Added the sink parameter to default policy call. w3c/trusted-types#203.
-
-
1 pull request reopened.
-
Renamed window.TrustedTypes to window.trustedTypes w3c/trusted-types#205, by @koto.
-
-
5 pull requests received 5 new comments.
-
Trimming the violating value to 40 characters, not the whole sample. w3c/trusted-types#200 (1 comment by @koto)
-
Removed getExposedPolicy() and the exposed flag from createPolicy(). w3c/trusted-types#171 (1 comment by @koto)
w3c/webappsec-permissions-policy
-
3 issues opened.
-
allow="" attribute model w3c/webappsec-permissions-policy#337, by @annevk.
-
rename "webauthn" feature-identifier token to be "publickey-credentials" w3c/webappsec-permissions-policy#335, by @equalsJeffH.
-
HTTP headers not registered with IANA w3c/webappsec-permissions-policy#331, by @clelland.
-
-
2 issues closed.
-
rename "webauthn" feature-identifier token to be "publickey-credentials" w3c/webappsec-permissions-policy#335.
-
Feature-Identifier value for WebAuthn? w3c/webappsec-permissions-policy#168.
-
-
5 issues received 17 new comments.
-
Architecture discussion: Permissions w3c/webappsec-permissions-policy#298 (7 comments by @annevk, @clelland, @equalsJeffH)
-
Need to define how 'src' works with sandboxed frames w3c/webappsec-permissions-policy#230 (5 comments by @annevk, @bzbarsky, @clelland)
-
Feature-Identifier value for WebAuthn? w3c/webappsec-permissions-policy#168 (2 comments by @equalsJeffH)
-
-
6 pull requests opened.
-
rename 'webauthn' feature-identifier token to 'publickey-credentials' w3c/webappsec-permissions-policy#336, by @equalsJeffH.
-
Add explicit [Exposed] w3c/webappsec-permissions-policy#334, by @saschanaz.
-
Explain why we need more than the `loading` attribute w3c/webappsec-permissions-policy#333, by @Malvoz.
-
Create decoding-image-default-sync.md w3c/webappsec-permissions-policy#332, by @Malvoz.
-
Add `webauthn` feature (fix #306) w3c/webappsec-permissions-policy#330, by @Malvoz.
-
Fix broken link to Page Lifecycle's feature-policies w3c/webappsec-permissions-policy#329, by @Malvoz.
-
-
4 pull requests merged.
-
rename 'webauthn' feature-identifier token to 'publickey-credentials' w3c/webappsec-permissions-policy#336.
-
Create document-policy-explainer.md w3c/webappsec-permissions-policy#328.
-
Add `webauthn` feature (fix #306) w3c/webappsec-permissions-policy#330.
-
Fix broken link to Page Lifecycle's feature-policies w3c/webappsec-permissions-policy#329.
-
-
1 pull request closed.
-
add webauthn as proposed feature (FP issue #168) w3c/webappsec-permissions-policy#306.
-
-
5 pull requests received 6 new comments.
-
Create document-policy-explainer.md w3c/webappsec-permissions-policy#328 (2 comments by @annevk, @clelland)
-
add webauthn as proposed feature (FP issue #168) w3c/webappsec-permissions-policy#306 (1 comment by @equalsJeffH)
-
Fix broken link to Page Lifecycle's feature-policies w3c/webappsec-permissions-policy#329 (1 comment by @clelland)
-
w3c/webappsec-csp
-
3 issues opened.
-
Update to constructor operations w3c/webappsec-csp#409, by @Ms2ger.
-
Update spec to new IDL syntax for optional dictionaries w3c/webappsec-csp#408, by @Ms2ger.
-
Conflict in CSP reporting specs on nullable fields w3c/webappsec-csp#406, by @huchenlei.
-
-
3 issues closed.
-
The `disown-opener` directive is not the right model w3c/webappsec-csp#194.
-
I want all links on my website to be rel=noopener w3c/webappsec-csp#316.
-
Setting policy when origins are not known ahead of time w3c/webappsec-csp#24.
-
-
5 issues received 12 new comments.
-
I want all links on my website to be rel=noopener w3c/webappsec-csp#316 (6 comments by @annevk, @kdzwinel, @Malvoz)
-
CSP HTTP headers not registered with IANA w3c/webappsec-csp#404 (2 comments by @clelland, @mikewest)
-
Setting policy when origins are not known ahead of time w3c/webappsec-csp#24 (2 comments by @Malvoz, @sandinmyjoints)
-
-
1 pull request opened.
-
Add explicit [Exposed] + dictionary default value w3c/webappsec-csp#407, by @saschanaz.
-
-
1 pull request merged.
-
Add explicit [Exposed] + dictionary default value w3c/webappsec-csp#407.
-
-
1 pull request received 1 new comment.
w3c/webappsec-mixed-content
-
1 issue opened.
-
`cors-with-forced-preflight` is not a mode. w3c/webappsec-mixed-content#23, by @mikewest.
-
-
1 pull request opened.
-
Fill out Level 2 spec w3c/webappsec-mixed-content#22, by @estark37.
-
-
1 pull request merged.
-
Fill out Level 2 spec w3c/webappsec-mixed-content#22.
-
-
1 pull request received 23 new comments.
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Interaction with Structured Headers w3c/webappsec-fetch-metadata#40, by @annevk.
-
-
5 issues received 16 new comments.
-
Interaction with Structured Headers w3c/webappsec-fetch-metadata#40 (7 comments by @annevk, @mikewest)
-
Handling iframing via <embed> / <object> w3c/webappsec-fetch-metadata#37 (5 comments by @annevk, @arturjanc, @mikewest)
-
Exposing `Sec-Fetch` headers to Service Workers via Request().Headers() w3c/webappsec-fetch-metadata#38 (2 comments by @arturjanc, @mikewest)
-
Sending `Sec-Fetch-Site: none` after redirects from directly user-initiated requests w3c/webappsec-fetch-metadata#39 (1 comment by @mikewest)
-
w3c/webappsec
-
1 issue opened.
-
TPAC 2019 Agenda. w3c/webappsec#555, by @mikewest.
-
-
1 issue received 8 new comments.
-
TPAC 2019 Agenda. w3c/webappsec#555 (8 comments by @annevk, @deian, @hillbrad, @johnwilander, @Malvoz, @mikewest, @terriko)
-
w3c/webcrypto
-
1 issue opened.
-
Allow arbitrary ECDSA curves. w3c/webcrypto#225, by @MicahZoltu.
-
-
1 issue received 1 new comment.
w3c/webappsec-credential-management
-
2 issues opened.
-
Feature Request: Ability to store public/private keys from crypto.subtle.generateKey w3c/webappsec-credential-management#141, by @ThisIsMissEm.
-
Update spec to new IDL syntax for optional dictionaries w3c/webappsec-credential-management#140, by @Ms2ger.
-
-
1 issue received 2 new comments.
-
feature policy for the various credential types: per-credential? all-included? w3c/webappsec-credential-management#135 (2 comments by @equalsJeffH)
-
-
1 pull request opened.
-
Add default dictionary value w3c/webappsec-credential-management#139, by @saschanaz.
-
-
1 pull request received 1 new comment.
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
URL's `port` is `null` if default value. w3c/webappsec-upgrade-insecure-requests#18, by @mikewest.
-
w3c/permissions
-
2 issues opened.
-
"Changes to this document may be tracked at" points to incorrect repo ? w3c/permissions#198, by @equalsJeffH.
-
`MidiPermissionDescriptor` in example 1 is confusing w3c/permissions#197, by @equalsJeffH.
-
-
1 issue reopened.
-
Allow Permissions Policy-based permission models w3c/permissions#185, by @jan-ivar.
-
-
1 issue received 6 new comments.
-
Allow Permissions Policy-based permission models w3c/permissions#185 (6 comments by @jan-ivar, @jyasskin, @raymeskhoury)
-
-
1 pull request opened.
-
Direct Connection Permission w3c/permissions#196, by @lgrahl.
-
GitHub
w3c/webappsec-permissions-policy
-
1 issue opened.
-
"All" directive should be a possible feature name w3c/webappsec-permissions-policy#327, by @emilfihlman.
-
-
6 issues closed.
-
Should document.domain setter be considered different than 'self' ? w3c/webappsec-permissions-policy#253.
-
Architecture discussion: Document Policies w3c/webappsec-permissions-policy#299.
-
"All" directive should be a possible feature name w3c/webappsec-permissions-policy#327.
-
Explicit export/definition for "payment" w3c/webappsec-permissions-policy#154.
-
How vibrate will work with Feature Policy given the user gesture requirement? w3c/webappsec-permissions-policy#58.
-
Provide example(s) of enabling disabled-by-default feature(s) w3c/webappsec-permissions-policy#45.
-
-
12 issues received 19 new comments.
-
What happened to the webrtc feature? w3c/webappsec-permissions-policy#250 (4 comments by @clelland, @lgrahl, @Malvoz)
-
"All" directive should be a possible feature name w3c/webappsec-permissions-policy#327 (3 comments by @clelland, @emilfihlman, @igrigorik)
-
Allow document.cookie and maybe Set-Cookie from the server to be controlled w3c/webappsec-permissions-policy#85 (2 comments by @clelland, @Malvoz)
-
Need to define how 'src' works with sandboxed frames w3c/webappsec-permissions-policy#230 (2 comments by @clelland)
-
Should document.domain setter be considered different than 'self' ? w3c/webappsec-permissions-policy#253 (1 comment by @clelland)
-
Architecture discussion: Sandbox policies w3c/webappsec-permissions-policy#300 (1 comment by @clelland)
-
Architecture discussion: Document Policies w3c/webappsec-permissions-policy#299 (1 comment by @clelland)
-
Dividing features across different types of policies w3c/webappsec-permissions-policy#296 (1 comment by @clelland)
-
Explicit export/definition for "payment" w3c/webappsec-permissions-policy#154 (1 comment by @clelland)
-
How vibrate will work with Feature Policy given the user gesture requirement? w3c/webappsec-permissions-policy#58 (1 comment by @clelland)
-
Provide example(s) of enabling disabled-by-default feature(s) w3c/webappsec-permissions-policy#45 (1 comment by @clelland)
-
-
5 pull requests opened.
-
Create document-policy-explainer.md w3c/webappsec-permissions-policy#328, by @clelland.
-
Change same-origin-domain check to same-origin. w3c/webappsec-permissions-policy#326, by @clelland.
-
Remove algorithms no longer needed w3c/webappsec-permissions-policy#325, by @dtapuska.
-
Expose new algorithms to create a Feature Policy before document is c… w3c/webappsec-permissions-policy#324, by @dtapuska.
-
Add `display-capture` feature w3c/webappsec-permissions-policy#323, by @Malvoz.
-
-
3 pull requests merged.
-
Change same-origin-domain check to same-origin. w3c/webappsec-permissions-policy#326.
-
Remove algorithms no longer needed w3c/webappsec-permissions-policy#325.
-
Expose new algorithms to create a Feature Policy before document is c… w3c/webappsec-permissions-policy#324.
-
-
3 pull requests received 33 new comments.
-
Create document-policy-explainer.md w3c/webappsec-permissions-policy#328 (24 comments by @clelland, @eeeps, @foolip, @huchenlei, @Malvoz, @sideshowbarker)
-
Expose new algorithms to create a Feature Policy before document is c… w3c/webappsec-permissions-policy#324 (7 comments by @clelland, @dtapuska)
-
Remove algorithms no longer needed w3c/webappsec-permissions-policy#325 (2 comments by @clelland, @dtapuska)
-
w3c/webappsec-fetch-metadata
-
4 issues opened.
-
Sending `Sec-Fetch-Site: none` after redirects from directly user-initiated requests w3c/webappsec-fetch-metadata#39, by @arturjanc.
-
Exposing `Sec-Fetch` headers to Service Workers via Request().Headers() w3c/webappsec-fetch-metadata#38, by @arturjanc.
-
Handling iframing via <embed> / <object> w3c/webappsec-fetch-metadata#37, by @arturjanc.
-
Sec-Fetch-Site for service worker update request w3c/webappsec-fetch-metadata#36, by @makotoshimazu.
-
-
1 issue closed.
-
Decide on the proper `mode' value for CORS preflight requests w3c/webappsec-fetch-metadata#35.
-
-
2 issues received 7 new comments.
-
Decide on the proper `mode' value for CORS preflight requests w3c/webappsec-fetch-metadata#35 (5 comments by @annevk, @mikewest)
-
Sec-Fetch-Site for service worker update request w3c/webappsec-fetch-metadata#36 (2 comments by @arturjanc, @makotoshimazu)
-
w3c/webappsec-csp
-
3 issues opened.
-
Resolving 'self' within srcdoc iframe w3c/webappsec-csp#405, by @ckerschb.
-
CSP HTTP headers not registered with IANA w3c/webappsec-csp#404, by @SmashManiac.
-
CSP domain.com vs domain.com/ with slash w3c/webappsec-csp#403, by @laukstein.
-
-
1 issue closed.
-
CSP domain.com vs domain.com/ with slash w3c/webappsec-csp#403.
-
-
5 issues received 12 new comments.
-
CSP domain.com vs domain.com/ with slash w3c/webappsec-csp#403 (6 comments by @annevk, @dveditz, @laukstein)
-
w3c/webcrypto
-
1 issue opened.
-
Please add support for chacha20-poly1305 w3c/webcrypto#223, by @cryptomilk.
-
-
1 pull request opened.
-
Fix some typos in the specification w3c/webcrypto#224, by @tniessen.
-
w3c/trusted-types
-
2 issues opened.
-
Remove TrustedURL requirement for non-navigational sinks. w3c/trusted-types#192, by @koto.
-
Add a target suitable for nodejs. w3c/trusted-types#190, by @koto.
-
-
13 issues closed.
-
Why is there no type for style / CSS? w3c/trusted-types#104.
-
Specify the enforcement for non HTML namespaces w3c/trusted-types#183.
-
Remove TrustedURL requirement for non-navigational sinks. w3c/trusted-types#192.
-
Consider metadata API; building blocks for HTML sanitizers w3c/trusted-types#43.
-
Add additional context to the default policy invocations w3c/trusted-types#131.
-
Per-type enforcement w3c/trusted-types#66.
-
Suggestion: Use different switch/flag than CSP w3c/trusted-types#1.
-
Figure out what to do with cross-document interactions w3c/trusted-types#50.
-
Define rules for TT when multiple headers are present w3c/trusted-types#178.
-
Finalize the header syntax w3c/trusted-types#182.
-
Specify the violation events w3c/trusted-types#184.
-
Bypass via insertAdjacentText w3c/trusted-types#133.
-
Handle srcset attributes w3c/trusted-types#139.
-
-
17 issues received 24 new comments.
-
Define rules for TT when multiple headers are present w3c/trusted-types#178 (3 comments by @koto, @mikesamuel)
-
Allow guarding (dynamic) module imports - a type for module specifiers w3c/trusted-types#117 (2 comments by @mikesamuel)
-
Rename the factory as available on window to window.trustedTypes. w3c/trusted-types#177 (1 comment by @mikesamuel)
-
15 pull requests opened.
-
Added text to security considerations. w3c/trusted-types#202, by @koto.
-
Added non-goals and use cases. w3c/trusted-types#201, by @koto.
-
Trimming the violating value to 40 characters, not the whole sample. w3c/trusted-types#200, by @koto.
-
Added enforcement for SVG sinks. w3c/trusted-types#199, by @koto.
-
Removed TrustedURL for non-navigational sinks. w3c/trusted-types#198, by @koto.
-
Added get{Property|Attribute}Type definition. w3c/trusted-types#197, by @koto.
-
Updated the dependencies. w3c/trusted-types#196, by @koto.
-
Allowed the policy create* functions to accept multiple arguments (the first one will be stringified). w3c/trusted-types#195, by @koto.
-
Specified the sink names to use for violation events. w3c/trusted-types#194, by @koto.
-
Editorial changes. w3c/trusted-types#193, by @koto.
-
Rewrote the spec to integrate the header with CSP w3c/trusted-types#191, by @koto.
-
Protect text node manipulation under script elements. Fixes #133. w3c/trusted-types#189, by @koto.
-
Fix the poisoned proto in tests. w3c/trusted-types#188, by @koto.
-
Bugfix: Call the IE range hack on install(). w3c/trusted-types#187, by @koto.
-
Update demo w3c/trusted-types#186, by @Siegrift.
-
-
16 pull requests merged.
-
Added text to security considerations. w3c/trusted-types#202.
-
Added non-goals and use cases. w3c/trusted-types#201.
-
Trimming the violating value to 40 characters, not the whole sample. w3c/trusted-types#200.
-
Added enforcement for SVG sinks. w3c/trusted-types#199.
-
Removed TrustedURL for non-navigational sinks. w3c/trusted-types#198.
-
Added get{Property|Attribute}Type definition. w3c/trusted-types#197.
-
Updated the dependencies. w3c/trusted-types#196.
-
Specified the sink names to use for violation events. w3c/trusted-types#194.
-
Editorial changes. w3c/trusted-types#193.
-
Rewrote the spec to integrate the header with CSP w3c/trusted-types#191.
-
Protect text node manipulation under script elements. Fixes #133. w3c/trusted-types#189.
-
Fix the poisoned proto in tests. w3c/trusted-types#188.
-
Bugfix: Call the IE range hack on install(). w3c/trusted-types#187.
-
Rewrote CSP & EcmaScript integration w3c/trusted-types#170.
-
Update demo w3c/trusted-types#186.
-
-
1 pull request closed.
-
enforcement for `<img srcset>` w3c/trusted-types#140.
-
-
2 pull requests received 7 new comments.
w3c/permissions
-
2 issues opened.
-
tcp/udp permission w3c/permissions#195, by @jimmywarting.
-
Consider making `request-permission-to-use` aware of user activation w3c/permissions#194, by @engedy.
-
-
1 issue closed.
-
tcp/udp permission w3c/permissions#195.
-
-
2 issues received 5 new comments.
-
Consider making `request-permission-to-use` aware of user activation w3c/permissions#194 (4 comments by @engedy, @jyasskin, @mustaqahmed)
-
w3c/webappsec-mixed-content
-
1 issue closed.
-
Definition of "unauthenticated response" actually defining "authenticated response"? w3c/webappsec-mixed-content#19.
-
-
1 pull request opened.
-
Add MIX level 2 skeleton w3c/webappsec-mixed-content#21, by @estark37.
-
-
2 pull requests merged.
-
Fix typo in "unauthenticated response" definition. w3c/webappsec-mixed-content#20.
-
Add MIX level 2 skeleton w3c/webappsec-mixed-content#21.
-
-
1 pull request received 5 new comments.
w3c/webappsec
-
1 issue closed.
-
Adopt Fetch Metadata as a deliverable. w3c/webappsec#550.
-
-
2 issues received 4 new comments.
w3c/webappsec-subresource-integrity
-
5 issues closed.
-
Consider feature detection w3c/webappsec-subresource-integrity#37.
-
What about RDF ? w3c/webappsec-subresource-integrity#76.
-
Add an SRI control as either a CSP directive or a new header w3c/webappsec-subresource-integrity#23.
-
JavaScript crossorigin vs crossOrigin attribute w3c/webappsec-subresource-integrity#24.
-
The design fails to make a secure guarantee w3c/webappsec-subresource-integrity#80.
-
-
3 issues received 5 new comments.
-
Require that proxies do not modify integrity checked assets w3c/webappsec-subresource-integrity#60 (1 comment by @mozfreddyb)
-
Add an SRI control as either a CSP directive or a new header w3c/webappsec-subresource-integrity#23 (1 comment by @mozfreddyb)
-
1 pull request opened.
-
Revert `require-sri-for` w3c/webappsec-subresource-integrity#82, by @mozfreddyb.
-
-
1 pull request merged.
-
Revert `require-sri-for` w3c/webappsec-subresource-integrity#82.
-
-
1 pull request received 4 new comments.
-
Revert `require-sri-for` w3c/webappsec-subresource-integrity#82 (4 comments by @devd, @MaceWindu, @mozfreddyb)
-
TR publications
-
1 document published.
-
Fetch Metadata Request Headers published as a First Public Working Draft. History of Fetch Metadata Request Headers
-
GitHub
w3c/webappsec-fetch-metadata
-
2 issues opened.
-
Decide on the proper `mode' value for CORS preflight requests w3c/webappsec-fetch-metadata#35, by @arturjanc.
-
Treat http://foo.com -> https://foo.com requests as `Sec-Fetch-Site: cross-site`. w3c/webappsec-fetch-metadata#34, by @anforowicz.
-
-
3 pull requests opened.
-
move w3c stylesheet last w3c/webappsec-fetch-metadata#33, by @samuelweiler.
-
fpwd date fix w3c/webappsec-fetch-metadata#32, by @samuelweiler.
-
fpwd minor fixes w3c/webappsec-fetch-metadata#31, by @samuelweiler.
-
-
3 pull requests merged.
-
move w3c stylesheet last w3c/webappsec-fetch-metadata#33.
-
fpwd date fix w3c/webappsec-fetch-metadata#32.
-
fpwd minor fixes w3c/webappsec-fetch-metadata#31.
-
w3c/webappsec-csp
-
4 issues opened.
-
Integration with document.open() w3c/webappsec-csp#402, by @TimothyGu.
-
Define interaction between script-src / trusted-types w3c/webappsec-csp#401, by @mikesamuel.
-
frame-src spec does not match implementations in terms of which CSP is used w3c/webappsec-csp#400, by @bzbarsky.
-
Support 'strict-dynamic' in style-src w3c/webappsec-csp#399, by @arturjanc.
-
-
2 issues closed.
-
Missing description in the Spec for Level 3 w3c/webappsec-csp#386.
-
Scripts only in <head> w3c/webappsec-csp#395.
-
-
4 issues received 16 new comments.
-
frame-src spec does not match implementations in terms of which CSP is used w3c/webappsec-csp#400 (8 comments by @bzbarsky, @dveditz)
-
clarify whether csp blocks reflection of non-string arguments to eval w3c/webappsec-csp#201 (1 comment by @mikesamuel)
-
w3c/trusted-types
-
6 issues opened.
-
Make default policy available to tools w3c/trusted-types#185, by @mikesamuel.
-
Specify the violation events w3c/trusted-types#184, by @koto.
-
Specify the enforcement for non HTML namespaces w3c/trusted-types#183, by @koto.
-
Finalize the header syntax w3c/trusted-types#182, by @koto.
-
Define rules for TT when multiple headers are present w3c/trusted-types#178, by @koto.
-
Rename the factory as available on window to window.trustedTypes. w3c/trusted-types#177, by @koto.
-
-
6 issues closed.
-
setTimeout sink needs to allow Function w3c/trusted-types#159.
-
Non-normative note on 2 argument form of document.open. w3c/trusted-types#160.
-
Explain the Trusted Type behavior as an IDL attribute w3c/trusted-types#132.
-
Consider adding a link and examples to the built in sanitizers ? w3c/trusted-types#148.
-
Use once semantic w3c/trusted-types#175.
-
Figure out Function constructor + TrustedScript w3c/trusted-types#174.
-
-
1 issue reopened.
-
Figure out what to do with cross-document interactions w3c/trusted-types#50, by @koto.
-
-
10 issues received 15 new comments.
-
Allow for limiting the sinks that a type can be used for w3c/trusted-types#152 (3 comments by @engelsdamien, @koto)
-
3 pull requests opened.
-
Added proper annotations to the spec algorithms. w3c/trusted-types#181, by @koto.
-
edit docs w3c/trusted-types#180, by @mikesamuel.
-
CSP3 integration docs w3c/trusted-types#179, by @mikesamuel.
-
-
4 pull requests merged.
-
Added proper annotations to the spec algorithms. w3c/trusted-types#181.
-
Added TrustedTypes extended attribute to spec w3c/trusted-types#168.
-
edit docs w3c/trusted-types#180.
-
CSP3 integration docs w3c/trusted-types#179.
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Feature-Policy: clipboard-read and clipboard-write w3c/webappsec-permissions-policy#322, by @bershanskiy.
-
Feature idea: non-strict-mode w3c/webappsec-permissions-policy#320, by @Jamesernator.
-
-
1 issue reopened.
-
Effect of vertical-scroll policy w3c/webappsec-permissions-policy#278, by @clelland.
-
-
4 issues received 7 new comments.
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273 (3 comments by @craigfrancis, @ehsan-karamad)
-
Architecture discussion: Permissions w3c/webappsec-permissions-policy#298 (2 comments by @clelland, @eeeps)
-
Dividing features across different types of policies w3c/webappsec-permissions-policy#296 (1 comment by @eeeps)
-
-
1 pull request opened.
-
Fix spec link in focus-without-user-activation Policy w3c/webappsec-permissions-policy#321, by @foolip.
-
-
3 pull requests merged.
-
Fix spec link in focus-without-user-activation Policy w3c/webappsec-permissions-policy#321.
-
features.md: Add 'loading-image-default-eager'. w3c/webappsec-permissions-policy#315.
-
Clarify wording of non-Window global scopes issue w3c/webappsec-permissions-policy#307.
-
-
3 pull requests received 4 new comments.
-
add webauthn as proposed feature (FP issue #168) w3c/webappsec-permissions-policy#306 (2 comments by @clelland, @equalsJeffH)
-
Fix spec link in focus-without-user-activation Policy w3c/webappsec-permissions-policy#321 (1 comment by @clelland)
-
features.md: Add 'loading-image-default-eager'. w3c/webappsec-permissions-policy#315 (1 comment by @clelland)
-
w3c/webappsec-change-password-url
-
2 issues opened.
-
Consider ways of differentiating implementation and poor error pages w3c/webappsec-change-password-url#14, by @oliverdunk.
-
Restrict redirection status codes to temporary ones w3c/webappsec-change-password-url#13, by @tregagnon.
-
-
1 issue received 1 new comment.
-
Restrict redirection status codes to temporary ones w3c/webappsec-change-password-url#13 (1 comment by @hober)
-
w3c/webcrypto
-
1 issue opened.
-
Should CryptoKey be marked [Serializable] in IDL? w3c/webcrypto#222, by @bzbarsky.
-
-
3 issues received 8 new comments.
-
Should CryptoKey be marked [Serializable] in IDL? w3c/webcrypto#222 (2 comments by @annevk, @domenic)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @jimmywarting)
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Increasing granularity of storage directive w3c/webappsec-clear-site-data#60, by @asakusuma.
-
-
1 issue closed.
-
Increasing granularity of storage directive w3c/webappsec-clear-site-data#60.
-
-
2 issues received 5 new comments.
-
Increasing granularity of storage directive w3c/webappsec-clear-site-data#60 (4 comments by @annevk, @asakusuma)
-
Normative spec doesn't necessarily terminate service workers w3c/webappsec-clear-site-data#54 (1 comment by @jungkees)
-
w3c/permissions
-
1 issue received 2 new comments.
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
A new IntegrityCheckFailure event w3c/webappsec-subresource-integrity#77 (1 comment by @domfarolino)
-
w3c/webappsec
-
1 pull request opened.
-
Add missing specifications, update links to HTTPS w3c/webappsec#554, by @Malvoz.
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Use of "incumbent settings object" in "Policy inheritance" section does not make sense w3c/webappsec-upgrade-insecure-requests#17, by @bzbarsky.
-
-
1 issue received 1 new comment.
-
Use of "incumbent settings object" in "Policy inheritance" section does not make sense w3c/webappsec-upgrade-insecure-requests#17 (1 comment by @annevk)
-
w3c/webappsec-referrer-policy
-
1 issue received 2 new comments.
-
What default policy should new features use? w3c/webappsec-referrer-policy#121 (2 comments by @annevk, @fmarier)
-
-
1 pull request opened.
-
Limit `referer` header's value to 4k. w3c/webappsec-referrer-policy#122, by @mikewest.
-
-
1 pull request received 4 new comments.
-
Limit `referer` header's value to 4k. w3c/webappsec-referrer-policy#122 (4 comments by @annevk, @arturjanc, @mikewest)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Is "file:" protocol considered a "secure context", if not why? w3c/webappsec-secure-contexts#66, by @guest271314.
-
-
1 issue received 5 new comments.
-
Is "file:" protocol considered a "secure context", if not why? w3c/webappsec-secure-contexts#66 (5 comments by @guest271314, @inexorabletash, @mkruisselbrink)
-
Participants
-
1 organization joined.
-
Mitsubishi Electric Corporation joined.
-
GitHub
w3c/webappsec-permissions-policy
-
3 issues opened.
-
"Enforce" links (and "enforce" generally) w3c/webappsec-permissions-policy#312, by @eeeps.
-
define the term "feature" w3c/webappsec-permissions-policy#309, by @equalsJeffH.
-
Feature-Policy-Report-Only: which types are supported? w3c/webappsec-permissions-policy#305, by @gi11es.
-
-
4 issues closed.
-
"Enforce" links (and "enforce" generally) w3c/webappsec-permissions-policy#312.
-
Feature-Policy-Report-Only: which types are supported? w3c/webappsec-permissions-policy#305.
-
Expose policy to javascript w3c/webappsec-permissions-policy#65.
-
Opt-in negotiation for new sandboxy features w3c/webappsec-permissions-policy#288.
-
-
10 issues received 24 new comments.
-
commas and semicolons both allowed, with different rules for overriding w3c/webappsec-permissions-policy#148 (8 comments by @annevk, @briansmith, @clelland)
-
"Enforce" links (and "enforce" generally) w3c/webappsec-permissions-policy#312 (4 comments by @clelland, @eeeps)
-
Expose policy to javascript w3c/webappsec-permissions-policy#65 (3 comments by @annevk, @clelland, @foolip)
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (2 comments by @clelland, @Jamesernator)
-
Feature-Policy-Report-Only: which types are supported? w3c/webappsec-permissions-policy#305 (2 comments by @gi11es, @maxtruxa)
-
Architecture discussion: Sandbox policies w3c/webappsec-permissions-policy#300 (1 comment by @annevk)
-
Feature-Identifier value for WebAuthn? w3c/webappsec-permissions-policy#168 (1 comment by @equalsJeffH)
-
Opt-in negotiation for new sandboxy features w3c/webappsec-permissions-policy#288 (1 comment by @clelland)
-
-
11 pull requests opened.
-
Fix wrong property name for reporting w3c/webappsec-permissions-policy#319, by @sisidovski.
-
Clarify forgiving approach for document-write policy w3c/webappsec-permissions-policy#318, by @foolip.
-
Hyphenate 'sync-xhr' policy in example w3c/webappsec-permissions-policy#317, by @foolip.
-
Don't "enforce" feature policies, set them (#312) w3c/webappsec-permissions-policy#316, by @eeeps.
-
features.md: Add 'loading-image-default-eager'. w3c/webappsec-permissions-policy#315, by @Malvoz.
-
Change semicolons separating directives in examples to commas. w3c/webappsec-permissions-policy#314, by @eeeps.
-
HTML <meta>-delivery w3c/webappsec-permissions-policy#313, by @eeeps.
-
Add definitions to other page lifecyle feature policies w3c/webappsec-permissions-policy#310, by @dtapuska.
-
Dehyphenate "web platform" w3c/webappsec-permissions-policy#308, by @foolip.
-
Clarify wording of non-Window global scopes issue w3c/webappsec-permissions-policy#307, by @foolip.
-
add webauthn as proposed feature (FP issue #168) w3c/webappsec-permissions-policy#306, by @equalsJeffH.
-
-
12 pull requests merged.
-
Fix wrong property name for reporting w3c/webappsec-permissions-policy#319.
-
Dehyphenate "web platform" w3c/webappsec-permissions-policy#308.
-
Don't "enforce" feature policies, set them (#312) w3c/webappsec-permissions-policy#316.
-
Clarify forgiving approach for document-write policy w3c/webappsec-permissions-policy#318.
-
Hyphenate 'sync-xhr' policy in example w3c/webappsec-permissions-policy#317.
-
Create focus-without-user-activation.md w3c/webappsec-permissions-policy#304.
-
Add definitions to other page lifecyle feature policies w3c/webappsec-permissions-policy#310.
-
change status to fpwd w3c/webappsec-permissions-policy#294.
-
move 'payment' from proposed to standard feature w3c/webappsec-permissions-policy#301.
-
Create loading-image-default-eager.md w3c/webappsec-permissions-policy#295.
-
Update features.md w3c/webappsec-permissions-policy#302.
-
Update loading-frame-default-eager.md w3c/webappsec-permissions-policy#303.
-
-
8 pull requests received 25 new comments.
-
HTML <meta>-delivery w3c/webappsec-permissions-policy#313 (12 comments by @annevk, @briansmith, @clelland, @eeeps, @Malvoz)
-
Create focus-without-user-activation.md w3c/webappsec-permissions-policy#304 (3 comments by @ehsan-karamad, @marian-r)
-
Clarify forgiving approach for document-write policy w3c/webappsec-permissions-policy#318 (2 comments by @clelland, @foolip)
-
Add definitions to other page lifecyle feature policies w3c/webappsec-permissions-policy#310 (2 comments by @clelland, @dtapuska)
-
Change semicolons separating directives in examples to commas. w3c/webappsec-permissions-policy#314 (2 comments by @briansmith, @eeeps)
-
move 'payment' from proposed to standard feature w3c/webappsec-permissions-policy#301 (1 comment by @clelland)
-
w3c/webappsec-fetch-metadata
-
3 issues opened.
-
Behavior for payment manifests w3c/webappsec-fetch-metadata#30, by @rsolomakhin.
-
Update Redirect section with HTTPS->HTTP behavior w3c/webappsec-fetch-metadata#29, by @ericlaw1979.
-
Why is `Sec-Fetch-Site` based on the full URL redirect chain? w3c/webappsec-fetch-metadata#28, by @anforowicz.
-
-
4 issues received 12 new comments.
-
Behavior for payment manifests w3c/webappsec-fetch-metadata#30 (6 comments by @arturjanc, @mikewest, @rsolomakhin)
-
Why is `Sec-Fetch-Site` based on the full URL redirect chain? w3c/webappsec-fetch-metadata#28 (4 comments by @anforowicz, @arturjanc)
-
Update Redirect section with HTTPS->HTTP behavior w3c/webappsec-fetch-metadata#29 (1 comment by @arturjanc)
-
`Sec-Fetch-Site` for script-based redirects w3c/webappsec-fetch-metadata#25 (1 comment by @jerryzz0)
-
w3c/trusted-types
-
10 issues opened.
-
Putting guards at primitives instead of sinks w3c/trusted-types#176, by @annevk.
-
Use once semantic w3c/trusted-types#175, by @annevk.
-
Figure out Function constructor + TrustedScript w3c/trusted-types#174, by @koto.
-
Consider adding a type for base.href w3c/trusted-types#172, by @koto.
-
Cover missing sinks w3c/trusted-types#169, by @koto.
-
Non-normative note on 2 argument form of document.open. w3c/trusted-types#160, by @mikesamuel.
-
setTimeout sink needs to allow Function w3c/trusted-types#159, by @mikesamuel.
-
Double check sources of IDL blocks w3c/trusted-types#154, by @mikesamuel.
-
Allow for limiting the sinks that a type can be used for w3c/trusted-types#152, by @briansmith.
-
Implementing createURL is too hard w3c/trusted-types#151, by @briansmith.
-
-
6 issues closed.
-
Create commonly used and harmless constants like TrustedHTML.EMPTY w3c/trusted-types#95.
-
open for extension in createPolicy last arguments w3c/trusted-types#123.
-
Implementing createURL is too hard w3c/trusted-types#151.
-
spec: maybe use `<wpt>` to link spec sections to test suite w3c/trusted-types#109.
-
Calls to document.write are not passed to the policy (Chromium) w3c/trusted-types#136.
-
Can URL policies be defined to use `URL` instead of `DOMString`? w3c/trusted-types#150.
-
-
21 issues received 57 new comments.
-
Figure out Function constructor + TrustedScript w3c/trusted-types#174 (12 comments by @koto, @mikesamuel, @otherdaniel)
-
Allow for limiting the sinks that a type can be used for w3c/trusted-types#152 (7 comments by @briansmith, @koto)
-
Implementing createURL is too hard w3c/trusted-types#151 (6 comments by @briansmith, @koto, @mikesamuel)
-
Suggestion: Use different switch/flag than CSP w3c/trusted-types#1 (3 comments by @briansmith, @koto, @mikewest)
-
Non-normative note on 2 argument form of document.open. w3c/trusted-types#160 (2 comments by @koto, @mikesamuel)
-
Can URL policies be defined to use `URL` instead of `DOMString`? w3c/trusted-types#150 (2 comments by @briansmith, @koto)
-
Create commonly used and harmless constants like TrustedHTML.EMPTY w3c/trusted-types#95 (1 comment by @koto)
-
Consider metadata API; building blocks for HTML sanitizers w3c/trusted-types#43 (1 comment by @koto)
-
Calls to document.write are not passed to the policy (Chromium) w3c/trusted-types#136 (1 comment by @koto)
-
-
16 pull requests opened.
-
Added TrustedTypes.emptyHTML implementation. w3c/trusted-types#173, by @koto.
-
Removed getExposedPolicy() and the exposed flag from createPolicy(). w3c/trusted-types#171, by @koto.
-
Rewrote CSP & EcmaScript integration w3c/trusted-types#170, by @mikesamuel.
-
Added TrustedTypes extended attribute to spec w3c/trusted-types#168, by @koto.
-
BrowserStack tests will run in 'npm test' only if access key is provided w3c/trusted-types#167, by @koto.
-
Re-enabled disabled linter rules. w3c/trusted-types#166, by @koto.
-
Removed url-allow-http policy support. w3c/trusted-types#165, by @koto.
-
Added limited support for IE 11 w3c/trusted-types#164, by @koto.
-
Don't fail the Travis tests on PRs due to missing BrowserStack key. w3c/trusted-types#163, by @koto.
-
Made the polyfill work in Edge and Safari w3c/trusted-types#162, by @koto.
-
Update section on DOM-Parsing extensions w3c/trusted-types#161, by @mikesamuel.
-
Adds use case to spec section 1.3. w3c/trusted-types#158, by @mikesamuel.
-
Added BrowserStack support (runs on Travis). w3c/trusted-types#157, by @koto.
-
Changed the title for the spec. w3c/trusted-types#156, by @koto.
-
Upgraded all NPM dependencies to their latest versions. w3c/trusted-types#155, by @koto.
-
Fix example - see #152. w3c/trusted-types#153, by @koto.
-
-
14 pull requests merged.
-
Added TrustedTypes.emptyHTML implementation. w3c/trusted-types#173.
-
Removed getExposedPolicy() and the exposed flag from createPolicy(). w3c/trusted-types#171.
-
BrowserStack tests will run in 'npm test' only if access key is provided w3c/trusted-types#167.
-
Re-enabled disabled linter rules. w3c/trusted-types#166.
-
Added a first draft of the type metadata. w3c/trusted-types#149.
-
Removed url-allow-http policy support. w3c/trusted-types#165.
-
Added limited support for IE 11 w3c/trusted-types#164.
-
Made the polyfill work in Edge and Safari w3c/trusted-types#162.
-
Don't fail the Travis tests on PRs due to missing BrowserStack key. w3c/trusted-types#163.
-
Update section on DOM-Parsing extensions w3c/trusted-types#161.
-
Added BrowserStack support (runs on Travis). w3c/trusted-types#157.
-
Changed the title for the spec. w3c/trusted-types#156.
-
Upgraded all NPM dependencies to their latest versions. w3c/trusted-types#155.
-
Fix example - see #152. w3c/trusted-types#153.
-
-
1 pull request closed.
-
spec: cleanup uses of `[TreatNullAs]` annotations w3c/trusted-types#142.
-
-
7 pull requests received 34 new comments.
-
spec: cleanup uses of `[TreatNullAs]` annotations w3c/trusted-types#142 (5 comments by @mikesamuel, @otherdaniel)
w3c/webappsec-csp
-
8 issues opened.
-
Does child-src defer to script-src? w3c/webappsec-csp#398, by @bakkot.
-
Header parsing and integration with Fetch w3c/webappsec-csp#397, by @annevk.
-
Scripts only in <head> w3c/webappsec-csp#395, by @craigfrancis.
-
Consider removing plugin-types w3c/webappsec-csp#394, by @annevk.
-
Enforce "at most once" semantics for scripts w3c/webappsec-csp#392, by @briansmith.
-
Extend `frame-ancestors` to allow resizing iframe based on its contents. w3c/webappsec-csp#391, by @briansmith.
-
Clarify behavior for cached favicon loads w3c/webappsec-csp#390, by @briansmith.
-
-
1 issue closed.
-
Extend `frame-ancestors` to allow resizing iframe based on its contents. w3c/webappsec-csp#391.
-
-
7 issues received 46 new comments.
-
Extend `frame-ancestors` to allow resizing iframe based on its contents. w3c/webappsec-csp#391 (11 comments by @annevk, @briansmith, @craigfrancis, @dveditz)
-
Any protection against dynamic module import? w3c/webappsec-csp#243 (10 comments by @briansmith, @mikesamuel)
-
Enforce "at most once" semantics for scripts w3c/webappsec-csp#392 (8 comments by @annevk, @briansmith, @dveditz)
-
Consider removing plugin-types w3c/webappsec-csp#394 (7 comments by @annevk, @briansmith, @lbherrera, @mikewest, @Sora2455)
-
Multiple CSP headers restriction is unclear w3c/webappsec-csp#215 (3 comments by @briansmith, @cnsgithub)
-
Add way to define all country code top-level domain. w3c/webappsec-csp#256 (1 comment by @laukstein)
-
-
1 pull request opened.
-
typo: s/thich/which/ w3c/webappsec-csp#393, by @mikesamuel.
-
w3c/webappsec-referrer-policy
-
2 issues opened.
-
What default policy should new features use? w3c/webappsec-referrer-policy#121, by @jeremyroman.
-
Should request's referrer uses browsing context container’s node document url in Blob url w3c/webappsec-referrer-policy#120, by @tungnh28.
-
w3c/webappsec
-
1 issue opened.
-
"UI Security" is not the correct Shortname w3c/webappsec#553, by @tabatkins.
-
-
3 issues received 5 new comments.
-
Clarify CSP header recommendations for non-HTML pages w3c/webappsec#520 (2 comments by @annevk, @briansmith)
-
1 pull request closed.
-
Merge pull request #541 from w3c/wseltzer-patch-8 w3c/webappsec#545.
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
Is it possible to do SRI on importScripts in JS? w3c/webappsec-subresource-integrity#79 (1 comment by @freshp86)
-
-
1 pull request opened.
-
Fix formatting w3c/webappsec-subresource-integrity#81, by @tom93.
-
-
1 pull request merged.
-
Fix formatting w3c/webappsec-subresource-integrity#81.
-
-
1 pull request received 2 new comments.
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Drop executionContexts? w3c/webappsec-clear-site-data#59, by @annevk.
-
-
2 issues received 5 new comments.
-
Drop executionContexts? w3c/webappsec-clear-site-data#59 (4 comments by @annevk, @asakusuma, @ericlaw1979, @wanderview)
-
Setting and clearing data in same response w3c/webappsec-clear-site-data#33 (1 comment by @kennethkufluk)
-
w3c/permissions
-
1 issue opened.
-
Add "background-playback" permission type? w3c/permissions#193, by @mantou132.
-
w3c/webappsec-credential-management
-
3 issues opened.
-
finish PR #100: update "request a credential" algorithm w3c/webappsec-credential-management#137, by @equalsJeffH.
-
add permissions policy support for webauthn w3c/webappsec-credential-management#136, by @equalsJeffH.
-
feature policy for the various credential types: per-credential? all-included? w3c/webappsec-credential-management#135, by @equalsJeffH.
-
-
2 issues received 2 new comments.
-
add permissions policy support for webauthn w3c/webappsec-credential-management#136 (1 comment by @agl)
-
feature policy for the various credential types: per-credential? all-included? w3c/webappsec-credential-management#135 (1 comment by @equalsJeffH)
-
-
1 pull request opened.
-
Add Feature Policy support for WebAuthn w3c/webappsec-credential-management#138, by @equalsJeffH.
-
-
2 pull requests received 3 new comments.
-
Add Feature Policy support for WebAuthn w3c/webappsec-credential-management#138 (2 comments by @equalsJeffH, @mikewest)
-
Drop 'origin' from public interfaces after #100. w3c/webappsec-credential-management#131 (1 comment by @equalsJeffH)
-
w3c/webcrypto
-
1 issue received 1 new comment.
w3c/webappsec-mixed-content
-
1 issue opened.
-
Definition of "unauthenticated response" actually defining "authenticated response"? w3c/webappsec-mixed-content#19, by @jdeblasio.
-
-
1 issue received 1 new comment.
-
Definition of "unauthenticated response" actually defining "authenticated response"? w3c/webappsec-mixed-content#19 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Fix typo in "unauthenticated response" definition. w3c/webappsec-mixed-content#20, by @jdeblasio.
-
Lifecycle
-
1 charter started.
-
Chartered until 31 March 2021.
-
TR publications
-
1 document published.
-
Feature Policy published as a First Public Working Draft. History of Feature Policy
-
GitHub
w3c/webappsec-permissions-policy
-
4 issues opened.
-
Architecture discussion: Sandbox policies w3c/webappsec-permissions-policy#300, by @clelland.
-
Architecture discussion: Document Policies w3c/webappsec-permissions-policy#299, by @clelland.
-
Architecture discussion: Permissions w3c/webappsec-permissions-policy#298, by @clelland.
-
Dividing features across different types of policies w3c/webappsec-permissions-policy#296, by @annevk.
-
-
5 issues closed.
-
HTML calls Initialize document’s Feature Policy seems wrong w3c/webappsec-permissions-policy#284.
-
Feature proposal: opener w3c/webappsec-permissions-policy#50.
-
(Updated) Feature Policy v1 explainer w3c/webappsec-permissions-policy#43.
-
Send feature policy in sub-resource request headers w3c/webappsec-permissions-policy#20.
-
export anchor terms for algorithms w3c/webappsec-permissions-policy#260.
-
-
11 issues received 17 new comments.
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273 (4 comments by @ehsan-karamad, @marian-r, @mustaqahmed)
-
Architecture discussion: Sandbox policies w3c/webappsec-permissions-policy#300 (3 comments by @clelland, @ehsan-karamad)
-
Should document.domain setter be considered different than 'self' ? w3c/webappsec-permissions-policy#253 (2 comments by @annevk, @zcorpan)
-
Possible race in feature policy in multiprocess implementations w3c/webappsec-permissions-policy#256 (1 comment by @annevk)
-
Send feature policy in sub-resource request headers w3c/webappsec-permissions-policy#20 (1 comment by @annevk)
-
Feature-Identifier value for WebAuthn? w3c/webappsec-permissions-policy#168 (1 comment by @subyraman)
-
Feature Policy: Service Worker fetch handling w3c/webappsec-permissions-policy#280 (1 comment by @ithinkihaveacat)
-
-
8 pull requests opened.
-
Create focus-without-user-activation.md w3c/webappsec-permissions-policy#304, by @ehsan-karamad.
-
Update loading-frame-default-eager.md w3c/webappsec-permissions-policy#303, by @ehsan-karamad.
-
Update features.md w3c/webappsec-permissions-policy#302, by @loonybear.
-
move 'payment' from proposed to standard feature w3c/webappsec-permissions-policy#301, by @Malvoz.
-
Change 'lazyload' to 'loading-frame-default-eager' w3c/webappsec-permissions-policy#297, by @Malvoz.
-
Create loading-image-default-eager.md w3c/webappsec-permissions-policy#295, by @ehsan-karamad.
-
change status to fpwd w3c/webappsec-permissions-policy#294, by @samuelweiler.
-
Update and rename lazyload.md to loading-frame-default-eager.md w3c/webappsec-permissions-policy#293, by @ehsan-karamad.
-
-
6 pull requests merged.
-
Update unoptimized images policy w3c/webappsec-permissions-policy#292.
-
Correct uses of the term 'nested browsing context' w3c/webappsec-permissions-policy#291.
-
Change 'lazyload' to 'loading-frame-default-eager' w3c/webappsec-permissions-policy#297.
-
Update and rename lazyload.md to loading-frame-default-eager.md w3c/webappsec-permissions-policy#293.
-
Use dfn tags for algorithms, and export as appropriate. w3c/webappsec-permissions-policy#287.
-
Update sandbox.md w3c/webappsec-permissions-policy#290.
-
-
1 pull request closed.
-
Update image policies for OT w3c/webappsec-permissions-policy#286.
-
-
9 pull requests received 45 new comments.
-
Update and rename lazyload.md to loading-frame-default-eager.md w3c/webappsec-permissions-policy#293 (16 comments by @clelland, @ehsan-karamad, @Malvoz)
-
Create focus-without-user-activation.md w3c/webappsec-permissions-policy#304 (6 comments by @ehsan-karamad, @marian-r)
-
move 'payment' from proposed to standard feature w3c/webappsec-permissions-policy#301 (3 comments by @clelland, @Malvoz)
-
Create loading-image-default-eager.md w3c/webappsec-permissions-policy#295 (2 comments by @clelland, @ehsan-karamad)
-
Update image policies for OT w3c/webappsec-permissions-policy#286 (2 comments by @clelland, @loonybear)
-
Change 'lazyload' to 'loading-frame-default-eager' w3c/webappsec-permissions-policy#297 (1 comment by @clelland)
-
Use dfn tags for algorithms, and export as appropriate. w3c/webappsec-permissions-policy#287 (1 comment by @clelland)
-
w3c/webappsec
-
2 issues received 2 new comments.
-
2 pull requests opened.
-
framing security needs for Web Payments w3c/webappsec#552, by @equalsJeffH.
-
style: adjust formatting w3c/webappsec#551, by @j9t.
-
-
1 pull request merged.
-
style: adjust formatting w3c/webappsec#551.
-
w3c/trusted-types
-
4 issues opened.
-
Can URL policies be defined to use `URL` instead of `DOMString`? w3c/trusted-types#150, by @briansmith.
-
Consider adding a link and examples to the built in sanitizers ? w3c/trusted-types#148, by @lifaon74.
-
adjustments to HostEnsureCanCompileStrings discard value w3c/trusted-types#144, by @mikesamuel.
-
Clarify interaction between unsafe-eval and TrustedScript. w3c/trusted-types#143, by @mikesamuel.
-
-
10 issues received 51 new comments.
-
Clarify interaction between unsafe-eval and TrustedScript. w3c/trusted-types#143 (23 comments by @arturjanc, @koto, @lweichselbaum, @mikesamuel, @Sora2455)
-
Suggestion: Use different switch/flag than CSP w3c/trusted-types#1 (5 comments by @briansmith, @koto, @mikesamuel)
-
Consider metadata API; building blocks for HTML sanitizers w3c/trusted-types#43 (4 comments by @koto, @xtofian)
-
Consider adding a link and examples to the built in sanitizers ? w3c/trusted-types#148 (3 comments by @koto, @lifaon74, @mikesamuel)
-
Facilitate creating trusted types from string literals w3c/trusted-types#96 (3 comments by @koto, @littledan, @xtofian)
-
Can URL policies be defined to use `URL` instead of `DOMString`? w3c/trusted-types#150 (1 comment by @briansmith)
-
adjustments to HostEnsureCanCompileStrings discard value w3c/trusted-types#144 (1 comment by @mikesamuel)
-
-
4 pull requests opened.
-
Added a first draft of the type metadata. w3c/trusted-types#149, by @koto.
-
Switched to lts node version on Travis. w3c/trusted-types#147, by @koto.
-
Use CG-DRAFT status w3c/trusted-types#146, by @marcoscaceres.
-
Make WebIDL prettier. w3c/trusted-types#145, by @mikesamuel.
-
-
3 pull requests merged.
-
Switched to lts node version on Travis. w3c/trusted-types#147.
-
Use CG-DRAFT status w3c/trusted-types#146.
-
Make WebIDL prettier. w3c/trusted-types#145.
-
-
5 pull requests received 18 new comments.
-
spec: cleanup uses of `[TreatNullAs]` annotations w3c/trusted-types#142 (3 comments by @mikesamuel, @otherdaniel)
-
Migrates spec from Google doc into bikeshed format w3c/trusted-types#108 (2 comments by @koto, @mikesamuel)
w3c/permissions
-
1 issue opened.
-
Add "screen-wake-lock" permission type w3c/permissions#192, by @kenchris.
-
-
1 issue received 1 new comment.
w3c/webappsec-csp
-
1 issue opened.
-
Initializing a document's CSP list requires synchronous cross-process access w3c/webappsec-csp#389, by @bzbarsky.
-
-
2 issues received 2 new comments.
-
Policy to allow only custom properties in inline CSS w3c/webappsec-csp#174 (1 comment by @nico3333fr)
-
Initializing a document's CSP list requires synchronous cross-process access w3c/webappsec-csp#389 (1 comment by @annevk)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
FAQ: How to use this for hotlinking protection w3c/webappsec-fetch-metadata#27, by @briansmith.
-
-
1 issue closed.
-
Sec-Fetch-User is not detailed enough w3c/webappsec-fetch-metadata#23.
-
-
2 issues received 2 new comments.
-
FAQ: How to use this for hotlinking protection w3c/webappsec-fetch-metadata#27 (1 comment by @arturjanc)
-
w3c/webappsec-credential-management
-
1 issue received 1 new comment.
-
What can be passed as fetch() credentials? w3c/webappsec-credential-management#133 (1 comment by @ishitatsuyuki)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Typo: space between “non-” and “potentially trustworthy” w3c/webappsec-referrer-policy#118, by @j9t.
-
w3c/webcrypto
-
1 issue opened.
-
Lacks basic determinism w3c/webcrypto#221, by @biocrypto730.
-
-
1 issue received 1 new comment.
GitHub
w3c/webappsec-fetch-metadata
-
9 issues opened.
-
`Sec-Fetch-User` for subresource requets? w3c/webappsec-fetch-metadata#26, by @mikewest.
-
`Sec-Fetch-Site` for script-based redirects w3c/webappsec-fetch-metadata#25, by @arturjanc.
-
Sec-Fetch-User is not detailed enough w3c/webappsec-fetch-metadata#23, by @annevk.
-
Introduce `nested-navigate` to `Sec-Fetch-Mode`. w3c/webappsec-fetch-metadata#22, by @mikewest.
-
Alternative to `Sec-Fetch-Site: none` w3c/webappsec-fetch-metadata#20, by @mikewest.
-
Consider dropping default boolean headers. w3c/webappsec-fetch-metadata#19, by @mikewest.
-
Sandboxing w3c/webappsec-fetch-metadata#18, by @annevk.
-
"popup-navigate" / "popup-document" w3c/webappsec-fetch-metadata#17, by @annevk.
-
Is `Sec-Fetch-Dest` necessary? w3c/webappsec-fetch-metadata#16, by @annevk.
-
-
9 issues closed.
-
Consider dropping default boolean headers. w3c/webappsec-fetch-metadata#19.
-
Alternative to `Sec-Fetch-Site: none` w3c/webappsec-fetch-metadata#20.
-
Trailing dot when determining same-site-edness for Sec-Fetch-Site w3c/webappsec-fetch-metadata#15.
-
Sec-Fetch-Dest is not trustworthy w3c/webappsec-fetch-metadata#10.
-
Name suggestions w3c/webappsec-fetch-metadata#2.
-
More descriptive header names for `destination` and `user-activated` w3c/webappsec-fetch-metadata#9.
-
"popup-navigate" / "popup-document" w3c/webappsec-fetch-metadata#17.
-
Introduce `nested-navigate` to `Sec-Fetch-Mode`. w3c/webappsec-fetch-metadata#22.
-
Sec-Fetch-Site vs intranet "sites" w3c/webappsec-fetch-metadata#14.
-
-
12 issues received 53 new comments.
-
Is `Sec-Fetch-Dest` necessary? w3c/webappsec-fetch-metadata#16 (18 comments by @annevk, @arturjanc, @jakearchibald, @mikewest)
-
Alternative to `Sec-Fetch-Site: none` w3c/webappsec-fetch-metadata#20 (9 comments by @anforowicz, @arturjanc, @mikewest)
-
Sec-Fetch-User is not detailed enough w3c/webappsec-fetch-metadata#23 (5 comments by @annevk, @arturjanc, @mikewest)
-
"popup-navigate" / "popup-document" w3c/webappsec-fetch-metadata#17 (5 comments by @annevk, @arturjanc, @mikewest)
-
Consider dropping default boolean headers. w3c/webappsec-fetch-metadata#19 (4 comments by @arturjanc, @mikewest, @yoavweiss)
-
Trailing dot when determining same-site-edness for Sec-Fetch-Site w3c/webappsec-fetch-metadata#15 (3 comments by @mikewest)
-
More descriptive header names for `destination` and `user-activated` w3c/webappsec-fetch-metadata#9 (1 comment by @mikewest)
-
Introduce `nested-navigate` to `Sec-Fetch-Mode`. w3c/webappsec-fetch-metadata#22 (1 comment by @mikewest)
-
-
2 pull requests opened.
-
Fix formatting of HTML tag w3c/webappsec-fetch-metadata#24, by @fmarier.
-
Fix the documentation for Sec-Fetch-Mode: nested-navigate. w3c/webappsec-fetch-metadata#21, by @jerryzz0.
-
-
2 pull requests merged.
-
Fix formatting of HTML tag w3c/webappsec-fetch-metadata#24.
-
Fix the documentation for Sec-Fetch-Mode: nested-navigate. w3c/webappsec-fetch-metadata#21.
-
-
1 pull request reopened.
-
Fix formatting of HTML tag w3c/webappsec-fetch-metadata#24, by @mikewest.
-
-
1 pull request received 1 new comment.
w3c/trusted-types
-
3 issues opened.
-
Event handler path not checking right name w3c/trusted-types#141, by @mikesamuel.
-
Handle srcset attributes w3c/trusted-types#139, by @koto.
-
Calls to document.write are not passed to the policy (Chromium) w3c/trusted-types#136, by @p-.
-
-
1 issue closed.
-
TrustedTypes.isHTML('test') throws exception w3c/trusted-types#134.
-
-
13 issues received 54 new comments.
-
Facilitate creating trusted types from string literals w3c/trusted-types#96 (21 comments by @jridgewell, @koto, @littledan, @mikesamuel, @xtofian)
-
Bypass via insertAdjacentText w3c/trusted-types#133 (13 comments by @koto, @mikesamuel, @otherdaniel, @securityMB)
-
Create commonly used and harmless constants like TrustedHTML.EMPTY w3c/trusted-types#95 (3 comments by @koto, @mikesamuel, @xtofian)
-
Allow guarding (dynamic) module imports - a type for module specifiers w3c/trusted-types#117 (1 comment by @mikesamuel)
-
Consider metadata API; building blocks for HTML sanitizers w3c/trusted-types#43 (1 comment by @koto)
-
Calls to document.write are not passed to the policy (Chromium) w3c/trusted-types#136 (1 comment by @koto)
-
-
5 pull requests opened.
-
spec: cleanup uses of `[TreatNullAs]` annotations w3c/trusted-types#142, by @mikesamuel.
-
enforcement for `<img srcset>` w3c/trusted-types#140, by @mikesamuel.
-
Regenerated the spec. w3c/trusted-types#138, by @koto.
-
Fix a TrustedScriptURL ref to be TrustedURL w3c/trusted-types#137, by @jonathanKingston.
-
TrustedTypes.isXXX(object?) => isXXX(any) w3c/trusted-types#135, by @otherdaniel.
-
-
3 pull requests merged.
-
Regenerated the spec. w3c/trusted-types#138.
-
Fix a TrustedScriptURL ref to be TrustedURL w3c/trusted-types#137.
-
TrustedTypes.isXXX(object?) => isXXX(any) w3c/trusted-types#135.
-
-
4 pull requests received 7 new comments.
w3c/webappsec-permissions-policy
-
3 issues opened.
-
Feature Policy: downloads-without-user-activation w3c/webappsec-permissions-policy#289, by @ehsan-karamad.
-
Opt-in negotiation for new sandboxy features w3c/webappsec-permissions-policy#288, by @clelland.
-
HTML calls Initialize document’s Feature Policy seems wrong w3c/webappsec-permissions-policy#284, by @annevk.
-
-
1 issue closed.
-
allowlist same-origin domain w3c/webappsec-permissions-policy#107.
-
-
15 issues received 42 new comments.
-
Clarify definition of 'autoplay' policy w3c/webappsec-permissions-policy#276 (9 comments by @beccahughes, @clelland, @mounirlamouri, @tomayac, @triblondon)
-
Policy proposal for unsolicited-permission-request w3c/webappsec-permissions-policy#281 (7 comments by @clelland, @mounirlamouri, @ojanvafai, @triblondon)
-
Effect of vertical-scroll policy w3c/webappsec-permissions-policy#278 (4 comments by @clelland, @ehsan-karamad, @triblondon)
-
HTML calls Initialize document’s Feature Policy seems wrong w3c/webappsec-permissions-policy#284 (3 comments by @annevk, @clelland)
-
Feature Policy: Service Worker fetch handling w3c/webappsec-permissions-policy#280 (3 comments by @kinu, @mfalken)
-
export anchor terms for algorithms w3c/webappsec-permissions-policy#260 (3 comments by @annevk, @clelland)
-
Opt-in negotiation for new sandboxy features w3c/webappsec-permissions-policy#288 (2 comments by @annevk, @clelland)
-
What happened to the webrtc feature? w3c/webappsec-permissions-policy#250 (2 comments by @clelland, @henbos)
-
Proposal: Control over `document.domain` w3c/webappsec-permissions-policy#241 (2 comments by @clelland, @DavidBruant)
-
Should document.domain setter be considered different than 'self' ? w3c/webappsec-permissions-policy#253 (1 comment by @clelland)
-
How to decide what is governed by feature policy w3c/webappsec-permissions-policy#248 (1 comment by @clelland)
-
-
6 pull requests opened.
-
Update unoptimized images policy w3c/webappsec-permissions-policy#292, by @loonybear.
-
Correct uses of the term 'nested browsing context' w3c/webappsec-permissions-policy#291, by @clelland.
-
Update sandbox.md w3c/webappsec-permissions-policy#290, by @ehsan-karamad.
-
Use dfn tags for algorithms, and export as appropriate. w3c/webappsec-permissions-policy#287, by @clelland.
-
Update image policies for OT w3c/webappsec-permissions-policy#286, by @loonybear.
-
fix typo in header name w3c/webappsec-permissions-policy#285, by @cvazac.
-
-
1 pull request merged.
-
fix typo in header name w3c/webappsec-permissions-policy#285.
-
-
4 pull requests received 26 new comments.
-
Update image policies for OT w3c/webappsec-permissions-policy#286 (23 comments by @jpmedley, @loonybear)
-
Correct uses of the term 'nested browsing context' w3c/webappsec-permissions-policy#291 (1 comment by @clelland)
-
w3c/webappsec
-
1 issue opened.
-
Adopt Fetch Metadata as a deliverable. w3c/webappsec#550, by @mikewest.
-
-
2 issues received 34 new comments.
-
Adopt Fetch Metadata as a deliverable. w3c/webappsec#550 (8 comments by @annevk, @arturjanc, @fmarier, @jyasskin, @mikewest)
-
2 pull requests opened.
-
Add privacy, security, and accessibility considerations w3c/webappsec#549, by @wseltzer.
-
Spelling corrections w3c/webappsec#548, by @wseltzer.
-
-
2 pull requests merged.
-
Add privacy, security, and accessibility considerations w3c/webappsec#549.
-
Spelling corrections w3c/webappsec#548.
-
w3c/webappsec-secure-contexts
-
1 pull request opened.
-
Regenerate index.html w3c/webappsec-secure-contexts#65, by @foolip.
-
-
1 pull request merged.
-
Regenerate index.html w3c/webappsec-secure-contexts#65.
-
w3c/webcrypto
-
1 issue opened.
-
Crypto needs defensive deep-copy constructor w3c/webcrypto#220, by @Pr0methean.
-
-
3 issues received 3 new comments.
w3c/webappsec-csp
-
3 issues opened.
-
Is CSPViolationReportBody a funny name? w3c/webappsec-csp#388, by @foolip.
-
http-equiv delivery method: recommend to set after <meta charset="utf-8">? w3c/webappsec-csp#387, by @Malvoz.
-
Missing description in the Spec for Level 3 w3c/webappsec-csp#386, by @ghost.
-
-
1 issue received 1 new comment.
-
1 pull request merged.
-
Spec the form of the report body delivered to the Reporting API. w3c/webappsec-csp#385.
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Explicitly mention if downloads should be upgraded to HTTPS or not w3c/webappsec-upgrade-insecure-requests#16, by @ckerschb.
-
-
1 issue received 2 new comments.
-
Explicitly mention if downloads should be upgraded to HTTPS or not w3c/webappsec-upgrade-insecure-requests#16 (2 comments by @annevk, @ckerschb)
-
w3c/permissions
-
1 issue opened.
-
Semantic Permission Bundles w3c/permissions#191, by @tomayac.
-
w3c/webappsec-change-password-url
-
1 issue opened.
-
Pathway to W3C adoption w3c/webappsec-change-password-url#12, by @nicksantamaria.
-
-
1 issue closed.
-
Pathway to W3C adoption w3c/webappsec-change-password-url#12.
-
-
1 issue received 2 new comments.
w3c/webappsec-credential-management
-
1 issue opened.
-
note considerations wrt credential processing in private/incognito context w3c/webappsec-credential-management#134, by @equalsJeffH.
-
-
1 issue received 1 new comment.
-
What can be passed as fetch() credentials? w3c/webappsec-credential-management#133 (1 comment by @lgarron)
-
w3c/webappsec-subresource-integrity
-
1 issue received 4 new comments.
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (4 comments by @ArneBab, @cben, @kevincox)
-
Participants
-
1 organization joined.
-
Baycloud Systems joined.
-
GitHub
w3c/webappsec-permissions-policy
-
7 issues opened.
-
Policy proposal for unsolicited-permission-request w3c/webappsec-permissions-policy#281, by @triblondon.
-
Feature Policy: Service Worker fetch handling w3c/webappsec-permissions-policy#280, by @kinu.
-
Visibility/Testability of policy interventions w3c/webappsec-permissions-policy#279, by @triblondon.
-
Effect of vertical-scroll policy w3c/webappsec-permissions-policy#278, by @triblondon.
-
Terminology issues relating to "feature" and "disabled" w3c/webappsec-permissions-policy#277, by @triblondon.
-
Clarify definition of 'autoplay' policy w3c/webappsec-permissions-policy#276, by @triblondon.
-
Scope of speaker policy w3c/webappsec-permissions-policy#275, by @triblondon.
-
-
8 issues received 27 new comments.
-
Proposal: Parameterized features w3c/webappsec-permissions-policy#163 (6 comments by @loonybear, @RByers, @triblondon)
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (5 comments by @ExE-Boss, @Jamesernator, @ojanvafai, @sstelfox, @triblondon)
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273 (5 comments by @dveditz, @frivoal, @marian-r)
-
Visibility/Testability of policy interventions w3c/webappsec-permissions-policy#279 (4 comments by @clelland, @loonybear, @triblondon)
-
Policy proposal for unsolicited-permission-request w3c/webappsec-permissions-policy#281 (4 comments by @annevk, @clelland, @mustaqahmed, @triblondon)
-
Feature Policy: Service Worker fetch handling w3c/webappsec-permissions-policy#280 (1 comment by @clelland)
-
-
1 pull request opened.
-
fix typo in ReportingObserver example w3c/webappsec-permissions-policy#283, by @paulirish.
-
-
2 pull requests merged.
-
fix typo in ReportingObserver example w3c/webappsec-permissions-policy#283.
-
Update explainer for unsized media w3c/webappsec-permissions-policy#209.
-
-
1 pull request closed.
-
Clarify what allowusermedia actually does. w3c/webappsec-permissions-policy#164.
-
-
2 pull requests received 2 new comments.
-
Clarify what allowusermedia actually does. w3c/webappsec-permissions-policy#164 (1 comment by @clelland)
w3c/webappsec-csp
-
4 issues opened.
-
policy's self-origin for CSP policies inserted by <meta> w3c/webappsec-csp#384, by @hiroshige-g.
-
Evaluate service-workers mode for CSP violation reports w3c/webappsec-csp#383, by @cvazac.
-
Effective directive routes non-script-like request through script-src-elem w3c/webappsec-csp#382, by @notriddle.
-
get fetch directive fallback list: image-src should be img-src w3c/webappsec-csp#381, by @notriddle.
-
-
3 issues closed.
-
Evaluate service-workers mode for CSP violation reports w3c/webappsec-csp#383.
-
get fetch directive fallback list: image-src should be img-src w3c/webappsec-csp#381.
-
Effective directive routes non-script-like request through script-src-elem w3c/webappsec-csp#382.
-
-
7 issues received 9 new comments.
-
Evaluate service-workers mode for CSP violation reports w3c/webappsec-csp#383 (2 comments by @cvazac, @wanderview)
-
get fetch directive fallback list: image-src should be img-src w3c/webappsec-csp#381 (2 comments by @gapple, @notriddle)
-
Allow navigation to only whitelisted URLs via navigate-to w3c/webappsec-csp#125 (1 comment by @andypaicu)
-
Effective directive routes non-script-like request through script-src-elem w3c/webappsec-csp#382 (1 comment by @notriddle)
-
-
1 pull request opened.
-
Spec the form of the report body delivered to the Reporting API. w3c/webappsec-csp#385, by @paulmeyer90.
-
-
1 pull request received 7 new comments.
-
Spec the form of the report body delivered to the Reporting API. w3c/webappsec-csp#385 (7 comments by @gapple, @mikewest, @paulmeyer90)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Can you only run this API using HTTPs? w3c/webappsec-clear-site-data#58, by @ghost.
-
-
1 issue closed.
-
Can you only run this API using HTTPs? w3c/webappsec-clear-site-data#58.
-
-
2 issues received 5 new comments.
-
[Q] What happens when "executionContexts" is present along with Location header? w3c/webappsec-clear-site-data#56 (3 comments by @annevk, @julienw)
-
Can you only run this API using HTTPs? w3c/webappsec-clear-site-data#58 (2 comments by @ghost, @mikewest)
-
w3c/trusted-types
-
6 issues opened.
-
TrustedTypes.isHTML('test') throws exception w3c/trusted-types#134, by @crypto.
-
Bypass via insertAdjacentText w3c/trusted-types#133, by @securityMB.
-
Explain the Trusted Type behavior as an IDL attribute w3c/trusted-types#132, by @koto.
-
Add additional context to the default policy invocations w3c/trusted-types#131, by @yonjah.
-
error out when creating a non-exposed default policy w3c/trusted-types#125, by @koto.
-
Add a non-minified version of the polyfill w3c/trusted-types#124, by @koto.
-
-
4 issues closed.
-
Understading the difference between Standalone CSP vs TrustedTypes w3c/trusted-types#116.
-
Clarify the default policy and how optional enforcement works in the README w3c/trusted-types#100.
-
error out when creating a non-exposed default policy w3c/trusted-types#125.
-
Add a non-minified version of the polyfill w3c/trusted-types#124.
-
-
6 issues received 6 new comments.
-
Create commonly used and harmless constants like TrustedHTML.EMPTY w3c/trusted-types#95 (1 comment by @koto)
-
Understading the difference between Standalone CSP vs TrustedTypes w3c/trusted-types#116 (1 comment by @koto)
-
-
5 pull requests opened.
-
1.0.5 release w3c/trusted-types#130, by @koto.
-
Added a link to wiki. w3c/trusted-types#129, by @koto.
-
Updated the explainer. w3c/trusted-types#128, by @koto.
-
Updated the spec. w3c/trusted-types#127, by @koto.
-
Error out when creating a non-exposed default policy. w3c/trusted-types#126, by @koto.
-
-
5 pull requests merged.
-
1.0.5 release w3c/trusted-types#130.
-
Added a link to wiki. w3c/trusted-types#129.
-
Updated the explainer. w3c/trusted-types#128.
-
Updated the spec. w3c/trusted-types#127.
-
Error out when creating a non-exposed default policy. w3c/trusted-types#126.
-
w3c/webappsec-subresource-integrity
-
4 issues received 10 new comments.
-
Extend SRI to support integrity metadata on inline script/style blocks w3c/webappsec-subresource-integrity#44 (6 comments by @annevk, @ghost)
-
A new IntegrityCheckFailure event w3c/webappsec-subresource-integrity#77 (2 comments by @annevk, @cvazac)
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (1 comment by @murbard)
-
Consider integrity check violation reporting w3c/webappsec-subresource-integrity#20 (1 comment by @rcbarnett-zz)
-
w3c/webcrypto
-
1 issue opened.
-
EdDSA support w3c/webcrypto#219, by @Ban44n.
-
-
1 issue received 3 new comments.
-
Please require a secure origin (Bug 25972) w3c/webcrypto#28 (3 comments by @MattiasMartens, @scabot, @X-Ryl669)
-
-
1 pull request opened.
-
Fix Web IDL extended attribute usage: [EnforceRange] now applies to types w3c/webcrypto#218, by @Manishearth.
-
w3c/webappsec
-
1 issue opened.
-
What about Same-Origin Resource Sharing? w3c/webappsec#546, by @pak0s.
-
-
2 issues closed.
-
What about Same-Origin Resource Sharing? w3c/webappsec#546.
-
Prevent programmatic focus in iframe w3c/webappsec#543.
-
-
4 issues received 12 new comments.
-
What about Same-Origin Resource Sharing? w3c/webappsec#546 (7 comments by @arturjanc, @ericlaw1979, @mozfreddyb, @pak0s)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
What can be passed as fetch() credentials? w3c/webappsec-credential-management#133, by @lgarron.
-
w3c/webappsec-fetch-metadata
-
3 issues opened.
-
Trailing dot when determining same-site-edness for Sec-Fetch-Site w3c/webappsec-fetch-metadata#15, by @anforowicz.
-
Sec-Fetch-Site vs intranet "sites" w3c/webappsec-fetch-metadata#14, by @anforowicz.
-
Sec-Fetch-Site's definition of "same-site" should be consistent with Cross-Origin-Resource-Policy w3c/webappsec-fetch-metadata#13, by @anforowicz.
-
-
1 issue closed.
-
Sec-Fetch-Site's definition of "same-site" should be consistent with Cross-Origin-Resource-Policy w3c/webappsec-fetch-metadata#13.
-
-
3 issues received 4 new comments.
-
Sec-Fetch-Site's definition of "same-site" should be consistent with Cross-Origin-Resource-Policy w3c/webappsec-fetch-metadata#13 (2 comments by @anforowicz)
-
Trailing dot when determining same-site-edness for Sec-Fetch-Site w3c/webappsec-fetch-metadata#15 (1 comment by @mikewest)
-
w3c/permissions
-
1 issue opened.
-
Conditional permissions w3c/permissions#189, by @martinthomson.
-
-
1 pull request opened.
-
Use [SameObject] for navigator.permissions IDL w3c/permissions#190, by @foolip.
-
-
1 pull request merged.
-
Use [SameObject] for navigator.permissions IDL w3c/permissions#190.
-
-
1 pull request closed.
-
chore(example): Escape special character w3c/permissions#149.
-
w3c/webappsec-mixed-content
-
2 issues opened.
-
"strict mixed content checking flag" not defined for environment settings objects w3c/webappsec-mixed-content#18, by @annevk.
-
Clarify mixed content behavior for access to origins in CIDR 127.0.0.0/8 or ::1/128 w3c/webappsec-mixed-content#17, by @seemant.
-
-
2 issues received 3 new comments.
-
Clarify mixed content behavior for access to origins in CIDR 127.0.0.0/8 or ::1/128 w3c/webappsec-mixed-content#17 (2 comments by @annevk, @seemant)
-
"strict mixed content checking flag" not defined for environment settings objects w3c/webappsec-mixed-content#18 (1 comment by @mikewest)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
protected resource’s URL w3c/webappsec-upgrade-insecure-requests#15, by @hiroshige-g.
-
-
1 issue received 1 new comment.
w3c/webappsec-secure-contexts
-
1 pull request opened.
-
Use WindowOrWorkerGlobalScope as a mixin w3c/webappsec-secure-contexts#64, by @foolip.
-
-
1 pull request merged.
-
Use WindowOrWorkerGlobalScope as a mixin w3c/webappsec-secure-contexts#64.
-
-
1 pull request received 4 new comments.
-
Use WindowOrWorkerGlobalScope as a mixin w3c/webappsec-secure-contexts#64 (4 comments by @annevk, @foolip, @mikewest)
-
TR publications
-
1 document published.
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Participants
-
1 participant joined.
-
Rob van Eijk (W3C Invited Experts) joined.
-
GitHub
w3c/trusted-types
-
8 issues opened.
-
open for extension in createPolicy last arguments w3c/trusted-types#123, by @Jxck.
-
Polyfilling HostEnsureCanCompileStrings w3c/trusted-types#120, by @mikesamuel.
-
Allow guarding (dynamic) module imports - a type for module specifiers w3c/trusted-types#117, by @koto.
-
Understading the difference between Standalone CSP vs TrustedTypes w3c/trusted-types#116, by @Rendez.
-
`npm spec` eats translation errors w3c/trusted-types#112, by @mikesamuel.
-
spec: maybe use `<wpt>` to link spec sections to test suite w3c/trusted-types#109, by @mikesamuel.
-
Why is there no type for style / CSS? w3c/trusted-types#104, by @annevk.
-
Clarify the default policy and how optional enforcement works in the README w3c/trusted-types#100, by @koto.
-
-
5 issues closed.
-
Semantics and naming of types w3c/trusted-types#7.
-
Figure out if TrustedXYZ objects should be Transferable w3c/trusted-types#93.
-
Browser extensions vs Trusted Types w3c/trusted-types#94.
-
Figure out if TrustedURL needs to be absolute. w3c/trusted-types#8.
-
Fallback policy support w3c/trusted-types#63.
-
-
14 issues received 25 new comments.
-
Understading the difference between Standalone CSP vs TrustedTypes w3c/trusted-types#116 (4 comments by @koto, @Rendez, @xtofian)
-
Why is there no type for style / CSS? w3c/trusted-types#104 (4 comments by @annevk, @koto, @sebmarkbage)
-
Create commonly used and harmless constants like TrustedHTML.EMPTY w3c/trusted-types#95 (2 comments by @koto, @vrana)
-
Allow guarding (dynamic) module imports - a type for module specifiers w3c/trusted-types#117 (2 comments by @koto)
-
spec: maybe use `<wpt>` to link spec sections to test suite w3c/trusted-types#109 (1 comment by @koto)
-
16 pull requests opened.
-
Fix a typo in spec w3c/trusted-types#122, by @vrana.
-
Rewrite of the specification. w3c/trusted-types#121, by @koto.
-
Editorial changes in the spec w3c/trusted-types#119, by @koto.
-
Fix link text in String compilation w3c/trusted-types#118, by @vrana.
-
Fix a typo in spec w3c/trusted-types#115, by @vrana.
-
Remove Enforcement in timer functions from spec w3c/trusted-types#114, by @vrana.
-
CONTRIBUTING: add notes about spec editing w3c/trusted-types#113, by @mikesamuel.
-
spec: remove extraneous hash w3c/trusted-types#111, by @mikesamuel.
-
Fix typos in spec w3c/trusted-types#110, by @vrana.
-
Migrates spec from Google doc into bikeshed format w3c/trusted-types#108, by @mikesamuel.
-
Enforce HTMLFormElement.action w3c/trusted-types#107, by @vrana.
-
Accept TrustedURL in link.href w3c/trusted-types#106, by @vrana.
-
Do not inherit TrustedScriptURL from TrustedURL w3c/trusted-types#105, by @vrana.
-
gulp spec now runs bikeshed w3c/trusted-types#103, by @mikesamuel.
-
Fix a missing closing p tag w3c/trusted-types#102, by @koba04.
-
Rename types to match reality w3c/trusted-types#101, by @vrana.
-
-
14 pull requests merged.
-
Fix a typo in spec w3c/trusted-types#122.
-
Rewrite of the specification. w3c/trusted-types#121.
-
Editorial changes in the spec w3c/trusted-types#119.
-
CONTRIBUTING: add notes about spec editing w3c/trusted-types#113.
-
spec: remove extraneous hash w3c/trusted-types#111.
-
Fix a typo in spec w3c/trusted-types#115.
-
Fix typos in spec w3c/trusted-types#110.
-
Enforce HTMLFormElement.action w3c/trusted-types#107.
-
Accept TrustedURL in link.href w3c/trusted-types#106.
-
Migrates spec from Google doc into bikeshed format w3c/trusted-types#108.
-
Do not inherit TrustedScriptURL from TrustedURL w3c/trusted-types#105.
-
gulp spec now runs bikeshed w3c/trusted-types#103.
-
Fix a missing closing p tag w3c/trusted-types#102.
-
Rename types to match reality w3c/trusted-types#101.
-
-
2 pull requests closed.
-
Fix link text in String compilation w3c/trusted-types#118.
-
Remove Enforcement in timer functions from spec w3c/trusted-types#114.
-
-
6 pull requests received 18 new comments.
w3c/webappsec-secure-contexts
-
1 issue received 1 new comment.
w3c/webappsec-change-password-url
-
1 issue received 1 new comment.
-
Consider restricting the target of the redirect to be same-origin w3c/webappsec-change-password-url#8 (1 comment by @othermaciej)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
typo on index.html w3c/webappsec-clear-site-data#57, by @cqueern.
-
-
2 issues received 2 new comments.
-
Normative spec doesn't necessarily terminate service workers w3c/webappsec-clear-site-data#54 (1 comment by @asakusuma)
-
[Q] What happens when "executionContexts" is present along with Location header? w3c/webappsec-clear-site-data#56 (1 comment by @annevk)
-
w3c/webappsec-referrer-policy
-
1 issue received 1 new comment.
-
what should the referer header be for a fetch() from a blob: URL worker script? w3c/webappsec-referrer-policy#95 (1 comment by @kkaefer)
-
w3c/webappsec-permissions-policy
-
3 issues opened.
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273, by @marian-r.
-
The key of report.body.feature doesn't match docs w3c/webappsec-permissions-policy#268, by @ScottHelme.
-
The value of report.type doesn't match docs w3c/webappsec-permissions-policy#267, by @ScottHelme.
-
-
3 issues closed.
-
The key of report.body.feature doesn't match docs w3c/webappsec-permissions-policy#268.
-
The value of report.type doesn't match docs w3c/webappsec-permissions-policy#267.
-
Consider moving to Web App Sec? w3c/webappsec-permissions-policy#218.
-
-
6 issues received 8 new comments.
-
The key of report.body.feature doesn't match docs w3c/webappsec-permissions-policy#268 (2 comments by @clelland, @ScottHelme)
-
The value of report.type doesn't match docs w3c/webappsec-permissions-policy#267 (2 comments by @clelland, @ScottHelme)
-
-
3 pull requests opened.
-
Clean up JS API w3c/webappsec-permissions-policy#272, by @clelland.
-
Remove unstable marker from JS API w3c/webappsec-permissions-policy#271, by @clelland.
-
Add explainer for "font display late swap" w3c/webappsec-permissions-policy#269, by @yshrdbrn.
-
-
4 pull requests merged.
-
“Should request be allowed to use feature” algorithm w3c/webappsec-permissions-policy#220.
-
Clean up JS API w3c/webappsec-permissions-policy#272.
-
Remove unstable marker from JS API w3c/webappsec-permissions-policy#271.
-
Add explainer for "font display late swap" w3c/webappsec-permissions-policy#269.
-
-
2 pull requests received 5 new comments.
-
“Should request be allowed to use feature” algorithm w3c/webappsec-permissions-policy#220 (4 comments by @clelland, @eeeps, @yoavweiss)
-
w3c/webappsec
-
2 issues opened.
-
CSP and HTML Modules w3c/webappsec#544, by @dandclark.
-
Prevent programmatic focus in iframe w3c/webappsec#543, by @marian-r.
-
-
2 issues received 12 new comments.
-
1 pull request opened.
-
Merge pull request #541 from w3c/wseltzer-patch-8 w3c/webappsec#545, by @ghost.
-
-
1 pull request closed.
-
Mixed content upgrades w3c/webappsec#419.
-
w3c/webappsec-subresource-integrity
-
1 issue closed.
-
<script type=module> w3c/webappsec-subresource-integrity#59.
-
-
1 issue received 3 new comments.
-
<script type=module> w3c/webappsec-subresource-integrity#59 (3 comments by @annevk, @dveditz, @pierogitus)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
FormData creation in "Create a PasswordCredential from an HTMLFormElement" w3c/webappsec-credential-management#132, by @tkent-google.
-
-
1 pull request received 1 new comment.
-
Resolve issues of accessing settings object in parallel steps w3c/webappsec-credential-management#93 (1 comment by @equalsJeffH)
-
w3c/webappsec-csp
-
3 issues received 7 new comments.
-
Choose a consistent model for workers under nonce-based policies w3c/webappsec-csp#375 (3 comments by @arturjanc, @dveditz)
-
Policy to allow only custom properties in inline CSS w3c/webappsec-csp#174 (3 comments by @dav-is, @dveditz)
-
-
1 pull request opened.
-
Fixes a typo in strict-dynamic-usage w3c/webappsec-csp#380, by @morten-olsen.
-
-
1 pull request received 1 new comment.
w3c/webcrypto
-
1 issue opened.
-
Accept Blob and SharedArrayBuffer too? w3c/webcrypto#216, by @jimmywarting.
-
-
2 issues received 4 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (3 comments by @jakearchibald)
-
-
1 pull request opened.
-
Correct "UInt8ClampedArray" typo in source w3c/webcrypto#217, by @sideshowbarker.
-
-
3 pull requests merged.
-
Correct "UInt8ClampedArray" typo in source w3c/webcrypto#217.
-
Fix case typo of "I" in "UInt8ClampedArray" w3c/webcrypto#211.
-
Fix readme w3c/webcrypto#214.
-
-
1 pull request received 2 new comments.
w3c/webappsec-fetch-metadata
-
3 issues opened.
-
Extensions behavior is not defined w3c/webappsec-fetch-metadata#12, by @empijei.
-
Sec-Fetch-Site utility for resources that need to be exposed cross-site w3c/webappsec-fetch-metadata#11, by @anforowicz.
-
Sec-Fetch-Dest is not trustworthy w3c/webappsec-fetch-metadata#10, by @anforowicz.
-
-
1 issue closed.
-
Sec-Fetch-Site utility for resources that need to be exposed cross-site w3c/webappsec-fetch-metadata#11.
-
-
3 issues received 9 new comments.
-
Sec-Fetch-Site utility for resources that need to be exposed cross-site w3c/webappsec-fetch-metadata#11 (4 comments by @anforowicz, @arturjanc, @mikewest)
-
Sec-Fetch-Dest is not trustworthy w3c/webappsec-fetch-metadata#10 (3 comments by @anforowicz, @arturjanc)
-
Extensions behavior is not defined w3c/webappsec-fetch-metadata#12 (2 comments by @anforowicz, @arturjanc)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue received 1 new comment.
-
Should loopback and other trusted urls be upgraded? w3c/webappsec-upgrade-insecure-requests#14 (1 comment by @ericlaw1979)
-
w3c/permissions
-
1 pull request merged.
-
Rename 'display' permission to 'display-capture'. w3c/permissions#188.
-