Web Application Security Working Group - Activity in 2021
No matches.
Lifecycle
-
1 charter extension.
-
Charter extended until 30 June 2022.
-
TR publications
-
1 document published.
-
Permissions published as a Working Draft. History of Permissions
-
Past meetings
-
1 meeting.
Participants
-
1 participant left.
-
Elaine Knight (Apple Inc.) left.
-
GitHub
w3c/webappsec-change-password-url
-
1 issue received 2 new comments.
-
Any follow-up drafts for fully automated password change? w3c/webappsec-change-password-url#34 (2 comments by @dumblob)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Add "policy controlled feature tokens" column to "Credential Types Registry" w3c/webappsec-credential-management#184, by @equalsJeffH.
-
-
1 pull request opened.
-
Add permissions-policy check for publicKey credentials w3c/webappsec-credential-management#182, by @equalsJeffH.
-
-
1 pull request merged.
-
Add "conditional mediation" w3c/webappsec-credential-management#155.
-
-
2 pull requests closed.
-
Add default dictionary value w3c/webappsec-credential-management#139.
-
Add Feature Policy support for WebAuthn w3c/webappsec-credential-management#138.
-
-
4 pull requests received 36 new comments.
-
Map options member identifiers and credential types: public-key vs publicKey w3c/webappsec-credential-management#181 (20 comments by @equalsJeffH, @jyasskin, @nsatragno)
-
Add permissions-policy check for publicKey credentials w3c/webappsec-credential-management#182 (11 comments by @equalsJeffH, @jyasskin, @nsatragno)
-
Add Feature Policy support for WebAuthn w3c/webappsec-credential-management#138 (3 comments by @equalsJeffH)
-
Add default dictionary value w3c/webappsec-credential-management#139 (2 comments by @nsatragno, @saschanaz)
-
w3c/webappsec-permissions-policy
-
5 issues opened.
-
add "otp-credentials" policy-controlled feature token to features.md w3c/webappsec-permissions-policy#443, by @equalsJeffH.
-
linkably define term "policy-controlled feature token" w3c/webappsec-permissions-policy#442, by @equalsJeffH.
-
more on my network w3c/webappsec-permissions-policy#441, by @Jacksonpreacher.
-
track w3c/webappsec-permissions-policy#440, by @Jacksonpreacher.
-
Incorret grammar in Container policies green box w3c/webappsec-permissions-policy#439, by @BrainCrumbz.
-
-
2 issues closed.
-
track w3c/webappsec-permissions-policy#440.
-
more on my network w3c/webappsec-permissions-policy#441.
-
-
1 issue received 1 new comment.
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (1 comment by @emersion)
-
-
1 pull request received 1 new comment.
-
add experimental features join-ad-interest-group and run-ad-auction w3c/webappsec-permissions-policy#438 (1 comment by @qingxinwu)
-
w3c/webappsec-subresource-integrity
-
2 pull requests received 7 new comments.
-
Edit 3.3.2 Parse metadata in more detail w3c/webappsec-subresource-integrity#110 (5 comments by @annevk, @baek9, @domfarolino)
-
Add some information for authors about the intent of the spec w3c/webappsec-subresource-integrity#103 (2 comments by @mozfreddyb, @robinwhittleton)
-
w3c/trusted-types
-
4 issues opened.
-
@mikewest maybe `tonymade8` should be blocked? See also #352 and #351. w3c/trusted-types#354, by @tonymade8.
-
Hash stash w3c/trusted-types#353, by @tonymade8.
-
Kpod w3c/trusted-types#352, by @tonymade8.
-
Payable to w3c/trusted-types#351, by @tonymade8.
-
-
4 issues closed.
-
@mikewest maybe `tonymade8` should be blocked? See also #352 and #351. w3c/trusted-types#354.
-
Hash stash w3c/trusted-types#353.
-
Kpod w3c/trusted-types#352.
-
Payable to w3c/trusted-types#351.
-
-
2 issues received 3 new comments.
-
@mikewest maybe `tonymade8` should be blocked? See also #352 and #351. w3c/trusted-types#354 (1 comment by @marcoscaceres)
w3c/webcrypto
-
6 issues opened.
-
Test importing spki and pkcs8 keys with algorithm-specific OIDs w3c/webcrypto#307, by @twiss.
-
Consider supporting CAESAR recommendations w3c/webcrypto#306, by @leonbotros.
-
No tests for `jwk.alg` property in RSA imports and exports w3c/webcrypto#304, by @lucacasonato.
-
Use `rsaEncryption` OID during exporting for all RSA algorithms w3c/webcrypto#300, by @lucacasonato.
-
No WPT tests for EC `raw` import w3c/webcrypto#298, by @lucacasonato.
-
RSA-OAEP & RSA-PSS errors different between spki and pkcs8 key importing w3c/webcrypto#297, by @lucacasonato.
-
-
1 issue closed.
-
RSA-OAEP & RSA-PSS errors different between spki and pkcs8 key importing w3c/webcrypto#297.
-
-
7 issues received 39 new comments.
-
Test importing spki and pkcs8 keys with algorithm-specific OIDs w3c/webcrypto#307 (14 comments by @jasnell, @panva, @twiss)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (13 comments by @dead-claudia, @dlongley, @jasnell, @leonbotros, @MattiasBuelens, @taralx, @twiss)
-
RSA-OAEP & RSA-PSS errors different between spki and pkcs8 key importing w3c/webcrypto#297 (6 comments by @lucacasonato, @panva, @twiss)
-
Use `rsaEncryption` OID during exporting for all RSA algorithms w3c/webcrypto#300 (1 comment by @panva)
-
-
5 pull requests opened.
-
Update RSA and ECDH export steps and OIDs w3c/webcrypto#305, by @twiss.
-
Editorial: clean RSA-OAEP JWK export switch stmt w3c/webcrypto#303, by @lucacasonato.
-
Correctly get "hash" during RSA JWK export w3c/webcrypto#302, by @lucacasonato.
-
Editorial: ordered list for RSA JWK export steps w3c/webcrypto#301, by @lucacasonato.
-
Fix error names when parsing pkcs8 RSA params w3c/webcrypto#299, by @twiss.
-
-
4 pull requests merged.
-
Editorial: clean RSA-OAEP JWK export switch stmt w3c/webcrypto#303.
-
Correctly get "hash" during RSA JWK export w3c/webcrypto#302.
-
Editorial: ordered list for RSA JWK export steps w3c/webcrypto#301.
-
Fix error names when parsing pkcs8 RSA params w3c/webcrypto#299.
-
-
1 pull request received 1 new comment.
w3c/webappsec-csp
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Editorial: Clarify the role of `'none'` in source lists. w3c/webappsec-csp#534, by @mikewest.
-
-
2 pull requests received 14 new comments.
-
Editorial: Clarify the role of `'none'` in source lists. w3c/webappsec-csp#534 (13 comments by @annevk, @april, @freddieleeman, @lweichselbaum, @mikewest, @mikispag)
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (1 comment by @ericlaw1979)
-
w3c/permissions
-
5 issues closed.
-
Ensure "nfc" is integrated into parent spec w3c/permissions#328.
-
Ensure "accelerometer" is integrated into parent spec w3c/permissions#296.
-
Ensure "gyroscope" is integrated into Gyroscope API w3c/permissions#321.
-
Ensure "camera" & "microphone" are defined in their parent spec w3c/permissions#323.
-
Ensure "magnetometer" is integrated into parent spec w3c/permissions#326.
-
-
6 issues received 6 new comments.
-
Ensure "camera" & "microphone" are defined in their parent spec w3c/permissions#323 (1 comment by @miketaylr)
-
2 pull requests opened.
-
Editorial: relocate nfc powerful feature. w3c/permissions#336, by @miketaylr.
-
Editorial: Relocate more powerful features. w3c/permissions#335, by @miketaylr.
-
-
2 pull requests merged.
-
Editorial: Relocate more powerful features. w3c/permissions#335.
-
Editorial: relocate "background-fetch", "display-capture", "xr" w3c/permissions#334.
-
-
2 pull requests received 2 new comments.
-
Editorial: Relationship to the Permissions Policy specification w3c/permissions#264 (1 comment by @equalsJeffH)
w3c/webappsec
-
1 issue received 1 new comment.
TR publications
-
4 documents published.
-
Permissions published 4 times as a Working Draft. History of Permissions
-
Past meetings
Participants
-
1 participant joined.
-
Edward Qiu (Meta) joined.
-
-
3 participants left.
-
Angel Li (Alibaba Group) left.
-
Dan Kaminsky (HUMAN) left.
-
Danesh Irani (Google LLC) left.
-
GitHub
w3c/webappsec-permissions-policy
-
1 issue received 1 new comment.
-
2 pull requests opened.
-
add experimental features join-ad-interest-group and run-ad-auction w3c/webappsec-permissions-policy#438, by @qingxinwu.
-
Add interest-cohort to list of Experimental Features w3c/webappsec-permissions-policy#437, by @yoshifp.
-
-
2 pull requests received 3 new comments.
-
add experimental features join-ad-interest-group and run-ad-auction w3c/webappsec-permissions-policy#438 (2 comments by @mikewest)
-
Add interest-cohort to list of Experimental Features w3c/webappsec-permissions-policy#437 (1 comment by @gapple)
-
w3c/permissions
-
16 issues opened.
-
Interaction between browser and system permissions w3c/permissions#332, by @marcoscaceres.
-
Ensure "xr" is integrated into parent spec w3c/permissions#330, by @miketaylr.
-
Ensure "persistent-storage" is integrated into parent spec w3c/permissions#329, by @miketaylr.
-
Ensure "nfc" is integrated into parent spec w3c/permissions#328, by @miketaylr.
-
Ensure "magnetometer" is integrated into parent spec w3c/permissions#326, by @miketaylr.
-
Ensure "camera" & "microphone" are defined in their parent spec w3c/permissions#323, by @miketaylr.
-
Ensure "display-capture" is integrated into Screen Capture API spec w3c/permissions#322, by @miketaylr.
-
Ensure "gyroscope" is integrated into Gyroscope API w3c/permissions#321, by @miketaylr.
-
Ensure "speaker-selection" is integrated into Audio Output Devices API spec w3c/permissions#320, by @miketaylr.
-
Ensure "bluetooth" is integrated into Web Bluetooth spec w3c/permissions#317, by @miketaylr.
-
Can we drop the allowed in non-secure contexts flag? w3c/permissions#315, by @miketaylr.
-
Proposals: Drop "Powerful features registry" and PermissionName enum w3c/permissions#314, by @marcoscaceres.
-
Remove extra "ambient-light-sensor" bits w3c/permissions#309, by @miketaylr.
-
Ensure "background-sync" is integrated into Web Background Synchronization spec w3c/permissions#308, by @miketaylr.
-
Ensure "ambient-light-sensor" is integrated into Ambient Light Sensor spec w3c/permissions#307, by @miketaylr.
-
-
12 issues closed.
-
Ensure "background-fetch" permission is integrated in Background Sync spec w3c/permissions#295.
-
Ensure "display-capture" is integrated into Screen Capture API spec w3c/permissions#322.
-
Ensure "persistent-storage" is integrated into parent spec w3c/permissions#329.
-
Permission lifetimes w3c/permissions#233.
-
Ensure "xr" is integrated into parent spec w3c/permissions#330.
-
Can we drop the allowed in non-secure contexts flag? w3c/permissions#315.
-
Ensure "notifications" permission is properly integrated into parent spec w3c/permissions#291.
-
Ensure "background-sync" is integrated into Web Background Synchronization spec w3c/permissions#308.
-
Ensure "bluetooth" is integrated into Web Bluetooth spec w3c/permissions#317.
-
Ensure "ambient-light-sensor" is integrated into Ambient Light Sensor spec w3c/permissions#307.
-
Remove extra "ambient-light-sensor" bits w3c/permissions#309.
-
Ensure "midi" permission is integrated in Web Midi API spec w3c/permissions#294.
-
-
1 issue reopened.
-
Ensure "accelerometer" is integrated into parent spec w3c/permissions#296, by @miketaylr.
-
-
17 issues received 37 new comments.
-
Ensure "bluetooth" is integrated into Web Bluetooth spec w3c/permissions#317 (5 comments by @marcoscaceres, @miketaylr)
-
Proposals: Drop "Powerful features registry" and PermissionName enum w3c/permissions#314 (5 comments by @dveditz, @jyasskin, @marcoscaceres, @miketaylr)
-
Ensure "persistent-storage" is integrated into parent spec w3c/permissions#329 (4 comments by @marcoscaceres, @miketaylr)
-
Ensure "gyroscope" is integrated into Gyroscope API w3c/permissions#321 (3 comments by @miketaylr, @rakuco)
-
Ensure "display-capture" is integrated into Screen Capture API spec w3c/permissions#322 (3 comments by @miketaylr)
-
Ensure "xr" is integrated into parent spec w3c/permissions#330 (2 comments by @marcoscaceres, @miketaylr)
-
Ensure "accelerometer" is integrated into parent spec w3c/permissions#296 (2 comments by @marcoscaceres, @miketaylr)
-
Can we drop the allowed in non-secure contexts flag? w3c/permissions#315 (2 comments by @marcoscaceres, @miketaylr)
-
Ensure "background-sync" is integrated into Web Background Synchronization spec w3c/permissions#308 (2 comments by @miketaylr)
-
Ensure "ambient-light-sensor" is integrated into Ambient Light Sensor spec w3c/permissions#307 (2 comments by @miketaylr)
-
Ensure "background-fetch" permission is integrated in Background Sync spec w3c/permissions#295 (1 comment by @miketaylr)
-
Ensure "camera" & "microphone" are defined in their parent spec w3c/permissions#323 (1 comment by @miketaylr)
-
Ensure "notifications" permission is properly integrated into parent spec w3c/permissions#291 (1 comment by @miketaylr)
-
Ensure "screen-wake-lock" permission is integrated in Screen Wake Lock API (or just remove it?) w3c/permissions#319 (1 comment by @miketaylr)
-
Ensure "midi" permission is integrated in Web Midi API spec w3c/permissions#294 (1 comment by @miketaylr)
-
-
12 pull requests opened.
-
Editorial: relocate "background-fetch", "display-capture", "xr" w3c/permissions#334, by @miketaylr.
-
Editorial: relocate "persistent-storage" powerful feature w3c/permissions#333, by @miketaylr.
-
Editorial: link <a>express permission</a> inside <a>request permission to use</a>. w3c/permissions#331, by @miketaylr.
-
Remove the allowed in non-secure contexts flag w3c/permissions#327, by @miketaylr.
-
Editorial: Add 'getting the current permission state' steps w3c/permissions#325, by @marcoscaceres.
-
Editorial: Relocate "camera", "microphone", "notifications", "speaker-selection". w3c/permissions#324, by @miketaylr.
-
Editorial: relocate background-sync and bluetooth w3c/permissions#318, by @miketaylr.
-
Editorial: relocate midi & ambient-light-sensor powerful features w3c/permissions#316, by @miketaylr.
-
Editorial: relocate PermissionName/push definition w3c/permissions#313, by @marcoscaceres.
-
Relocate screen-capture w3c/permissions#312, by @marcoscaceres.
-
Editorial: soft identify geolocation powerful feature w3c/permissions#311, by @marcoscaceres.
-
Remove ambient-light-sensor details defined in [[ambient-light]] w3c/permissions#310, by @miketaylr.
-
-
12 pull requests merged.
-
Editorial: relocate "persistent-storage" powerful feature w3c/permissions#333.
-
Editorial: link <a>express permission</a> inside <a>request permission to use</a>. w3c/permissions#331.
-
Define permission lifetimes w3c/permissions#287.
-
Remove the allowed in non-secure contexts flag w3c/permissions#327.
-
Editorial: Add 'getting the current permission state' steps w3c/permissions#325.
-
Editorial: Relocate "camera", "microphone", "notifications", "speaker-selection". w3c/permissions#324.
-
Editorial: relocate background-sync and bluetooth w3c/permissions#318.
-
Relocate screen-capture w3c/permissions#312.
-
Editorial: relocate midi & ambient-light-sensor powerful features w3c/permissions#316.
-
Editorial: relocate PermissionName/push definition w3c/permissions#313.
-
Editorial: soft identify geolocation powerful feature w3c/permissions#311.
-
Remove ambient-light-sensor details defined in [[ambient-light]] w3c/permissions#310.
-
-
1 pull request closed.
-
Direct Connection Permission w3c/permissions#196.
-
-
8 pull requests received 27 new comments.
-
Define permission lifetimes w3c/permissions#287 (17 comments by @jyasskin, @marcoscaceres, @miketaylr)
-
Editorial: relocate midi & ambient-light-sensor powerful features w3c/permissions#316 (3 comments by @marcoscaceres, @miketaylr)
-
Editorial: Add 'getting the current permission state' steps w3c/permissions#325 (2 comments by @jyasskin, @marcoscaceres)
-
Editorial: Relationship to the Permissions Policy specification w3c/permissions#264 (1 comment by @clelland)
-
Editorial: Relocate "camera", "microphone", "notifications", "speaker-selection". w3c/permissions#324 (1 comment by @miketaylr)
-
Remove ambient-light-sensor details defined in [[ambient-light]] w3c/permissions#310 (1 comment by @miketaylr)
-
w3c/webappsec-credential-management
-
4 issues opened.
-
update all <a ...> anchors to use bikeshed shortcuts like [= w3c/webappsec-credential-management#180, by @equalsJeffH.
-
change all numbered steps in the bikeshed source to be "1." w3c/webappsec-credential-management#179, by @equalsJeffH.
-
Do not reference EventLoop objects from "In parallel" sections w3c/webappsec-credential-management#177, by @nsatragno.
-
Fix the "aborted flag" reference w3c/webappsec-credential-management#175, by @nsatragno.
-
-
2 issues closed.
-
allow credential-type specs to declare top-level-only or not w3c/webappsec-credential-management#113.
-
Fix the "aborted flag" reference w3c/webappsec-credential-management#175.
-
-
1 issue reopened.
-
add permissions policy support for webauthn w3c/webappsec-credential-management#136, by @equalsJeffH.
-
-
4 issues received 5 new comments.
-
add permissions policy support for webauthn w3c/webappsec-credential-management#136 (2 comments by @equalsJeffH)
-
feature policy for the various credential types: per-credential? all-included? w3c/webappsec-credential-management#135 (1 comment by @equalsJeffH)
-
"sameOriginWithAncestors is unused" ? should s/unused/false/ ? w3c/webappsec-credential-management#116 (1 comment by @equalsJeffH)
-
allow credential-type specs to declare top-level-only or not w3c/webappsec-credential-management#113 (1 comment by @equalsJeffH)
-
-
4 pull requests opened.
-
Map options member identifiers and credential types: public-key vs publicKey w3c/webappsec-credential-management#181, by @equalsJeffH.
-
Add Nina Satragno as editor w3c/webappsec-credential-management#178, by @equalsJeffH.
-
Reject aborted operations with the abort reason w3c/webappsec-credential-management#176, by @nsatragno.
-
Fail the CI on bikeshed warnings w3c/webappsec-credential-management#174, by @jyasskin.
-
-
3 pull requests merged.
-
Add Nina Satragno as editor w3c/webappsec-credential-management#178.
-
Reject aborted operations with the abort reason w3c/webappsec-credential-management#176.
-
Fail the CI on bikeshed warnings w3c/webappsec-credential-management#174.
-
-
3 pull requests received 59 new comments.
-
Add "conditional mediation" w3c/webappsec-credential-management#155 (35 comments by @equalsJeffH, @jyasskin, @nsatragno)
-
Map options member identifiers and credential types: public-key vs publicKey w3c/webappsec-credential-management#181 (20 comments by @equalsJeffH, @jyasskin, @nsatragno)
-
Reject aborted operations with the abort reason w3c/webappsec-credential-management#176 (4 comments by @equalsJeffH, @jyasskin, @nsatragno)
-
w3c/webcrypto
-
1 issue opened.
-
CryptoKey global already practiced but not defined. w3c/webcrypto#296, by @panva.
-
-
1 issue closed.
-
CryptoKey global already practiced but not defined. w3c/webcrypto#296.
-
-
5 issues received 8 new comments.
-
AES-CBC without PKCS#7 padding for 16-byte aligned blocks w3c/webcrypto#295 (3 comments by @twiss, @vitaly-castLabs)
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
The algorithm for parsing metadata should be described in more detail w3c/webappsec-subresource-integrity#84 (1 comment by @baek9)
-
-
1 pull request opened.
-
Edit 3.3.2 Parse metadata in more detail w3c/webappsec-subresource-integrity#110, by @baek9.
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Fetch-Metadata to indicate when the browser is in a partitioned context w3c/webappsec-fetch-metadata#80, by @DCtheTall.
-
-
1 issue received 15 new comments.
-
Fetch-Metadata to indicate when the browser is in a partitioned context w3c/webappsec-fetch-metadata#80 (15 comments by @annevk, @dveditz, @krgovind, @mikewest)
-
-
1 pull request opened.
-
Add `nested-navigate` to list of valid `Sec-Fetch-Mode` values w3c/webappsec-fetch-metadata#81, by @0xedward.
-
-
1 pull request closed.
-
Add `nested-navigate` to list of valid `Sec-Fetch-Mode` values w3c/webappsec-fetch-metadata#81.
-
-
1 pull request received 2 new comments.
-
Add `nested-navigate` to list of valid `Sec-Fetch-Mode` values w3c/webappsec-fetch-metadata#81 (2 comments by @0xedward, @annevk)
-
w3c/webappsec-csp
-
5 issues opened.
-
Fetch rewrites ws/wss URLs, but browsers still report them in CSP w3c/webappsec-csp#532, by @annevk.
-
Fix a typo in the example of Strict CSP w3c/webappsec-csp#530, by @shhnjk.
-
Add Strict CSP in Authoring Considerations w3c/webappsec-csp#528, by @shhnjk.
-
should-block-response doesn't forward arguments w3c/webappsec-csp#524, by @annevk.
-
Hashes bypass source-based allowlisting only on pre-request, not on post-request w3c/webappsec-csp#523, by @antosart.
-
-
4 issues closed.
-
Fix a typo in the example of Strict CSP w3c/webappsec-csp#530.
-
Add Strict CSP in Authoring Considerations w3c/webappsec-csp#528.
-
CSP HTTP headers not registered with IANA w3c/webappsec-csp#404.
-
4 issues received 11 new comments.
-
Fetch rewrites ws/wss URLs, but browsers still report them in CSP w3c/webappsec-csp#532 (3 comments by @annevk, @ArthurSonzogni, @Rob--W)
-
Specify sanitizing algorithm of blockedURL, documentURL, sourceFile beyond fragment exclusion w3c/webappsec-csp#489 (3 comments by @ArthurSonzogni, @Rob--W)
-
CSP HTTP headers not registered with IANA w3c/webappsec-csp#404 (3 comments by @mikewest, @SmashManiac)
-
Hashes bypass source-based allowlisting only on pre-request, not on post-request w3c/webappsec-csp#523 (2 comments by @antosart, @koto)
-
-
6 pull requests opened.
-
Add ['wss', 'ws'] in "Strip URLs for use in reports" allow-list. w3c/webappsec-csp#533, by @ArthurSonzogni.
-
Fix a typo in the example of Strict CSP w3c/webappsec-csp#531, by @shhnjk.
-
Define Strict CSP in the Authoring Considerations section. w3c/webappsec-csp#529, by @shhnjk.
-
Introduce "Strip URL for use in reports". w3c/webappsec-csp#527, by @ArthurSonzogni.
-
Remove calleeRealm from EnsureCSPDoesNotBlockWasmByteCompilation w3c/webappsec-csp#526, by @fgmccabe.
-
Remove calleeRealm from EnsureCSPDoesNotBlockWasmByteCompilation w3c/webappsec-csp#525, by @fgmccabe.
-
-
3 pull requests merged.
-
Introduce "Strip URL for use in reports". w3c/webappsec-csp#527.
-
Fix a typo in the example of Strict CSP w3c/webappsec-csp#531.
-
Define Strict CSP in the Authoring Considerations section. w3c/webappsec-csp#529.
-
-
2 pull requests closed.
-
Add ['wss', 'ws'] in "Strip URLs for use in reports" allow-list. w3c/webappsec-csp#533.
-
Remove calleeRealm from EnsureCSPDoesNotBlockWasmByteCompilation w3c/webappsec-csp#525.
-
-
6 pull requests received 68 new comments.
-
Introduce "Strip URL for use in reports". w3c/webappsec-csp#527 (42 comments by @annevk, @ArthurSonzogni, @mikewest, @Rob--W)
-
Define Strict CSP in the Authoring Considerations section. w3c/webappsec-csp#529 (9 comments by @lweichselbaum, @mikewest, @shhnjk)
-
Add ['wss', 'ws'] in "Strip URLs for use in reports" allow-list. w3c/webappsec-csp#533 (7 comments by @annevk, @ArthurSonzogni)
-
Remove calleeRealm from EnsureCSPDoesNotBlockWasmByteCompilation w3c/webappsec-csp#526 (5 comments by @annevk, @fgmccabe)
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (4 comments by @boompig, @fgmccabe, @ostap0207)
-
w3c/webappsec-referrer-policy
-
3 issues opened.
-
Question in relation to Referrer-Policy header and its relation with link rel attribute w3c/webappsec-referrer-policy#159, by @evilaliv3.
-
Omit referrers on cross-origin requests from an RFC7686 address w3c/webappsec-referrer-policy#155, by @fmarier.
-
Bikeshed (remote) returns an error on main branch w3c/webappsec-referrer-policy#154, by @fmarier.
-
-
2 issues closed.
-
Question in relation to Referrer-Policy header and its relation with link rel attribute w3c/webappsec-referrer-policy#159.
-
Bikeshed (remote) returns an error on main branch w3c/webappsec-referrer-policy#154.
-
-
3 issues received 9 new comments.
-
Question in relation to Referrer-Policy header and its relation with link rel attribute w3c/webappsec-referrer-policy#159 (4 comments by @annevk, @evilaliv3, @hackademix)
-
Omit referrers on cross-origin requests from an RFC7686 address w3c/webappsec-referrer-policy#155 (4 comments by @annevk, @fmarier, @mikewest)
-
Bikeshed (remote) returns an error on main branch w3c/webappsec-referrer-policy#154 (1 comment by @annevk)
-
-
3 pull requests opened.
-
Update GitHub workflows to use main branch w3c/webappsec-referrer-policy#158, by @domfarolino.
-
Fix policy container references in build w3c/webappsec-referrer-policy#157, by @antosart.
-
Omit referrers on cross-origin requests from an .onion address w3c/webappsec-referrer-policy#156, by @fmarier.
-
-
1 pull request merged.
-
Fix policy container references in build w3c/webappsec-referrer-policy#157.
-
-
1 pull request closed.
-
Update GitHub workflows to use main branch w3c/webappsec-referrer-policy#158.
-
-
3 pull requests received 7 new comments.
-
Omit referrers on cross-origin requests from an .onion address w3c/webappsec-referrer-policy#156 (4 comments by @annevk, @domfarolino, @fmarier)
-
Fix policy container references in build w3c/webappsec-referrer-policy#157 (2 comments by @antosart, @domfarolino)
-
Update GitHub workflows to use main branch w3c/webappsec-referrer-policy#158 (1 comment by @domfarolino)
-
w3c/trusted-types
-
1 issue received 2 new comments.
-
1 pull request merged.
-
Spec draft for fromLiteral method. See #347. w3c/trusted-types#350.
-
w3c/webappsec
-
1 issue closed.
-
Content-Security-Policy didn't get into the IANA message header registry w3c/webappsec#532.
-
-
1 issue received 1 new comment.
-
Content-Security-Policy didn't get into the IANA message header registry w3c/webappsec#532 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Update 2021-11-16-agenda.md w3c/webappsec#606, by @shhnjk.
-
-
1 pull request merged.
-
Update 2021-11-16-agenda.md w3c/webappsec#606.
-
w3c/webappsec-change-password-url
-
1 issue received 1 new comment.
-
Clarify that redirects should be followed to resolve the Change Password URL w3c/webappsec-change-password-url#15 (1 comment by @dougwaldron)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 31 December 2021.
-
TR publications
-
9 documents published.
-
Mixed Content published as a Candidate Recommendation Draft. History of Mixed Content
-
Permissions published 8 times as a Working Draft. History of Permissions
-
Past meetings
Participants
-
3 participants joined.
-
Nina Satragno (Google LLC) joined.
-
Julien Rossi (CANTON CONSULTING) joined.
-
Orie Steele (Transmute) joined.
-
-
2 organizations joined.
-
CANTON CONSULTING joined.
-
Transmute joined.
-
GitHub
w3c/webappsec-credential-management
-
1 issue opened.
-
Fix build errors and warnings w3c/webappsec-credential-management#171, by @nsatragno.
-
-
2 issues closed.
-
Fix build errors and warnings w3c/webappsec-credential-management#171.
-
current build error and linking warnings w3c/webappsec-credential-management#115.
-
-
1 issue received 1 new comment.
-
current build error and linking warnings w3c/webappsec-credential-management#115 (1 comment by @nsatragno)
-
-
3 pull requests opened.
-
fix .pr-preview.json to use index.bs, not index.src.html w3c/webappsec-credential-management#173, by @equalsJeffH.
-
Fix several build errors and warnings w3c/webappsec-credential-management#172, by @nsatragno.
-
Update Conditional UI mediation w3c/webappsec-credential-management#170, by @nsatragno.
-
-
3 pull requests merged.
-
fix .pr-preview.json to use index.bs, not index.src.html w3c/webappsec-credential-management#173.
-
Update Conditional UI mediation w3c/webappsec-credential-management#170.
-
Fix several build errors and warnings w3c/webappsec-credential-management#172.
-
-
2 pull requests received 32 new comments.
-
Update Conditional UI mediation w3c/webappsec-credential-management#170 (26 comments by @equalsJeffH, @nsatragno)
-
Add "conditional mediation" w3c/webappsec-credential-management#155 (6 comments by @equalsJeffH, @nsatragno)
-
w3c/webappsec-csp
-
6 issues opened.
-
Extracting header list values is going away w3c/webappsec-csp#522, by @annevk.
-
Editorial: header names and values are byte sequences w3c/webappsec-csp#521, by @annevk.
-
Report a violation assumes violation's resource is a URL w3c/webappsec-csp#519, by @annevk.
-
Request to Support Dynamic Resource Validation w3c/webappsec-csp#518, by @gulachek.
-
Do not report violations after redirects w3c/webappsec-csp#517, by @antosart.
-
External color profiles and CSP w3c/webappsec-csp#516, by @annevk.
-
-
3 issues closed.
-
Extracting header list values is going away w3c/webappsec-csp#522.
-
Do not report violations after redirects w3c/webappsec-csp#517.
-
Report a violation assumes violation's resource is a URL w3c/webappsec-csp#519.
-
-
1 issue reopened.
-
Do not report violations after redirects w3c/webappsec-csp#517, by @annevk.
-
-
8 issues received 38 new comments.
-
Request to Support Dynamic Resource Validation w3c/webappsec-csp#518 (11 comments by @annevk, @dveditz, @gulachek, @mozfreddyb)
-
Do not report violations after redirects w3c/webappsec-csp#517 (10 comments by @annevk, @antosart, @terjanq)
-
External color profiles and CSP w3c/webappsec-csp#516 (8 comments by @annevk, @mikewest, @noamr, @svgeesus)
-
CSP HTTP headers not registered with IANA w3c/webappsec-csp#404 (5 comments by @mikewest, @mnot, @SmashManiac)
-
CSP report referrer property in reports with frame-ancestors CSP directive violations w3c/webappsec-csp#460 (1 comment by @gravi2)
-
Add keyword to prevent parser-based JS APIs from adding new scripts w3c/webappsec-csp#191 (1 comment by @Jamesernator)
-
-
2 pull requests opened.
-
Fix serialization of blockedURI w3c/webappsec-csp#520, by @antosart.
-
Fix violation's resource for eval violations w3c/webappsec-csp#515, by @antosart.
-
-
3 pull requests merged.
-
Fix serialization of blockedURI w3c/webappsec-csp#520.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293.
-
Fix violation's resource for eval violations w3c/webappsec-csp#515.
-
-
2 pull requests received 16 new comments.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (8 comments by @annevk, @antosart, @fgmccabe)
-
w3c/webcrypto
-
4 issues opened.
-
AES-CBC without PKCS#7 padding for 16-byte aligned blocks w3c/webcrypto#295, by @vitaly-castLabs.
-
Remove extensibility w3c/webcrypto#294, by @saschanaz.
-
Define return types of SubtleCrypto methods with more specific types w3c/webcrypto#293, by @saschanaz.
-
Mark CryptoKeyPair members as required w3c/webcrypto#290, by @saschanaz.
-
-
3 issues received 5 new comments.
-
AES-CBC without PKCS#7 padding for 16-byte aligned blocks w3c/webcrypto#295 (3 comments by @twiss, @vitaly-castLabs)
-
Define return types of SubtleCrypto methods with more specific types w3c/webcrypto#293 (1 comment by @twiss)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @matthewjumpsoffbuildings)
-
-
6 pull requests opened.
-
Delete .travis.yml w3c/webcrypto#292, by @saschanaz.
-
Mark CryptoKeyPair fields as required w3c/webcrypto#291, by @saschanaz.
-
Add support for PR Preview tool w3c/webcrypto#289, by @twiss.
-
fix: CryptoKey name in ECDSA raw importKey operation w3c/webcrypto#287, by @littledivy.
-
Update ReSpec usage w3c/webcrypto#286, by @twiss.
-
add randomUUID method w3c/webcrypto#285, by @bcoe.
-
-
4 pull requests merged.
-
Delete .travis.yml w3c/webcrypto#292.
-
Add support for PR Preview tool w3c/webcrypto#289.
-
fix: CryptoKey name in ECDSA raw importKey operation w3c/webcrypto#287.
-
Update ReSpec usage w3c/webcrypto#286.
-
-
4 pull requests received 32 new comments.
w3c/permissions
-
7 issues opened.
-
Fix "dot" notation in algorithms w3c/permissions#302, by @miketaylr.
-
Export "create a `PermissionStatus`" dfn w3c/permissions#297, by @miketaylr.
-
Ensure "accelerometer" is integrated into parent spec w3c/permissions#296, by @marcoscaceres.
-
Ensure "background-fetch" permission is integrated in Background Sync spec w3c/permissions#295, by @marcoscaceres.
-
Ensure "midi" permission is integrated in Web Midi API spec w3c/permissions#294, by @miketaylr.
-
Ensure "push" permission is integrated into Push API spec w3c/permissions#293, by @miketaylr.
-
Ensure "notifications" permission is properly integrated into parent spec w3c/permissions#291, by @miketaylr.
-
-
4 issues closed.
-
Ensure "push" permission is integrated into Push API spec w3c/permissions#293.
-
Fix "dot" notation in algorithms w3c/permissions#302.
-
Export "create a `PermissionStatus`" dfn w3c/permissions#297.
-
`MidiPermissionDescriptor` in example 1 is confusing w3c/permissions#197.
-
-
6 issues received 9 new comments.
-
Export "create a `PermissionStatus`" dfn w3c/permissions#297 (2 comments by @marcoscaceres, @miketaylr)
-
Ensure "midi" permission is integrated in Web Midi API spec w3c/permissions#294 (2 comments by @miketaylr)
-
Ensure "notifications" permission is properly integrated into parent spec w3c/permissions#291 (2 comments by @miketaylr)
-
-
8 pull requests opened.
-
Editorial: Discuss how query() makes abuse harder to detect. w3c/permissions#306, by @miketaylr.
-
Remove PushPermissionDescriptor, moved to Push API w3c/permissions#305, by @marcoscaceres.
-
Remove MidiPermissionDescriptor, now in MIDI spec w3c/permissions#304, by @marcoscaceres.
-
Editorial: Get rid of "dot" notation in algorithms w3c/permissions#303, by @miketaylr.
-
Add + export definition of express permission w3c/permissions#301, by @marcoscaceres.
-
Chore: Link issue #278 using magical ReSpec issue feature w3c/permissions#299, by @miketaylr.
-
chore: Export [=create a PermissionStatus=] w3c/permissions#298, by @miketaylr.
-
Editorial: update Notifications integration w3c/permissions#292, by @miketaylr.
-
-
9 pull requests merged.
-
Editorial: Discuss how query() makes abuse harder to detect. w3c/permissions#306.
-
Remove MidiPermissionDescriptor, now in MIDI spec w3c/permissions#304.
-
Remove PushPermissionDescriptor, moved to Push API w3c/permissions#305.
-
Editorial: Get rid of "dot" notation in algorithms w3c/permissions#303.
-
Add + export definition of express permission w3c/permissions#301.
-
Chore: Link issue #278 using magical ReSpec issue feature w3c/permissions#299.
-
chore: Export [=create a PermissionStatus=] w3c/permissions#298.
-
Editorial: clarify how aspects are specified w3c/permissions#282.
-
Editorial: update Notifications integration w3c/permissions#292.
-
-
1 pull request closed.
-
Discuss how query() makes abuse harder to detect. w3c/permissions#166.
-
-
10 pull requests received 13 new comments.
-
Discuss how query() makes abuse harder to detect. w3c/permissions#166 (2 comments by @jyasskin, @miketaylr)
-
Editorial: clarify how aspects are specified w3c/permissions#282 (2 comments by @marcoscaceres, @miketaylr)
-
Editorial: Discuss how query() makes abuse harder to detect. w3c/permissions#306 (1 comment by @miketaylr)
-
Remove PushPermissionDescriptor, moved to Push API w3c/permissions#305 (1 comment by @marcoscaceres)
-
w3c/permissions#300 (1 comment by @w3cbot)
-
Chore: Link issue #278 using magical ReSpec issue feature w3c/permissions#299 (1 comment by @marcoscaceres)
-
w3c/webappsec-permissions-policy
-
5 issues opened.
-
explain 'none' more fully w3c/webappsec-permissions-policy#435, by @equalsJeffH.
-
incorrect grammar: "and in and HTML attributes" w3c/webappsec-permissions-policy#434, by @equalsJeffH.
-
sh-dictionary link 404s w3c/webappsec-permissions-policy#433, by @equalsJeffH.
-
[HEADER-STRUCTURE] reference needs updating w3c/webappsec-permissions-policy#432, by @equalsJeffH.
-
Re-add Feature-Policy header as an alias? w3c/webappsec-permissions-policy#430, by @gsnedders.
-
-
2 issues received 2 new comments.
-
HTTP headers not registered with IANA w3c/webappsec-permissions-policy#331 (1 comment by @SmashManiac)
-
Re-add Feature-Policy header as an alias? w3c/webappsec-permissions-policy#430 (1 comment by @annevk)
-
-
4 pull requests opened.
-
Add window-placement experimental feature w3c/webappsec-permissions-policy#436, by @michaelwasserman.
-
Default allowlists only effect child browsing contexts w3c/webappsec-permissions-policy#431, by @reillyeon.
-
Fix typo in "Container policies" section w3c/webappsec-permissions-policy#429, by @reillyeon.
-
Add keyboard-map feature policy. w3c/webappsec-permissions-policy#428, by @snianu.
-
-
2 pull requests merged.
-
Add window-placement experimental feature w3c/webappsec-permissions-policy#436.
-
Fix typo in "Container policies" section w3c/webappsec-permissions-policy#429.
-
-
2 pull requests received 2 new comments.
-
Add window-placement experimental feature w3c/webappsec-permissions-policy#436 (1 comment by @michaelwasserman)
-
Default allowlists only effect child browsing contexts w3c/webappsec-permissions-policy#431 (1 comment by @clelland)
-
w3c/trusted-types
-
1 issue closed.
-
Bypass using execCommand w3c/trusted-types#345.
-
-
3 issues received 22 new comments.
-
CfC to publish as an FPWD. w3c/trusted-types#342 (15 comments by @dveditz, @koto, @mikewest, @mozfreddyb, @OR13, @shhnjk)
-
Create [TrustedTypes].fromLiteral method w3c/trusted-types#347 (6 comments by @domenic, @koto, @shhnjk)
-
-
1 pull request opened.
-
Spec draft for fromLiteral method. See #347. w3c/trusted-types#350, by @koto.
-
-
1 pull request closed.
-
Create privatepublicSECURITY.md w3c/trusted-types#349.
-
-
1 pull request received 9 new comments.
-
Spec draft for fromLiteral method. See #347. w3c/trusted-types#350 (9 comments by @craigfrancis, @domenic, @koto)
-
w3c/webappsec-referrer-policy
-
1 issue received 1 new comment.
-
Redesign of "extract header list values" expected w3c/webappsec-referrer-policy#115 (1 comment by @annevk)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Update reference for structured headers w3c/webappsec-fetch-metadata#79, by @bplommer.
-
w3c/webappsec
-
1 issue closed.
-
CSP: Specify response checking. w3c/webappsec#227.
-
-
2 issues received 2 new comments.
-
Content-Security-Policy didn't get into the IANA message header registry w3c/webappsec#532 (1 comment by @SmashManiac)
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (1 comment by @amark)
-
-
1 pull request received 2 new comments.
-
Add some information for authors about the intent of the spec w3c/webappsec-subresource-integrity#103 (2 comments by @robinwhittleton, @samuelweiler)
-
w3c/webappsec-clear-site-data
-
1 issue received 3 new comments.
-
Clear-Site-Data and sandboxing w3c/webappsec-clear-site-data#64 (3 comments by @annevk, @jakearchibald)
-
w3c/webappsec-mixed-content
-
1 issue closed.
-
References to [mixed-content] don't point to the level 1 spec w3c/webappsec-mixed-content#58.
-
-
1 pull request merged.
-
Update title and prose to match CRD living-standard nature w3c/webappsec-mixed-content#57.
-
-
1 pull request received 3 new comments.
-
Update title and prose to match CRD living-standard nature w3c/webappsec-mixed-content#57 (3 comments by @carlosjoan91, @sideshowbarker)
-
TR publications
-
6 documents published.
-
Mixed Content Level 2 published 3 times as a Candidate Recommendation Draft. History of Mixed Content Level 2
-
Secure Contexts published twice as a Candidate Recommendation Draft. History of Secure Contexts
-
Permissions published as a Working Draft. History of Permissions
-
Past meetings
Participants
-
2 participants joined.
-
changqing yan (ByteDance) joined.
-
Andrew Comminos (Meta) joined.
-
-
1 organization joined.
-
ByteDance joined.
-
GitHub
w3c/webappsec-mixed-content
-
1 issue opened.
-
References to [mixed-content] don't point to the level 1 spec w3c/webappsec-mixed-content#58, by @jyasskin.
-
-
2 issues closed.
-
Level 2 story for <form> w3c/webappsec-mixed-content#28.
-
Move MIX2 to FPWD w3c/webappsec-mixed-content#25.
-
-
3 issues received 6 new comments.
-
References to [mixed-content] don't point to the level 1 spec w3c/webappsec-mixed-content#58 (3 comments by @annevk, @jyasskin, @sideshowbarker)
-
Level 2 story for <form> w3c/webappsec-mixed-content#28 (2 comments by @carlosjoan91, @sideshowbarker)
-
-
7 pull requests opened.
-
Update title and prose to match CRD living-standard nature w3c/webappsec-mixed-content#57, by @sideshowbarker.
-
Update the Version History URL w3c/webappsec-mixed-content#56, by @sideshowbarker.
-
Set the Bikeshed spec metadata Level value to “none” w3c/webappsec-mixed-content#55, by @sideshowbarker.
-
Add .cache to .gitignore w3c/webappsec-mixed-content#54, by @sideshowbarker.
-
Unversion the spec metadata (no more Level 2) w3c/webappsec-mixed-content#53, by @sideshowbarker.
-
Add spec metadata required for (auto)publishing to TR w3c/webappsec-mixed-content#52, by @sideshowbarker.
-
CI: Autopublish CRD to TR space w3c/webappsec-mixed-content#51, by @sideshowbarker.
-
-
6 pull requests merged.
-
Update the Version History URL w3c/webappsec-mixed-content#56.
-
Set the Bikeshed spec metadata Level value to “none” w3c/webappsec-mixed-content#55.
-
Add .cache to .gitignore w3c/webappsec-mixed-content#54.
-
Unversion the spec metadata (no more Level 2) w3c/webappsec-mixed-content#53.
-
Add spec metadata required for (auto)publishing to TR w3c/webappsec-mixed-content#52.
-
CI: Autopublish CRD to TR space w3c/webappsec-mixed-content#51.
-
-
1 pull request received 5 new comments.
-
Update title and prose to match CRD living-standard nature w3c/webappsec-mixed-content#57 (5 comments by @carlosjoan91, @jyasskin, @sideshowbarker)
-
w3c/webappsec-csp
-
4 issues opened.
-
Content-Security-Policy header isn't registered w3c/webappsec-csp#514, by @mnot.
-
unsafe-eval and WebAssembly w3c/webappsec-csp#512, by @fgmccabe.
-
Scope of navigate-to and form-action w3c/webappsec-csp#510, by @annevk.
-
frame-src can leak cross origin information w3c/webappsec-csp#509, by @antosart.
-
-
1 issue closed.
-
unsafe-eval and WebAssembly w3c/webappsec-csp#512.
-
-
4 issues received 13 new comments.
-
frame-src can leak cross origin information w3c/webappsec-csp#509 (5 comments by @annevk, @antosart)
-
-
2 pull requests opened.
-
[CSP] Remove outdated comment about workers w3c/webappsec-csp#513, by @antosart.
-
Remove bs-extensions.include w3c/webappsec-csp#508, by @antosart.
-
-
2 pull requests merged.
-
[CSP] Remove outdated comment about workers w3c/webappsec-csp#513.
-
Remove bs-extensions.include w3c/webappsec-csp#508.
-
-
3 pull requests received 40 new comments.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (37 comments by @annevk, @antosart, @fgmccabe, @lweichselbaum, @mikewest)
-
w3c/webappsec
-
1 pull request opened.
-
Update index.html w3c/webappsec#605, by @cqueern.
-
-
1 pull request received 1 new comment.
w3c/webcrypto
-
3 issues opened.
-
Why isn't `crypto.getRandomValues` accept a data view? w3c/webcrypto#284, by @amn.
-
How to best propose features and show implementor interest w3c/webcrypto#280, by @panva.
-
[security] Please strongly discourage pure javascript implementation w3c/webcrypto#277, by @bastien-roucaries.
-
-
3 issues closed.
-
New editor for the Web Crypto spec w3c/webcrypto#249.
-
Fully define [Serializable] w3c/webcrypto#260.
-
PBKDF2 derive bits should throw OperationError when length is zero w3c/webcrypto#274.
-
-
6 issues received 16 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (5 comments by @jimmywarting, @knightcode, @MattiasBuelens)
-
How to best propose features and show implementor interest w3c/webcrypto#280 (4 comments by @panva, @twiss)
-
Selected ECC curves are not secure w3c/webcrypto#196 (3 comments by @lucacasonato, @RangerMauve, @twiss)
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (2 comments by @ghost, @petersmagnusson)
-
[security] Please strongly discourage pure javascript implementation w3c/webcrypto#277 (1 comment by @tniessen)
-
-
5 pull requests opened.
-
Fix some typos w3c/webcrypto#283, by @twiss.
-
Update README.md w3c/webcrypto#282, by @twiss.
-
fix: missing if, otherwise throws missing w3c/webcrypto#281, by @panva.
-
Fix and update mailing list link to public-webappsec w3c/webcrypto#279, by @twiss.
-
Update Editor w3c/webcrypto#278, by @twiss.
-
-
7 pull requests merged.
-
Update README.md w3c/webcrypto#282.
-
Fix some typos w3c/webcrypto#283.
-
Define serialization and deserialization steps for CryptoKey objects w3c/webcrypto#264.
-
Fix and update mailing list link to public-webappsec w3c/webcrypto#279.
-
Update Editor w3c/webcrypto#278.
-
Actually generate AES-KW key w3c/webcrypto#276.
-
PBKDF2 & HKDF derive bits should throw OperationError when length is zero w3c/webcrypto#275.
-
-
1 pull request closed.
-
fix: missing if, otherwise throws missing w3c/webcrypto#281.
-
-
5 pull requests received 6 new comments.
-
Define serialization and deserialization steps for CryptoKey objects w3c/webcrypto#264 (1 comment by @twiss)
-
PBKDF2 & HKDF derive bits should throw OperationError when length is zero w3c/webcrypto#275 (1 comment by @twiss)
w3c/webappsec-subresource-integrity
-
4 issues opened.
-
Use : as a separator for hash format w3c/webappsec-subresource-integrity#108, by @abitrolly.
-
Only recommending collision resistance w3c/webappsec-subresource-integrity#107, by @martinthomson.
-
Second preimage resistance w3c/webappsec-subresource-integrity#106, by @martinthomson.
-
Explain `crossorigin` w3c/webappsec-subresource-integrity#105, by @abitrolly.
-
-
3 issues closed.
-
Consider alternative src value for integrity supported resources w3c/webappsec-subresource-integrity#36.
-
Use : as a separator for hash format w3c/webappsec-subresource-integrity#108.
-
Relationship to Digest header w3c/webappsec-subresource-integrity#83.
-
-
6 issues received 28 new comments.
-
Explain `crossorigin` w3c/webappsec-subresource-integrity#105 (12 comments by @abitrolly, @mozfreddyb)
-
Use : as a separator for hash format w3c/webappsec-subresource-integrity#108 (7 comments by @abitrolly, @annevk, @mozfreddyb)
-
Consider alternative src value for integrity supported resources w3c/webappsec-subresource-integrity#36 (5 comments by @annevk, @chucklu, @mozfreddyb)
-
Relationship to Digest header w3c/webappsec-subresource-integrity#83 (2 comments by @annevk, @LPardue)
-
Add support for BLAKE hashes in subresource integrity w3c/webappsec-subresource-integrity#104 (1 comment by @abitrolly)
-
The algorithm for parsing metadata should be described in more detail w3c/webappsec-subresource-integrity#84 (1 comment by @domfarolino)
-
-
1 pull request received 1 new comment.
-
Add some information for authors about the intent of the spec w3c/webappsec-subresource-integrity#103 (1 comment by @mozfreddyb)
-
w3c/webappsec-secure-contexts
-
6 pull requests opened.
-
Fix Version History URL & add .cache to .gitignore w3c/webappsec-secure-contexts#96, by @sideshowbarker.
-
Fix the Version History URL w3c/webappsec-secure-contexts#95, by @sideshowbarker.
-
Revert "Add Status section (#92)" w3c/webappsec-secure-contexts#94, by @sideshowbarker.
-
Remove Previous Version w3c/webappsec-secure-contexts#93, by @xfq.
-
Add Status section w3c/webappsec-secure-contexts#92, by @sideshowbarker.
-
CI: Autopublish using GitHub Actions + spec-prod w3c/webappsec-secure-contexts#91, by @sideshowbarker.
-
-
6 pull requests merged.
-
Fix Version History URL & add .cache to .gitignore w3c/webappsec-secure-contexts#96.
-
Fix the Version History URL w3c/webappsec-secure-contexts#95.
-
Revert "Add Status section (#92)" w3c/webappsec-secure-contexts#94.
-
Remove Previous Version w3c/webappsec-secure-contexts#93.
-
Add Status section w3c/webappsec-secure-contexts#92.
-
CI: Autopublish using GitHub Actions + spec-prod w3c/webappsec-secure-contexts#91.
-
-
2 pull requests received 28 new comments.
-
CI: Autopublish using GitHub Actions + spec-prod w3c/webappsec-secure-contexts#91 (20 comments by @marcoscaceres, @sideshowbarker)
-
Add Status section w3c/webappsec-secure-contexts#92 (8 comments by @deniak, @marcoscaceres, @sideshowbarker, @sidvishnoi, @xfq)
-
w3c/trusted-types
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Create privatepublicSECURITY.md w3c/trusted-types#349, by @tonymade8.
-
w3c/webappsec-cspee
-
1 issue received 6 new comments.
w3c/permissions
-
3 pull requests received 3 new comments.
TR publications
-
2 documents published.
-
Permissions published twice as a Working Draft. History of Permissions
-
Past meetings
Participants
-
2 participants joined.
-
Lukas Weichselbaum (Google LLC) joined.
-
Krzysztof Kotowicz (Google LLC) joined.
-
-
2 participants left.
-
Melanie Richards (Microsoft Corporation) left.
-
Terri Oda (Intel Corporation) left.
-
GitHub
w3c/permissions
-
13 issues opened.
-
Link to CONTRIBUTING.md from README.md w3c/permissions#288, by @miketaylr.
-
Specifications should add conformance classes w3c/permissions#283, by @marcoscaceres.
-
Add Mike Taylor as editor w3c/permissions#279, by @miketaylr.
-
Safari returns different results for current permission state w3c/permissions#278, by @miketaylr.
-
Typo in example 2 w3c/permissions#276, by @miketaylr.
-
Typo in example 3 w3c/permissions#275, by @miketaylr.
-
Add an introduction section? w3c/permissions#274, by @miketaylr.
-
Remove (or update?) Makefile w3c/permissions#273, by @miketaylr.
-
Fix pr-preview config (for ReSpec) w3c/permissions#272, by @miketaylr.
-
Links in document metadata section are busted w3c/permissions#270, by @miketaylr.
-
Update CONTRIBUTING w3c/permissions#269, by @marcoscaceres.
-
Definition of PermissionStatus lifetime w3c/permissions#266, by @szewai.
-
Move permissions out to each spec w3c/permissions#263, by @marcoscaceres.
-
-
15 issues closed.
-
Link to CONTRIBUTING.md from README.md w3c/permissions#288.
-
Update CONTRIBUTING w3c/permissions#269.
-
Remove (or update?) Makefile w3c/permissions#273.
-
Typo in example 2 w3c/permissions#276.
-
Add Mike Taylor as editor w3c/permissions#279.
-
Typo in example 3 w3c/permissions#275.
-
Fix pr-preview config (for ReSpec) w3c/permissions#272.
-
Links in document metadata section are busted w3c/permissions#270.
-
Move automation to a Note w3c/permissions#258.
-
Add 'webvr' to "Permission Registry" enum w3c/permissions#108.
-
PermissionStatus's memory management is unclear w3c/permissions#170.
-
The boolean permission query algorithm isn't Boolean w3c/permissions#167.
-
Delineate relationship between Permissions and Feature Policy w3c/permissions#176.
-
PermissionStatus should have a `name` w3c/permissions#237.
-
-
14 issues received 32 new comments.
-
Semantic Permission Bundles w3c/permissions#191 (7 comments by @anssiko, @marcoscaceres, @reillyeon, @tomayac)
-
Move permissions out to each spec w3c/permissions#263 (5 comments by @hamishwillee, @jyasskin, @marcoscaceres)
-
Definition of PermissionStatus lifetime w3c/permissions#266 (3 comments by @marcoscaceres, @rniwa, @smaug----)
-
PermissionStatus's memory management is unclear w3c/permissions#170 (2 comments by @marcoscaceres, @smaug----)
-
"Changes to this document may be tracked at" points to incorrect repo ? w3c/permissions#198 (1 comment by @marcoscaceres)
-
-
16 pull requests opened.
-
Editorial: fixed typos in Permissions Policy section w3c/permissions#290, by @fselcukcan.
-
chore: Update README.md w3c/permissions#289, by @MiTo0o.
-
Define permission lifetimes w3c/permissions#287, by @marcoscaceres.
-
Rename PermissionName enum to PowerfulFeatureName w3c/permissions#286, by @marcoscaceres.
-
Editorial: use permission state concept, not enum values w3c/permissions#285, by @marcoscaceres.
-
Editorial: rename specification w3c/permissions#284, by @marcoscaceres.
-
Editorial: clarify how aspects are specified w3c/permissions#282, by @marcoscaceres.
-
chore: update how to contribute w3c/permissions#281, by @marcoscaceres.
-
Fixes #279 - Add myself as editor, mark Jeffrey as emeritus w3c/permissions#280, by @miketaylr.
-
Fixes a couple of typos in the examples w3c/permissions#277, by @miketaylr.
-
Fixes #270 - Fix incorrect respecConfig.github.repoURL w3c/permissions#271, by @miketaylr.
-
Fix link to GitHub repository w3c/permissions#268, by @tidoust.
-
Chore: convert back to ReSpec w3c/permissions#267, by @marcoscaceres.
-
Editorial: move "automation" to its own repo/spec w3c/permissions#265, by @marcoscaceres.
-
Editorial: Relationship to the Permissions Policy specification w3c/permissions#264, by @marcoscaceres.
-
Editorial: s/boolean/default permission query algorithm w3c/permissions#262, by @marcoscaceres.
-
-
16 pull requests merged.
-
Editorial: fixed typos in Permissions Policy section w3c/permissions#290.
-
chore: Update README.md w3c/permissions#289.
-
chore: update how to contribute w3c/permissions#281.
-
Editorial: rename specification w3c/permissions#284.
-
Fixes a couple of typos in the examples w3c/permissions#277.
-
Fixes #279 - Add myself as editor, mark Jeffrey as emeritus w3c/permissions#280.
-
Chore: convert back to ReSpec w3c/permissions#267.
-
Editorial: move "automation" to its own repo/spec w3c/permissions#265.
-
Add xr-spatial-tracking enum value + entry w3c/permissions#254.
-
Add garbage collection for PermissionStatus w3c/permissions#256.
-
Editorial: s/boolean/default permission query algorithm w3c/permissions#262.
-
Editorial: Relationship to the Permissions Policy specification w3c/permissions#264.
-
Geolocation is secure context only w3c/permissions#260.
-
Midi is secure context only w3c/permissions#261.
-
Editorial: mark various permissions "at risk" w3c/permissions#259.
-
Add name attribute to PermissionStatus w3c/permissions#248.
-
-
3 pull requests closed.
-
Fix link to GitHub repository w3c/permissions#268.
-
Fixes #270 - Fix incorrect respecConfig.github.repoURL w3c/permissions#271.
-
Remove 'speaker-selection' enum value, as it's not implemented? w3c/permissions#257.
-
-
15 pull requests received 60 new comments.
-
Define permission lifetimes w3c/permissions#287 (10 comments by @jyasskin, @marcoscaceres, @miketaylr, @tomayac)
-
Editorial: use permission state concept, not enum values w3c/permissions#285 (8 comments by @jyasskin, @marcoscaceres)
-
Editorial: rename specification w3c/permissions#284 (7 comments by @jyasskin, @marcoscaceres, @miketaylr)
-
Add xr-spatial-tracking enum value + entry w3c/permissions#254 (4 comments by @cabanier, @marcoscaceres)
-
Add name attribute to PermissionStatus w3c/permissions#248 (4 comments by @jyasskin, @marcoscaceres)
-
Editorial: fixed typos in Permissions Policy section w3c/permissions#290 (3 comments by @marcoscaceres, @miketaylr, @w3cbot)
-
Rename PermissionName enum to PowerfulFeatureName w3c/permissions#286 (3 comments by @jyasskin, @marcoscaceres)
-
Handle not fully active documents when querying Permissions API w3c/permissions#249 (2 comments by @marcoscaceres, @rakina)
-
Fixes #270 - Fix incorrect respecConfig.github.repoURL w3c/permissions#271 (1 comment by @miketaylr)
-
Remove 'speaker-selection' enum value, as it's not implemented? w3c/permissions#257 (1 comment by @marcoscaceres)
-
w3c/webappsec-cspee
-
1 issue opened.
-
Limit length of 'csp' attribute w3c/webappsec-cspee#22, by @antosart.
-
-
1 issue received 3 new comments.
-
1 pull request opened.
-
Limit length of CSP attribute w3c/webappsec-cspee#21, by @antosart.
-
-
1 pull request received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue received 4 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (4 comments by @DanWin, @dimaqq, @Seirdy)
-
-
1 pull request merged.
-
Updated spec links to updated hash values w3c/webappsec-permissions-policy#425.
-
-
2 pull requests closed.
-
Add .circleci/config.yml w3c/webappsec-permissions-policy#417.
-
Change semicolons separating directives in examples to commas. w3c/webappsec-permissions-policy#314.
-
-
3 pull requests received 4 new comments.
-
Updated spec links to updated hash values w3c/webappsec-permissions-policy#425 (2 comments by @clelland, @w3cbot)
-
Change semicolons separating directives in examples to commas. w3c/webappsec-permissions-policy#314 (1 comment by @clelland)
-
w3c/webcrypto
-
2 issues opened.
-
PBKDF2 derive bits should throw OperationError when length is zero w3c/webcrypto#274, by @littledivy.
-
timingSafeEqual functionality w3c/webcrypto#270, by @jespertheend.
-
-
1 issue closed.
-
What is the security model for non-extractable keys? w3c/webcrypto#269.
-
-
6 issues received 24 new comments.
-
Please require a secure origin (Bug 25972) w3c/webcrypto#28 (13 comments by @pztrick, @stevendesu, @twiss, @varunnaagaraj, @X-Ryl669)
-
timingSafeEqual functionality w3c/webcrypto#270 (6 comments by @jespertheend, @panva, @tniessen, @twiss)
-
What is the security model for non-extractable keys? w3c/webcrypto#269 (2 comments by @lucacasonato, @sleevi)
-
PBKDF2 derive bits should throw OperationError when length is zero w3c/webcrypto#274 (1 comment by @twiss)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @knightcode)
-
-
5 pull requests opened.
-
Actually generate AES-KW key w3c/webcrypto#276, by @lucacasonato.
-
PBKDF2 & HKDF derive bits should throw OperationError when length is zero w3c/webcrypto#275, by @littledivy.
-
chore: auto-publish spec to gh-pages w3c/webcrypto#273, by @marcoscaceres.
-
Throw an OperationError in the PBKDF2 derive bits operation if iterations is zero w3c/webcrypto#272, by @littledivy.
-
Add missing steps in HMAC import key operation w3c/webcrypto#271, by @lucacasonato.
-
-
2 pull requests merged.
-
chore: auto-publish spec to gh-pages w3c/webcrypto#273.
-
-
1 pull request closed.
-
Add missing steps in HMAC import key operation w3c/webcrypto#271.
-
-
3 pull requests received 4 new comments.
-
Throw an OperationError in the PBKDF2 derive bits operation if iterations is zero w3c/webcrypto#272 (1 comment by @twiss)
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Add support for BLAKE hashes in subresource integrity w3c/webappsec-subresource-integrity#104, by @abitrolly.
-
-
2 issues received 6 new comments.
-
Add support for BLAKE hashes in subresource integrity w3c/webappsec-subresource-integrity#104 (5 comments by @abitrolly, @mozfreddyb)
-
Add recommendation to use SRI for versioned & stable resources w3c/webappsec-subresource-integrity#102 (1 comment by @mozfreddyb)
-
-
1 pull request received 13 new comments.
-
Add some information for authors about the intent of the spec w3c/webappsec-subresource-integrity#103 (13 comments by @mikewest, @mozfreddyb, @robinwhittleton)
-
w3c/webappsec
-
3 issues opened.
-
Stop advising to people use the mailing list w3c/webappsec#602, by @marcoscaceres.
-
Transfer issues to appropriate repos? w3c/webappsec#601, by @marcoscaceres.
-
Move to auto-publish w3c/webappsec#600, by @marcoscaceres.
-
-
1 issue closed.
-
Which process version is the WG using? w3c/webappsec#599.
-
-
2 issues received 7 new comments.
-
Stop advising to people use the mailing list w3c/webappsec#602 (2 comments by @marcoscaceres, @Seirdy)
-
1 pull request opened.
-
Fix a typo w3c/webappsec#603, by @vrana.
-
-
1 pull request merged.
-
Fix a typo w3c/webappsec#603.
-
w3c/webappsec-csp
-
2 pull requests received 17 new comments.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (15 comments by @annevk, @fgmccabe)
-
Introduce 'webrtc' as a simple on/off switch w3c/webappsec-csp#457 (2 comments by @alvestrand, @zenhack)
-
w3c/trusted-types
-
1 issue received 11 new comments.
-
Create [TrustedTypes].fromLiteral method w3c/trusted-types#347 (11 comments by @domenic, @koto, @shhnjk)
-
-
1 pull request opened.
-
Fix type of definitions for interfaces and a dictionary w3c/trusted-types#348, by @dontcallmedom.
-
-
1 pull request merged.
-
Fix type of definitions for interfaces and a dictionary w3c/trusted-types#348.
-
w3c/webappsec-fetch-metadata
-
1 issue received 1 new comment.
-
Sec-Fetch-Site for navigations from outside the browser w3c/webappsec-fetch-metadata#77 (1 comment by @dveditz)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 30 September 2021.
-
TR publications
-
3 documents published.
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
Permissions published twice as a Working Draft. History of Permissions
-
Past meetings
-
1 meeting.
GitHub
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Sec-Fetch-Site for navigations from outside the browser w3c/webappsec-fetch-metadata#77, by @dveditz.
-
-
11 issues closed.
-
Extensions behavior is not defined w3c/webappsec-fetch-metadata#12.
-
`Sec-Fetch-Site` for requests from extension background pages w3c/webappsec-fetch-metadata#47.
-
Sending `Sec-Fetch-Site: none` after redirects from directly user-initiated requests w3c/webappsec-fetch-metadata#39.
-
Should we ignore invalid values? w3c/webappsec-fetch-metadata#54.
-
FAQ: How to use this for hotlinking protection w3c/webappsec-fetch-metadata#27.
-
Why is `Sec-Fetch-Site` based on the full URL redirect chain? w3c/webappsec-fetch-metadata#28.
-
Update Redirect section with HTTPS->HTTP behavior w3c/webappsec-fetch-metadata#29.
-
Handling iframing via <embed> / <object> w3c/webappsec-fetch-metadata#37.
-
`<portal>` should result in a "nested" navigation. w3c/webappsec-fetch-metadata#46.
-
Link to Editor's Draft should target actual spec w3c/webappsec-fetch-metadata#57.
-
Remove outstanding issues w3c/webappsec-fetch-metadata#73.
-
-
10 issues received 13 new comments.
-
Sec-Fetch-Site for navigations from outside the browser w3c/webappsec-fetch-metadata#77 (3 comments by @annevk, @arturjanc)
-
Sec-Fetch-User and Sec-Fetch-Site for user-initiated UI navigations w3c/webappsec-fetch-metadata#71 (2 comments by @annevk, @mikewest)
-
Sending `Sec-Fetch-Site: none` after redirects from directly user-initiated requests w3c/webappsec-fetch-metadata#39 (1 comment by @mikewest)
-
FAQ: How to use this for hotlinking protection w3c/webappsec-fetch-metadata#27 (1 comment by @mikewest)
-
Why is `Sec-Fetch-Site` based on the full URL redirect chain? w3c/webappsec-fetch-metadata#28 (1 comment by @mikewest)
-
Update Redirect section with HTTPS->HTTP behavior w3c/webappsec-fetch-metadata#29 (1 comment by @mikewest)
-
`<portal>` should result in a "nested" navigation. w3c/webappsec-fetch-metadata#46 (1 comment by @mikewest)
-
Link to Editor's Draft should target actual spec w3c/webappsec-fetch-metadata#57 (1 comment by @mikewest)
-
-
2 pull requests opened.
-
Add considerations for extension contexts. w3c/webappsec-fetch-metadata#76, by @mikewest.
-
Clean up the integration with HTML and Fetch. w3c/webappsec-fetch-metadata#75, by @mikewest.
-
-
2 pull requests merged.
-
Add considerations for extension contexts. w3c/webappsec-fetch-metadata#76.
-
Clean up the integration with HTML and Fetch. w3c/webappsec-fetch-metadata#75.
-
-
2 pull requests received 14 new comments.
-
Add considerations for extension contexts. w3c/webappsec-fetch-metadata#76 (13 comments by @annevk, @arturjanc, @dergoegge, @mikewest)
-
Clean up the integration with HTML and Fetch. w3c/webappsec-fetch-metadata#75 (1 comment by @mikewest)
-
w3c/webappsec
-
2 issues opened.
-
Which process version is the WG using? w3c/webappsec#599, by @marcoscaceres.
-
[meta] Adopting the Sanitizer API w3c/webappsec#596, by @mozfreddyb.
-
-
3 issues received 32 new comments.
-
[meta] Adopting the Sanitizer API w3c/webappsec#596 (24 comments by @annevk, @domenic, @mikewest, @mozfreddyb, @msporny, @otherdaniel, @samuelweiler, @wseltzer)
-
Which process version is the WG using? w3c/webappsec#599 (5 comments by @marcoscaceres, @mikewest, @wseltzer)
-
-
2 pull requests opened.
-
[charter] typos/clarity w3c/webappsec#598, by @samuelweiler.
-
[charter] add doc policy; remove CSP:EE, SRI, Suborigins, Origin Policy w3c/webappsec#597, by @samuelweiler.
-
-
2 pull requests merged.
-
[charter] typos/clarity w3c/webappsec#598.
-
[charter] add doc policy; remove CSP:EE, SRI, Suborigins, Origin Policy w3c/webappsec#597.
-
-
1 pull request received 3 new comments.
-
[charter] add doc policy; remove CSP:EE, SRI, Suborigins, Origin Policy w3c/webappsec#597 (3 comments by @mikewest, @samuelweiler)
-
w3c/webappsec-csp
-
1 issue opened.
-
Consider adding import-src w3c/webappsec-csp#506, by @shhnjk.
-
-
2 issues received 7 new comments.
-
1 pull request opened.
-
Enforce build success in github actions w3c/webappsec-csp#507, by @antosart.
-
-
1 pull request merged.
-
Enforce build success in github actions w3c/webappsec-csp#507.
-
-
1 pull request received 41 new comments.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (41 comments by @annevk, @antosart, @dontcallmedom, @fgmccabe)
-
w3c/trusted-types
-
3 issues opened.
-
Create [TrustedTypes].fromLiteral method w3c/trusted-types#347, by @shhnjk.
-
Bypass using execCommand w3c/trusted-types#345, by @apple502j.
-
Consider allowing `innerHTML = ''` w3c/trusted-types#343, by @koto.
-
-
5 issues received 28 new comments.
-
Consider allowing `innerHTML = ''` w3c/trusted-types#343 (15 comments by @arturjanc, @koto, @mikewest, @mozfreddyb, @securityMB, @shhnjk)
-
CfC to publish as an FPWD. w3c/trusted-types#342 (5 comments by @marcoscaceres, @mikewest, @samuelweiler, @shhnjk)
-
Create [TrustedTypes].fromLiteral method w3c/trusted-types#347 (3 comments by @koto, @shhnjk, @Sora2455)
-
-
2 pull requests opened.
-
typo: compliment => complement w3c/trusted-types#344, by @paulirish.
-
2 pull requests merged.
-
fix typos w3c/trusted-types#346.
-
typo: compliment => complement w3c/trusted-types#344.
-
-
2 pull requests received 3 new comments.
w3c/permissions
-
2 issues opened.
-
Move automation to a Note w3c/permissions#258, by @marcoscaceres.
-
Add a fourth permission state "grantable without a prompt"? w3c/permissions#250, by @mkruisselbrink.
-
-
10 issues closed.
-
"prompt the user to choose" algorithm impedance mismatch. w3c/permissions#161.
-
Remove "device-info" permission w3c/permissions#203.
-
A new permission for canvas data w3c/permissions#165.
-
Write a Security Considerations section w3c/permissions#221.
-
Possibly add 'vibration' to Permission Registry Enum? w3c/permissions#173.
-
A more modest request() w3c/permissions#158.
-
Custom PermissionName definitions in other host environments w3c/permissions#212.
-
[question] permission scope w3c/permissions#226.
-
Add "screen-wake-lock" permission type w3c/permissions#192.
-
Clipboard permissions w3c/permissions#175.
-
-
9 issues received 22 new comments.
-
Handle non-fully-active documents w3c/permissions#162 (10 comments by @fergald, @jyasskin, @marcoscaceres, @rakina)
-
Add a fourth permission state "grantable without a prompt"? w3c/permissions#250 (4 comments by @marcoscaceres, @mkruisselbrink, @tomayac)
-
Custom PermissionName definitions in other host environments w3c/permissions#212 (2 comments by @marcoscaceres)
-
Possibly add 'vibration' to Permission Registry Enum? w3c/permissions#173 (1 comment by @marcoscaceres)
-
-
10 pull requests opened.
-
Midi is secure context only w3c/permissions#261, by @marcoscaceres.
-
Geolocation is secure context only w3c/permissions#260, by @marcoscaceres.
-
Editorial: mark various permissions "at risk" w3c/permissions#259, by @marcoscaceres.
-
Remove 'speaker-selection' enum value, as it's not implemented? w3c/permissions#257, by @marcoscaceres.
-
Add garbage collection for PermissionStatus w3c/permissions#256, by @marcoscaceres.
-
Revert "Add "gamepad" permission (#200)" w3c/permissions#255, by @marcoscaceres.
-
Add xr-spatial-tracking enum value + entry w3c/permissions#254, by @marcoscaceres.
-
Remove 'device-info' permission w3c/permissions#253, by @marcoscaceres.
-
s/Screen Capture/Display Capture w3c/permissions#252, by @eladalon1983.
-
-
6 pull requests merged.
-
Remove 'device-info' permission w3c/permissions#253.
-
Revert "Add "gamepad" permission (#200)" w3c/permissions#255.
-
s/Screen Capture/Display Capture w3c/permissions#252.
-
Fix typo w3c/permissions#251.
-
Add 'screen-wake-lock' permission w3c/permissions#247.
-
Remove clipboard-write w3c/permissions#246.
-
-
7 pull requests received 16 new comments.
-
Add xr-spatial-tracking enum value + entry w3c/permissions#254 (5 comments by @cabanier, @kdashg, @Manishearth, @marcoscaceres)
-
Handle not fully active documents when querying Permissions API w3c/permissions#249 (3 comments by @johannhof, @marcoscaceres, @rakina)
-
Remove 'speaker-selection' enum value, as it's not implemented? w3c/permissions#257 (1 comment by @marcoscaceres)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Remove Discovery API example? w3c/webappsec-secure-contexts#90, by @bathos.
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Add recommendation to use SRI for versioned & stable resources w3c/webappsec-subresource-integrity#102, by @mozfreddyb.
-
-
1 issue received 7 new comments.
-
Add recommendation to use SRI for versioned & stable resources w3c/webappsec-subresource-integrity#102 (7 comments by @bchapuis, @mikewest, @robinwhittleton)
-
-
1 pull request opened.
-
Add some information for authors about the intent of the spec w3c/webappsec-subresource-integrity#103, by @robinwhittleton.
-
-
1 pull request received 4 new comments.
-
Add some information for authors about the intent of the spec w3c/webappsec-subresource-integrity#103 (4 comments by @mikewest)
-
w3c/webcrypto
-
2 issues opened.
-
What is the security model for non-extractable keys? w3c/webcrypto#269, by @lucacasonato.
-
Editorial: adopt Infra w3c/webcrypto#268, by @annevk.
-
-
2 issues closed.
-
getRandomValues() and BigInt w3c/webcrypto#255.
-
-
4 issues received 6 new comments.
-
AES-CBC decryption should not throw error while dealing with bad padded ciphers w3c/webcrypto#177 (1 comment by @twiss)
-
2 pull requests opened.
-
Replace reference to RFC2898 with RFC8018 w3c/webcrypto#267, by @dontcallmedom.
-
Allow passing a BigInt64Array/BigUint64Array to getRandomValues w3c/webcrypto#266, by @twiss.
-
-
2 pull requests merged.
-
Allow passing a BigInt64Array/BigUint64Array to getRandomValues w3c/webcrypto#266.
-
Replace reference to RFC2898 with RFC8018 w3c/webcrypto#267.
-
-
2 pull requests received 6 new comments.
-
Allow passing a BigInt64Array/BigUint64Array to getRandomValues w3c/webcrypto#266 (5 comments by @annevk, @TimothyGu, @twiss)
-
w3c/webappsec-post-spectre-webdev
-
1 issue closed.
-
Make recommendations around local-schemed frames. w3c/webappsec-post-spectre-webdev#2.
-
-
1 issue received 1 new comment.
-
Make recommendations around local-schemed frames. w3c/webappsec-post-spectre-webdev#2 (1 comment by @mikewest)
-
w3c/webappsec-credential-management
-
1 issue received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Make GitHub the preferred way to give feedback w3c/webappsec-permissions-policy#427, by @marcoscaceres.
-
TR publications
-
9 documents published.
-
Content Security Policy Level 3 published 4 times as a Working Draft. History of Content Security Policy Level 3
-
Permissions published 4 times as a Working Draft. History of Permissions
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
Past meetings
-
1 meeting.
Participants
-
1 participant left.
-
David Ross (Google LLC) left.
-
GitHub
w3c/webappsec-csp
-
2 issues opened.
-
Preendering and prefetch-src w3c/webappsec-csp#502, by @mfalken.
-
Any chance to get Content-Security-Policy: frame-sandbox? w3c/webappsec-csp#501, by @giy-debug.
-
-
2 issues received 4 new comments.
-
Preendering and prefetch-src w3c/webappsec-csp#502 (3 comments by @antosart, @camillelamy, @mfalken)
-
Any chance to get Content-Security-Policy: frame-sandbox? w3c/webappsec-csp#501 (1 comment by @dveditz)
-
-
4 pull requests opened.
-
Fix CSP nonce typo w3c/webappsec-csp#505, by @iambrosie.
-
Fix nonce in example about strict-dynamic w3c/webappsec-csp#504, by @antosart.
-
Clarify what the hash in the unsafe-hashes example refers to w3c/webappsec-csp#503, by @fmarier.
-
chore: rename build-validate-publish.yml to auto-publish.yml w3c/webappsec-csp#500, by @marcoscaceres.
-
-
4 pull requests merged.
-
Fix CSP nonce typo w3c/webappsec-csp#505.
-
Clarify what the hash in the unsafe-hashes example refers to w3c/webappsec-csp#503.
-
Revert changing names of SPV event members w3c/webappsec-csp#499.
-
chore: rename build-validate-publish.yml to auto-publish.yml w3c/webappsec-csp#500.
-
-
1 pull request closed.
-
Fix nonce in example about strict-dynamic w3c/webappsec-csp#504.
-
-
4 pull requests received 17 new comments.
-
Introduce 'webrtc' as a simple on/off switch w3c/webappsec-csp#457 (14 comments by @antosart, @jan-ivar, @martinthomson, @mikewest, @rumkin, @zenhack)
-
Clarify what the hash in the unsafe-hashes example refers to w3c/webappsec-csp#503 (1 comment by @mikewest)
-
w3c/permissions
-
3 issues opened.
-
Watching for permission changes w3c/permissions#244, by @marcoscaceres.
-
Permissions states should be concepts w3c/permissions#243, by @marcoscaceres.
-
Linking error w3c/permissions#242, by @marcoscaceres.
-
-
33 issues closed.
-
chore: Turn on `Assume Explicit For` w3c/permissions#220.
-
Gauging interest in a Permission Handler API? w3c/permissions#224.
-
Add "web-share" to PermissionName? w3c/permissions#236.
-
Add "payment" permission w3c/permissions#239.
-
Using Web IDL to describe WebDriver JSON is a bit unusual w3c/permissions#174.
-
May reorder the permission state read steps w3c/permissions#137.
-
Capability Model w3c/permissions#148.
-
Request `Fullscreen` state w3c/permissions#147.
-
Reflect `fullscreen` state w3c/permissions#145.
-
Maybe add navigator.permissions.supports()? w3c/permissions#136.
-
Spec examples do not include `request()` w3c/permissions#144.
-
Mechanism for permission feature-detection? w3c/permissions#134.
-
Support for custom permission types w3c/permissions#130.
-
Make sure spec reflects issues w3c/permissions#126.
-
Guidance on where to put permission related stuff in other specs w3c/permissions#110.
-
Requesting permissions needs to be able to ask for multiple things w3c/permissions#92.
-
Only allow permissions.request() during user interaction w3c/permissions#77.
-
Check request() polyfill and update spec to match w3c/permissions#113.
-
Support minimizable request UI with permissions.request() w3c/permissions#76.
-
Flesh out request("push") w3c/permissions#111.
-
Flesh out request("geolocation") w3c/permissions#112.
-
Review of jyasskin's draft w3c/permissions#74.
-
Add pointerlock to the permissions enum? w3c/permissions#67.
-
This could replace the Quota Management API? w3c/permissions#51.
-
navigator.permissions.request w3c/permissions#48.
-
Add "nfc" to enum PermissionName w3c/permissions#47.
-
deploy.sh doesn't fail for patches with bikeshed errors w3c/permissions#123.
-
Define underlying infrastructure w3c/permissions#33.
-
Support for background sync (one-off and periodic) w3c/permissions#29.
-
Flesh out more complex permission issues we see down the road w3c/permissions#28.
-
What should "retrieve the permission state" do for pickers? w3c/permissions#8.
-
Linking error w3c/permissions#242.
-
-
39 issues received 49 new comments.
-
Clarify when a site is allowed to display the permission prompt w3c/permissions#245 (8 comments by @collimarco, @jyasskin, @marcoscaceres)
-
Using Web IDL to describe WebDriver JSON is a bit unusual w3c/permissions#174 (2 comments by @domenic, @marcoscaceres)
-
Requesting permissions needs to be able to ask for multiple things w3c/permissions#92 (2 comments by @marcoscaceres, @tomayac)
-
The boolean permission query algorithm isn't Boolean w3c/permissions#167 (1 comment by @marcoscaceres)
-
Guidance on whether to add a permissions to the platform w3c/permissions#116 (1 comment by @marcoscaceres)
-
Guidance on where to put permission related stuff in other specs w3c/permissions#110 (1 comment by @marcoscaceres)
-
Only allow permissions.request() during user interaction w3c/permissions#77 (1 comment by @marcoscaceres)
-
Support minimizable request UI with permissions.request() w3c/permissions#76 (1 comment by @marcoscaceres)
-
deploy.sh doesn't fail for patches with bikeshed errors w3c/permissions#123 (1 comment by @marcoscaceres)
-
Flesh out more complex permission issues we see down the road w3c/permissions#28 (1 comment by @marcoscaceres)
-
What should "retrieve the permission state" do for context related permissions? w3c/permissions#9 (1 comment by @marcoscaceres)
-
What should "retrieve the permission state" do for pickers? w3c/permissions#8 (1 comment by @marcoscaceres)
-
-
5 pull requests opened.
-
Handle not fully active documents when querying Permissions API w3c/permissions#249, by @marcoscaceres.
-
Add name attribute to PermissionStatus w3c/permissions#248, by @marcoscaceres.
-
Add 'screen-wake-lock' permission w3c/permissions#247, by @marcoscaceres.
-
Remove clipboard-write w3c/permissions#246, by @marcoscaceres.
-
chore: auto-publish spec w3c/permissions#241, by @marcoscaceres.
-
-
3 pull requests merged.
-
Add "gamepad" permission w3c/permissions#200.
-
chore: auto-publish spec w3c/permissions#241.
-
Use media device permission revocation algorithm. w3c/permissions#225.
-
-
2 pull requests closed.
-
Auto-fetch the previous version link. w3c/permissions#219.
-
Add periodic-background-sync enum and description. w3c/permissions#202.
-
-
8 pull requests received 25 new comments.
-
Add 'screen-wake-lock' permission w3c/permissions#247 (12 comments by @annevk, @marcoscaceres, @martinthomson, @rakuco, @reillyeon)
-
Add name attribute to PermissionStatus w3c/permissions#248 (7 comments by @annevk, @johannhof, @marcoscaceres, @tomayac)
-
Handle not fully active documents when querying Permissions API w3c/permissions#249 (1 comment by @marcoscaceres)
-
Add periodic-background-sync enum and description. w3c/permissions#202 (1 comment by @marcoscaceres)
-
w3c/webcrypto
-
1 issue received 1 new comment.
-
1 pull request received 1 new comment.
-
Define serialization and deserialization steps for CryptoKey objects w3c/webcrypto#264 (1 comment by @twiss)
-
w3c/webappsec
-
2 issues opened.
-
2021-2023 charter feedback w3c/webappsec#595, by @annevk.
-
[charter] list Document Policy as a deliverable w3c/webappsec#590, by @samuelweiler.
-
-
2 issues closed.
-
[charter] list Document Policy as a deliverable w3c/webappsec#590.
-
-
2 issues received 4 new comments.
-
[charter] list Document Policy as a deliverable w3c/webappsec#590 (3 comments by @annevk, @clelland, @samuelweiler)
-
-
7 pull requests opened.
-
A couple more COI-adjacent items w3c/webappsec#594, by @arturjanc.
-
Add link to proposed charter w3c/webappsec#593, by @wseltzer.
-
new charter start date TBD w3c/webappsec#592, by @xueyuanjia.
-
add webcrypto to change log w3c/webappsec#591, by @samuelweiler.
-
add Post-Spectre Web Development as a deliverable w3c/webappsec#589, by @samuelweiler.
-
Clarify that new feature limit applies only once a spec hits CR w3c/webappsec#588, by @samuelweiler.
-
set milestones for Permissions Policy, Permissions API, and Cred Man w3c/webappsec#587, by @samuelweiler.
-
-
8 pull requests merged.
-
Add link to proposed charter w3c/webappsec#593.
-
A couple more COI-adjacent items w3c/webappsec#594.
-
new charter start date TBD w3c/webappsec#592.
-
add webcrypto to change log w3c/webappsec#591.
-
Clarify that new feature limit applies only once a spec hits CR w3c/webappsec#588.
-
set milestones for Permissions Policy, Permissions API, and Cred Man w3c/webappsec#587.
-
add Post-Spectre Web Development as a deliverable w3c/webappsec#589.
-
Set 2021 milestone for mixed content to Rec w3c/webappsec#585.
-
-
5 pull requests received 15 new comments.
-
set milestones for Permissions Policy, Permissions API, and Cred Man w3c/webappsec#587 (5 comments by @dontcallmedom)
-
Clarify that new feature limit applies only once a spec hits CR w3c/webappsec#588 (3 comments by @annevk, @mikewest, @samuelweiler)
-
add Post-Spectre Web Development as a deliverable w3c/webappsec#589 (2 comments by @annevk, @sideshowbarker)
-
w3c/trusted-types
-
1 issue opened.
-
CfC to publish as an FPWD. w3c/trusted-types#342, by @mikewest.
-
-
1 issue received 7 new comments.
-
CfC to publish as an FPWD. w3c/trusted-types#342 (7 comments by @annevk, @cwilso, @marcoscaceres, @mikewest, @shhnjk)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
"Strip url for use as a referrer" sets path to null, which is a spec type error w3c/webappsec-referrer-policy#153, by @gsnedders.
-
-
1 issue received 1 new comment.
-
"Strip url for use as a referrer" sets path to null, which is a spec type error w3c/webappsec-referrer-policy#153 (1 comment by @annevk)
-
-
1 pull request merged.
-
Adapt to referrer policy being in policy container w3c/webappsec-referrer-policy#152.
-
w3c/webappsec-credential-management
-
1 pull request opened.
-
chore: rename build-validate-publish.yml to auto-publish.yml w3c/webappsec-credential-management#167, by @marcoscaceres.
-
-
1 pull request merged.
-
chore: rename build-validate-publish.yml to auto-publish.yml w3c/webappsec-credential-management#167.
-
w3c/webappsec-upgrade-insecure-requests
-
1 pull request opened.
-
chore: rename build-validate-publish.yml to auto-publish.yml w3c/webappsec-upgrade-insecure-requests#26, by @marcoscaceres.
-
-
1 pull request merged.
-
chore: rename build-validate-publish.yml to auto-publish.yml w3c/webappsec-upgrade-insecure-requests#26.
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Remove outstanding issues w3c/webappsec-fetch-metadata#73, by @annevk.
-
-
1 pull request opened.
-
chore: rename build-validate-publish.yml to auto-publish.yml w3c/webappsec-fetch-metadata#74, by @marcoscaceres.
-
-
1 pull request merged.
-
chore: rename build-validate-publish.yml to auto-publish.yml w3c/webappsec-fetch-metadata#74.
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Explicitly encourage user agents to validate cache content via integrity attributes w3c/webappsec-subresource-integrity#101, by @crisperdue.
-
-
1 issue reopened.
-
Explicitly encourage user agents to validate cache content via integrity attributes w3c/webappsec-subresource-integrity#101, by @annevk.
-
-
1 issue received 2 new comments.
-
Explicitly encourage user agents to validate cache content via integrity attributes w3c/webappsec-subresource-integrity#101 (2 comments by @annevk, @crisperdue)
-
w3c/webappsec-post-spectre-webdev
-
1 issue opened.
-
Move this to MDN? w3c/webappsec-post-spectre-webdev#24, by @samuelweiler.
-
-
1 issue received 2 new comments.
TR publications
-
3 documents published.
-
Content Security Policy Level 3 published 3 times as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
GitHub
w3c/webappsec-csp
-
2 issues opened.
-
SecurityPolicyViolationEventInit data members naming doesn't seem to match browsers w3c/webappsec-csp#498, by @cdumez.
-
[Embedded Enforcement] Introduce a way to only validate nonce usage w3c/webappsec-csp#495, by @shhnjk.
-
-
1 issue closed.
-
[Embedded Enforcement] Introduce a way to only validate nonce usage w3c/webappsec-csp#495.
-
-
4 issues received 15 new comments.
-
SecurityPolicyViolationEventInit data members naming doesn't seem to match browsers w3c/webappsec-csp#498 (10 comments by @annevk, @antosart, @cdumez, @darinadler, @gsnedders, @mikewest)
-
[Embedded Enforcement] Introduce a way to only validate nonce usage w3c/webappsec-csp#495 (2 comments by @antosart, @shhnjk)
-
Policy to allow only custom properties in inline CSS w3c/webappsec-csp#174 (2 comments by @ProgramMax)
-
Using csp attribute to prevent all networking out of the srcdoc iframe w3c/webappsec-csp#492 (1 comment by @dveditz)
-
-
3 pull requests opened.
-
Revert changing names of SPV event members w3c/webappsec-csp#499, by @antosart.
-
Use request's policy container for checks w3c/webappsec-csp#494, by @antosart.
-
Remove response check w3c/webappsec-csp#493, by @antosart.
-
-
3 pull requests merged.
-
Use request's policy container for checks w3c/webappsec-csp#494.
-
Remove response check w3c/webappsec-csp#493.
-
Adapt to the policy container w3c/webappsec-csp#482.
-
-
1 pull request closed.
-
Introduce 'webrtc-src'. w3c/webappsec-csp#287.
-
-
6 pull requests received 44 new comments.
-
Introduce 'webrtc' as a simple on/off switch w3c/webappsec-csp#457 (25 comments by @alvestrand, @annevk, @antosart, @benjamingr, @jan-ivar, @mikewest, @shacharz, @zenhack)
-
w3c/webappsec
-
1 issue opened.
-
[charter] set milestones for Permissions Policy, Permissions API, and Cred Man w3c/webappsec#586, by @samuelweiler.
-
-
3 issues received 9 new comments.
-
[charter] set milestones for Permissions Policy, Permissions API, and Cred Man w3c/webappsec#586 (5 comments by @clelland, @equalsJeffH, @marcoscaceres, @plehegar)
-
Concerns with moving to living standard model w3c/webappsec#580 (2 comments by @mozfreddyb, @wseltzer)
-
Web Applications should not have internet access by default w3c/webappsec#578 (2 comments by @ghost, @samuelweiler)
-
-
5 pull requests opened.
-
Set 2021 milestone for mixed content to Rec w3c/webappsec#585, by @samuelweiler.
-
Proposed webcrypto scope addition w3c/webappsec#584, by @wseltzer.
-
Additional clarification w3c/webappsec#583, by @wseltzer.
-
Remove .travis.yml file w3c/webappsec#582, by @sideshowbarker.
-
[charter 2021] allow going to rec; require 2x expected support w3c/webappsec#581, by @samuelweiler.
-
-
6 pull requests merged.
-
Proposed webcrypto scope addition w3c/webappsec#584.
-
Additional clarification w3c/webappsec#583.
-
[charter 2021] allow going to rec; require 2x expected support w3c/webappsec#581.
-
Remove .travis.yml file w3c/webappsec#582.
-
Make redirect for SRI spec include fragment ID w3c/webappsec#559.
-
[charter 2021] Widen scope of Permission API w3c/webappsec#579.
-
-
5 pull requests received 17 new comments.
-
[charter 2021] allow going to rec; require 2x expected support w3c/webappsec#581 (8 comments by @annevk, @dveditz, @hober, @mikewest, @samuelweiler, @wseltzer)
-
Proposed webcrypto scope addition w3c/webappsec#584 (6 comments by @annevk, @mikewest, @sideshowbarker)
-
w3c/webcrypto
-
4 issues opened.
-
Proposal: better key derivation functions w3c/webcrypto#265, by @bakkot.
-
Fully define [Serializable] w3c/webcrypto#260, by @annevk.
-
getRandomValues() and BigInt w3c/webcrypto#255, by @annevk.
-
-
11 issues closed.
-
Lacks basic determinism w3c/webcrypto#221.
-
Bug 29005 - Add support for secp256k1 curve w3c/webcrypto#82.
-
Allow arbitrary ECDSA curves. w3c/webcrypto#225.
-
Definition of "Crypto" should be moved to a normative section w3c/webcrypto#252.
-
Key usages too granular? w3c/webcrypto#240.
-
Why can't I get a file checksum if I'm on http? w3c/webcrypto#238.
-
Should CryptoKey be marked [Serializable] in IDL? w3c/webcrypto#222.
-
Supported operation list missing "digest" w3c/webcrypto#178.
-
HMAC get key length operation returns default length in bytes, not bits w3c/webcrypto#210.
-
HKDF's deriveBits() operation does not convert "length" parameter to octets w3c/webcrypto#184.
-
Persistent storage against webkit's ITP w3c/webcrypto#245.
-
-
1 issue reopened.
-
getRandomValues: explicitly obtain a reference to the bytes in the passed ArrayBufferView w3c/webcrypto#253, by @twiss.
-
-
13 issues received 19 new comments.
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (5 comments by @ghost, @sleevi, @twiss)
-
Why can't I get a file checksum if I'm on http? w3c/webcrypto#238 (2 comments by @StephenLynx, @twiss)
-
getRandomValues: explicitly obtain a reference to the bytes in the passed ArrayBufferView w3c/webcrypto#253 (2 comments by @annevk, @twiss)
-
Definition of "Crypto" should be moved to a normative section w3c/webcrypto#252 (1 comment by @twiss)
-
-
7 pull requests opened.
-
Define serialization and deserialization steps for CryptoKey objects w3c/webcrypto#264, by @twiss.
-
Fix cached internal slots being interpreted as references w3c/webcrypto#262, by @twiss.
-
Hoist <dfn>s out of non-normative sections w3c/webcrypto#261, by @twiss.
-
Mark CryptoKey [Serializable] in IDL w3c/webcrypto#259, by @twiss.
-
Add "digest" to list of supported operations w3c/webcrypto#258, by @twiss.
-
Fix HMAC's get key length operation by returning default length in bits w3c/webcrypto#257, by @twiss.
-
Fix HKDF's deriveBits() operation by converting the "length" parameter to octets w3c/webcrypto#256, by @twiss.
-
-
6 pull requests merged.
-
Fix cached internal slots being interpreted as references w3c/webcrypto#262.
-
Hoist <dfn>s out of non-normative sections w3c/webcrypto#261.
-
Mark CryptoKey [Serializable] in IDL w3c/webcrypto#259.
-
Add "digest" to list of supported operations w3c/webcrypto#258.
-
Fix HMAC's get key length operation by returning default length in bits w3c/webcrypto#257.
-
-
2 pull requests received 22 new comments.
-
Define serialization and deserialization steps for CryptoKey objects w3c/webcrypto#264 (21 comments by @annevk, @mikewest, @sleevi, @twiss)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Integrate with policy container w3c/webappsec-permissions-policy#556, by @annevk.
-
Provide example permission policy control via JS Element.setAttribute() w3c/webappsec-permissions-policy#426, by @michaelwasserman.
-
-
2 issues received 6 new comments.
-
Integrate with policy container w3c/webappsec-permissions-policy#556 (4 comments by @annevk, @antosart, @marcoscaceres)
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (2 comments by @olmari, @sandorvasas)
-
-
2 pull requests opened.
-
Updated spec links to updated hash values w3c/webappsec-permissions-policy#425, by @yoshifp.
-
Add window-placement to features.md w3c/webappsec-permissions-policy#424, by @quisquous.
-
w3c/permissions
-
1 issue received 1 new comment.
-
1 pull request received 1 new comment.
w3c/trusted-types
-
1 issue opened.
-
Mechanism to allow static HTML w3c/trusted-types#340, by @shhnjk.
-
-
1 issue closed.
-
Mechanism to allow static HTML w3c/trusted-types#340.
-
-
2 issues received 2 new comments.
-
Access the source/file that is using the 'default' policy w3c/trusted-types#295 (1 comment by @Siegrift)
w3c/webappsec-change-password-url
-
1 issue opened.
-
Any follow-up drafts for fully automated password change? w3c/webappsec-change-password-url#34, by @dumblob.
-
-
1 issue received 2 new comments.
-
Any follow-up drafts for fully automated password change? w3c/webappsec-change-password-url#34 (2 comments by @dumblob, @tschoffelen)
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Adapt to referrer policy being in policy container w3c/webappsec-referrer-policy#152, by @antosart.
-
-
1 pull request merged.
-
Editorial: Fix HTML markup conformance error w3c/webappsec-referrer-policy#151.
-
w3c/webappsec-secure-contexts
-
1 issue received 1 new comment.
-
about:blank" or "about:srcdoc" with query string or fragment should be potentially trustworthy w3c/webappsec-secure-contexts#81 (1 comment by @annevk)
-
TR publications
-
1 document published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Marcos Caceres (Apple Inc.) joined.
-
GitHub
w3c/webappsec-secure-contexts
-
2 issues received 2 new comments.
-
Potentially trustworthy URL algo should explicitly treat authenticated schemes as non-opaque w3c/webappsec-secure-contexts#85 (1 comment by @fred-wang)
-
about:blank" or "about:srcdoc" with query string or fragment should be potentially trustworthy w3c/webappsec-secure-contexts#81 (1 comment by @fred-wang)
-
-
2 pull requests opened.
-
Remove reference to "filesystem:" scheme from a note. w3c/webappsec-secure-contexts#89, by @fred-wang.
-
Fix typo "it’s creator" w3c/webappsec-secure-contexts#87, by @fred-wang.
-
-
2 pull requests merged.
-
Remove reference to "filesystem:" scheme from a note. w3c/webappsec-secure-contexts#89.
-
Fix typo "it’s creator" w3c/webappsec-secure-contexts#87.
-
-
2 pull requests received 8 new comments.
-
Fix typo "it’s creator" w3c/webappsec-secure-contexts#87 (6 comments by @annevk, @fred-wang, @w3cbot)
-
Remove reference to "filesystem:" scheme from a note. w3c/webappsec-secure-contexts#89 (2 comments by @annevk, @w3cbot)
-
w3c/webcrypto
-
3 issues opened.
-
Deterministically derive key pair from secret, salt, and context? w3c/webcrypto#254, by @knightcode.
-
getRandomValues: explicitly obtain a reference to the bytes in the passed ArrayBufferView w3c/webcrypto#253, by @annevk.
-
Definition of "Crypto" should be moved to a normative section w3c/webcrypto#252, by @tidoust.
-
-
1 issue closed.
-
Allow add external algorithm bridge w3c/webcrypto#248.
-
-
1 issue received 2 new comments.
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Fix typo in permissions policy explainer w3c/webappsec-permissions-policy#422, by @endormi.
-
-
1 issue closed.
-
Fix typo in permissions policy explainer w3c/webappsec-permissions-policy#422.
-
-
2 issues received 12 new comments.
-
Permissions Policy JS API w3c/webappsec-permissions-policy#401 (11 comments by @annevk, @clelland, @craigfrancis)
-
-
3 pull requests opened.
-
fix link to document-policy explainer w3c/webappsec-permissions-policy#423, by @paulirish.
-
Correct text in permissions policy explainer (example 1) w3c/webappsec-permissions-policy#421, by @endormi.
-
Add interest-cohort to features list w3c/webappsec-permissions-policy#420, by @freddieleeman.
-
-
2 pull requests merged.
-
fix link to document-policy explainer w3c/webappsec-permissions-policy#423.
-
Correct text in permissions policy explainer (example 1) w3c/webappsec-permissions-policy#421.
-
-
2 pull requests received 3 new comments.
-
Correct text in permissions policy explainer (example 1) w3c/webappsec-permissions-policy#421 (2 comments by @marcoscaceres, @w3cbot)
-
w3c/webappsec-csp
-
5 issues opened.
-
Using csp attribute to prevent all networking out of the srcdoc iframe w3c/webappsec-csp#492, by @mitar.
-
Should navigational checks apply to javascript: navigations? w3c/webappsec-csp#491, by @antosart.
-
Mention deprecation of plugin-types in CSP3? w3c/webappsec-csp#490, by @Elchi3.
-
Specify sanitizing algorithm of blockedURL, documentURL, sourceFile beyond fragment exclusion w3c/webappsec-csp#489, by @Rob--W.
-
CSP script-src self and blobs w3c/webappsec-csp#487, by @youennf.
-
-
1 issue closed.
-
Should navigational checks apply to javascript: navigations? w3c/webappsec-csp#491.
-
-
4 issues received 9 new comments.
-
Should navigational checks apply to javascript: navigations? w3c/webappsec-csp#491 (4 comments by @annevk, @antosart, @dveditz)
-
Using csp attribute to prevent all networking out of the srcdoc iframe w3c/webappsec-csp#492 (2 comments by @antosart, @mitar)
-
Mention deprecation of plugin-types in CSP3? w3c/webappsec-csp#490 (2 comments by @annevk, @dveditz)
-
-
1 pull request opened.
-
Make bikeshed compile without errors w3c/webappsec-csp#488, by @antosart.
-
-
1 pull request merged.
-
Make bikeshed compile without errors w3c/webappsec-csp#488.
-
-
2 pull requests received 20 new comments.
w3c/permissions
-
6 issues opened.
-
Add "payment" permission w3c/permissions#239, by @marcoscaceres.
-
PermissionStatus should have a `name` w3c/permissions#237, by @marcoscaceres.
-
Add "web-share" to PermissionName? w3c/permissions#236, by @saschanaz.
-
Should we SecureContext the API w3c/permissions#235, by @marcoscaceres.
-
previousResult not really stored anywhere w3c/permissions#234, by @marcoscaceres.
-
Permission lifetimes w3c/permissions#233, by @marcoscaceres.
-
-
1 issue closed.
-
Should we SecureContext the API w3c/permissions#235.
-
-
3 issues received 6 new comments.
-
Should we SecureContext the API w3c/permissions#235 (3 comments by @clelland, @jyasskin, @marcoscaceres)
-
previousResult not really stored anywhere w3c/permissions#234 (2 comments by @jyasskin, @marcoscaceres)
-
The "prompt" permission state maps poorly across browsers w3c/permissions#230 (1 comment by @marcoscaceres)
-
-
1 pull request opened.
-
Editorial: cleanup w3c/permissions#238, by @marcoscaceres.
-
-
2 pull requests merged.
-
Editorial: cleanup w3c/permissions#238.
-
Remove clipboard-read from PermissionName w3c/permissions#228.
-
-
1 pull request closed.
-
Remove clipboard-read w3c/permissions#222.
-
-
1 pull request reopened.
-
Add "gamepad" permission w3c/permissions#200, by @marcoscaceres.
-
-
4 pull requests received 5 new comments.
w3c/webappsec
-
1 issue opened.
-
Concerns with moving to living standard model w3c/webappsec#580, by @pes10k.
-
-
3 issues received 9 new comments.
-
Web Applications should not have internet access by default w3c/webappsec#578 (7 comments by @awwright, @craigfrancis, @dveditz, @ghost)
-
-
1 pull request opened.
-
[charter 2021] Widen scope of Permission API w3c/webappsec#579, by @marcoscaceres.
-
-
1 pull request merged.
-
Fix the name and URL of DAS WG w3c/webappsec#577.
-
-
2 pull requests received 6 new comments.
-
[charter 2021] Widen scope of Permission API w3c/webappsec#579 (4 comments by @clelland, @marcoscaceres, @mikewest)
-
w3c/trusted-types
-
2 issues received 4 new comments.
-
Access the source/file that is using the 'default' policy w3c/trusted-types#295 (2 comments by @koto, @Siegrift)
w3c/webappsec-credential-management
-
1 issue opened.
-
Replace "a priori authenticated URL" with "potentially trustworthy URL" w3c/webappsec-credential-management#166, by @fred-wang.
-
-
1 issue closed.
-
Examples in the wild w3c/webappsec-credential-management#164.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Replace void with undefined in Web IDL w3c/webappsec-credential-management#165, by @foolip.
-
-
1 pull request merged.
-
Editorial: Align with Web IDL specification w3c/webappsec-credential-management#149.
-
-
1 pull request closed.
-
Replace void with undefined in Web IDL w3c/webappsec-credential-management#165.
-
-
3 pull requests received 7 new comments.
-
Add "conditional mediation" w3c/webappsec-credential-management#155 (4 comments by @equalsJeffH, @MasterKale)
-
Replace void with undefined in Web IDL w3c/webappsec-credential-management#165 (2 comments by @foolip)
-
Editorial: Align with Web IDL specification w3c/webappsec-credential-management#149 (1 comment by @foolip)
-
w3c/webappsec-fetch-metadata
-
1 issue received 2 new comments.
-
`Sec-Fetch-Site` for requests from extension background pages w3c/webappsec-fetch-metadata#47 (2 comments by @annevk, @iVanlIsh)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 30 June 2021.
-
TR publications
-
7 documents published.
-
Content Security Policy Level 3 published 4 times as a Working Draft. History of Content Security Policy Level 3
-
Fetch Metadata Request Headers published twice as a Working Draft. History of Fetch Metadata Request Headers
-
Post-Spectre Web Development published as a First Public Working Draft. History of Post-Spectre Web Development
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
S Tran (Wikimedia Foundation) joined.
-
-
1 organization joined.
-
Wikimedia Foundation joined.
-
-
1 organization left.
-
PayPal left.
-
GitHub
w3c/webappsec-csp
-
5 issues opened.
-
Fix "network scheme" references. w3c/webappsec-csp#479, by @jyasskin.
-
Media queries in the `media` attribute should be subject to CSP w3c/webappsec-csp#476, by @arturjanc.
-
Should the parent CSP apply to documents created by svg images? w3c/webappsec-csp#474, by @antosart.
-
Non-ASCII characters in CSP policy. w3c/webappsec-csp#473, by @antosart.
-
More robust handling of non-executable <script> nodes w3c/webappsec-csp#472, by @arturjanc.
-
-
3 issues closed.
-
More robust handling of non-executable <script> nodes w3c/webappsec-csp#472.
-
Fix "network scheme" references. w3c/webappsec-csp#479.
-
Use Infra for JSON w3c/webappsec-csp#455.
-
-
11 issues received 39 new comments.
-
Should the parent CSP apply to documents created by svg images? w3c/webappsec-csp#474 (7 comments by @annevk, @antosart, @mikewest)
-
Non-ASCII characters in CSP policy. w3c/webappsec-csp#473 (6 comments by @annevk, @bakkot, @chrishtr, @dveditz)
-
More robust handling of non-executable <script> nodes w3c/webappsec-csp#472 (5 comments by @arturjanc, @domenic, @jeremyroman)
-
Cross-realm eval() calls and 'unsafe-eval' w3c/webappsec-csp#438 (2 comments by @dinofx, @TomiBelan)
-
Accessing the `nonce` from JS, effectively makes all nonce based CSPs `strict-dynamic` w3c/webappsec-csp#458 (2 comments by @arturjanc, @ctidd)
-
Media queries in the `media` attribute should be subject to CSP w3c/webappsec-csp#476 (2 comments by @annevk, @arturjanc)
-
Add report samples to security considerations w3c/webappsec-csp#470 (2 comments by @arturjanc, @jyasskin)
-
Handling of javascript: navigations is not interoperable, spec doesn't match most implementations w3c/webappsec-csp#322 (1 comment by @dinofx)
-
11 pull requests opened.
-
Clarify what to do with non-ASCII characters w3c/webappsec-csp#486, by @antosart.
-
Editorial: Use https URLs in README.md w3c/webappsec-csp#485, by @sideshowbarker.
-
CI: (re)Drop Previous Version bikeshed metadata w3c/webappsec-csp#484, by @sideshowbarker.
-
CI: Drop the Previous Version bikeshed metadata w3c/webappsec-csp#483, by @sideshowbarker.
-
Adapt to the policy container w3c/webappsec-csp#482, by @antosart.
-
Editorial: Use "Previous Version: from biblio" w3c/webappsec-csp#481, by @sideshowbarker.
-
Editorial: Drop Previous Version link w3c/webappsec-csp#480, by @sideshowbarker.
-
Editorial: Update spec filename in README.md w3c/webappsec-csp#478, by @sideshowbarker.
-
CI: Enable Echidna autopublishing to TR space w3c/webappsec-csp#477, by @sideshowbarker.
-
Fix typo in img-src post-request checks w3c/webappsec-csp#475, by @antosart.
-
CI: Switch to using w3c/spec-prod w3c/webappsec-csp#471, by @sideshowbarker.
-
-
14 pull requests merged.
-
Clarify what to do with non-ASCII characters w3c/webappsec-csp#486.
-
Editorial: Use https URLs in README.md w3c/webappsec-csp#485.
-
CI: (re)Drop Previous Version bikeshed metadata w3c/webappsec-csp#484.
-
CI: Drop the Previous Version bikeshed metadata w3c/webappsec-csp#483.
-
Meta: align with Fetch w3c/webappsec-csp#461.
-
Editorial: Use "Previous Version: from biblio" w3c/webappsec-csp#481.
-
Editorial: Drop Previous Version link w3c/webappsec-csp#480.
-
Editorial: Update spec filename in README.md w3c/webappsec-csp#478.
-
Serialize JSON by reference to Infra spec w3c/webappsec-csp#465.
-
CI: Enable Echidna autopublishing to TR space w3c/webappsec-csp#477.
-
Fix typo in img-src post-request checks w3c/webappsec-csp#475.
-
CI: Switch to using w3c/spec-prod w3c/webappsec-csp#471.
-
Follow Bikeshed filename convention: Use index.bs w3c/webappsec-csp#469.
-
Match hash-algorithm parts case-insensitively (as CSP2) w3c/webappsec-csp#464.
-
-
4 pull requests received 16 new comments.
-
Clarify what to do with non-ASCII characters w3c/webappsec-csp#486 (6 comments by @annevk, @antosart)
-
Match hash-algorithm parts case-insensitively (as CSP2) w3c/webappsec-csp#464 (1 comment by @sideshowbarker)
w3c/webappsec
-
1 issue opened.
-
Web Applications should not have internet access by default w3c/webappsec#578, by @ghost.
-
-
1 issue received 1 new comment.
-
2 pull requests opened.
-
Fix the name and URL of DAS WG w3c/webappsec#577, by @xfq.
-
Editorial fixes w3c/webappsec#576, by @dontcallmedom.
-
-
1 pull request merged.
-
Editorial fixes w3c/webappsec#576.
-
-
1 pull request received 1 new comment.
w3c/permissions
-
1 issue closed.
-
PWA install permission w3c/permissions#227.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Remove Permission Registry provisional note w3c/permissions#232, by @anssiko.
-
-
1 pull request merged.
-
Remove Permission Registry provisional note w3c/permissions#232.
-
-
1 pull request received 2 new comments.
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Replace references to the "sync-xhr" policy-controlled feature w3c/webappsec-permissions-policy#419, by @sideshowbarker.
-
Proper delimiter clarification w3c/webappsec-permissions-policy#418, by @patricktokeeffe.
-
-
1 issue closed.
-
Proper delimiter clarification w3c/webappsec-permissions-policy#418.
-
-
2 issues received 4 new comments.
-
Proper delimiter clarification w3c/webappsec-permissions-policy#418 (3 comments by @annevk, @clelland, @patricktokeeffe)
-
w3c/webappsec-referrer-policy
-
1 issue received 2 new comments.
-
Allow referrerpolicy attribute on <link> w3c/webappsec-referrer-policy#15 (2 comments by @Alynva, @annevk)
-
-
3 pull requests opened.
-
Editorial: Fix HTML markup conformance error w3c/webappsec-referrer-policy#151, by @sideshowbarker.
-
CI: Switch to https://github.com/w3c/spec-prod w3c/webappsec-referrer-policy#150, by @sideshowbarker.
-
Update Version History URL to "main" branch w3c/webappsec-referrer-policy#149, by @sideshowbarker.
-
-
1 pull request merged.
-
Update Version History URL to "main" branch w3c/webappsec-referrer-policy#149.
-
-
1 pull request received 1 new comment.
-
CI: Switch to https://github.com/w3c/spec-prod w3c/webappsec-referrer-policy#150 (1 comment by @sideshowbarker)
-
w3c/webcrypto
-
2 issues closed.
-
ECC-based encryption? w3c/webcrypto#176.
-
support streaming hashing w3c/webcrypto#250.
-
-
1 issue received 3 new comments.
w3c/webappsec-cspee
-
1 issue opened.
-
Status of CSPEE spec? Implementor interest? w3c/webappsec-cspee#19, by @sideshowbarker.
-
-
1 pull request opened.
-
Fix typo w3c/webappsec-cspee#20, by @ericlaw1979.
-
-
1 pull request merged.
-
Fix typo w3c/webappsec-cspee#20.
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Examples in the wild w3c/webappsec-credential-management#164, by @SilentImp.
-
-
2 issues received 2 new comments.
-
Username/ID hint for navigator.credentials.get() w3c/webappsec-credential-management#144 (1 comment by @ChadKillingsworth)
w3c/webappsec-fetch-metadata
-
2 issues opened.
-
Sec-Fetch-Site's use of "initiator" is misleading w3c/webappsec-fetch-metadata#72, by @domenic.
-
Sec-Fetch-User and Sec-Fetch-Site for user-initiated UI navigations w3c/webappsec-fetch-metadata#71, by @annevk.
-
-
4 issues closed.
-
Sec-Fetch-Site's use of "initiator" is misleading w3c/webappsec-fetch-metadata#72.
-
Naming for new items in `mode`. w3c/webappsec-fetch-metadata#45.
-
New 'Sec-Fetch-Dest' Type - "import" w3c/webappsec-fetch-metadata#59.
-
Fetch integration w3c/webappsec-fetch-metadata#58.
-
-
7 issues received 11 new comments.
-
Sec-Fetch-User and Sec-Fetch-Site for user-initiated UI navigations w3c/webappsec-fetch-metadata#71 (3 comments by @annevk, @arturjanc, @domenic)
-
Sec-Fetch-Site's use of "initiator" is misleading w3c/webappsec-fetch-metadata#72 (2 comments by @domenic, @mikewest)
-
Why is `Sec-Fetch-Site` based on the full URL redirect chain? w3c/webappsec-fetch-metadata#28 (1 comment by @annevk)
-
Update Redirect section with HTTPS->HTTP behavior w3c/webappsec-fetch-metadata#29 (1 comment by @annevk)
-
-
7 pull requests opened.
-
Editorial: Use "Previous Version: from biblio" w3c/webappsec-fetch-metadata#70, by @sideshowbarker.
-
Update URL of ED w3c/webappsec-fetch-metadata#69, by @tidoust.
-
Editorial: Fix Previous Version URL w3c/webappsec-fetch-metadata#68, by @sideshowbarker.
-
Editorial: Switch status to WD for Echidna w3c/webappsec-fetch-metadata#67, by @sideshowbarker.
-
CI: Enable Echidna autopublishing to TR space w3c/webappsec-fetch-metadata#66, by @sideshowbarker.
-
Meta: Make Version History link to main (!master) w3c/webappsec-fetch-metadata#65, by @sideshowbarker.
-
CI: GitHub-Actions-based build-validate-publish w3c/webappsec-fetch-metadata#64, by @sideshowbarker.
-
-
7 pull requests merged.
-
Editorial: Use "Previous Version: from biblio" w3c/webappsec-fetch-metadata#70.
-
Update URL of ED w3c/webappsec-fetch-metadata#69.
-
Editorial: Fix Previous Version URL w3c/webappsec-fetch-metadata#68.
-
Editorial: Switch status to WD for Echidna w3c/webappsec-fetch-metadata#67.
-
CI: Enable Echidna autopublishing to TR space w3c/webappsec-fetch-metadata#66.
-
Meta: Make Version History link to main (!master) w3c/webappsec-fetch-metadata#65.
-
CI: GitHub-Actions-based build-validate-publish w3c/webappsec-fetch-metadata#64.
-
-
1 pull request closed.
-
Regenerate index.html file w3c/webappsec-fetch-metadata#62.
-
-
3 pull requests received 3 new comments.
-
CI: Enable Echidna autopublishing to TR space w3c/webappsec-fetch-metadata#66 (1 comment by @sideshowbarker)
-
CI: GitHub-Actions-based build-validate-publish w3c/webappsec-fetch-metadata#64 (1 comment by @mikewest)
-
w3c/webappsec-post-spectre-webdev
-
3 issues opened.
-
Editorial: uppercase group w3c/webappsec-post-spectre-webdev#13, by @annevk.
-
Why is Sec-Fetch-User not mentioned? w3c/webappsec-post-spectre-webdev#12, by @annevk.
-
Should static resources use Vary? w3c/webappsec-post-spectre-webdev#11, by @annevk.
-
-
3 issues closed.
-
Why is Sec-Fetch-User not mentioned? w3c/webappsec-post-spectre-webdev#12.
-
Editorial: uppercase group w3c/webappsec-post-spectre-webdev#13.
-
Should static resources use Vary? w3c/webappsec-post-spectre-webdev#11.
-
-
3 issues received 4 new comments.
-
Why is Sec-Fetch-User not mentioned? w3c/webappsec-post-spectre-webdev#12 (2 comments by @arturjanc, @mikewest)
-
-
10 pull requests opened.
-
Cite “A guide to enable cross-origin isolation” w3c/webappsec-post-spectre-webdev#23, by @sideshowbarker.
-
Editorial: Set 'Level: none' in Bikeshed metadata w3c/webappsec-post-spectre-webdev#22, by @sideshowbarker.
-
Editorial: Drop “site-isolation” dupe from biblio w3c/webappsec-post-spectre-webdev#21, by @sideshowbarker.
-
Editorial: Fix a couple of typos/misspellings w3c/webappsec-post-spectre-webdev#20, by @sideshowbarker.
-
Editorial: Make FWPD indicate non-Rec-track w3c/webappsec-post-spectre-webdev#19, by @sideshowbarker.
-
Align repo-type with documented taxonomy w3c/webappsec-post-spectre-webdev#18, by @dontcallmedom.
-
Editorial: Add w3cid for Mike West as editor w3c/webappsec-post-spectre-webdev#17, by @sideshowbarker.
-
Editorial: Prep fpwd.html 2021-03-16 publication w3c/webappsec-post-spectre-webdev#16, by @sideshowbarker.
-
CI: Use GitHub Actions to build/validate/publish w3c/webappsec-post-spectre-webdev#15, by @sideshowbarker.
-
update github.io link w3c/webappsec-post-spectre-webdev#14, by @wseltzer.
-
-
9 pull requests merged.
-
Cite “A guide to enable cross-origin isolation” w3c/webappsec-post-spectre-webdev#23.
-
Editorial: Set 'Level: none' in Bikeshed metadata w3c/webappsec-post-spectre-webdev#22.
-
Editorial: Drop “site-isolation” dupe from biblio w3c/webappsec-post-spectre-webdev#21.
-
Editorial: Fix a couple of typos/misspellings w3c/webappsec-post-spectre-webdev#20.
-
Align repo-type with documented taxonomy w3c/webappsec-post-spectre-webdev#18.
-
Editorial: Make FWPD indicate non-Rec-track w3c/webappsec-post-spectre-webdev#19.
-
Editorial: Add w3cid for Mike West as editor w3c/webappsec-post-spectre-webdev#17.
-
Editorial: Prep fpwd.html 2021-03-16 publication w3c/webappsec-post-spectre-webdev#16.
-
CI: Use GitHub Actions to build/validate/publish w3c/webappsec-post-spectre-webdev#15.
-
-
1 pull request closed.
-
update github.io link w3c/webappsec-post-spectre-webdev#14.
-
-
5 pull requests received 8 new comments.
-
CI: Use GitHub Actions to build/validate/publish w3c/webappsec-post-spectre-webdev#15 (4 comments by @mikewest, @sideshowbarker)
-
Cite “A guide to enable cross-origin isolation” w3c/webappsec-post-spectre-webdev#23 (1 comment by @mikewest)
-
Editorial: Set 'Level: none' in Bikeshed metadata w3c/webappsec-post-spectre-webdev#22 (1 comment by @mikewest)
-
Editorial: Prep fpwd.html 2021-03-16 publication w3c/webappsec-post-spectre-webdev#16 (1 comment by @mikewest)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Status of Clear-Site-Data spec? Implementor interest? w3c/webappsec-clear-site-data#71, by @sideshowbarker.
-
-
1 issue received 2 new comments.
-
Status of Clear-Site-Data spec? Implementor interest? w3c/webappsec-clear-site-data#71 (2 comments by @annevk, @sideshowbarker)
-
w3c/webappsec-cors-for-developers
-
1 issue opened.
-
Mark document as no longer being worked on? And archive this repo? w3c/webappsec-cors-for-developers#11, by @sideshowbarker.
-
w3c/webappsec-suborigins
-
1 issue opened.
-
Mark spec as no longer being worked on? And archive this repo? w3c/webappsec-suborigins#81, by @sideshowbarker.
-
w3c/webappsec-uisecurity
-
1 issue opened.
-
Mark spec as no longer being worked on? And archive this repo? w3c/webappsec-uisecurity#15, by @sideshowbarker.
-
w3c/webappsec-mixed-content
-
2 issues opened.
-
Clarify treatment of CORS-enabled requests w3c/webappsec-mixed-content#50, by @letitz.
-
Spec is not clear about blobs created in sandboxed iframes w3c/webappsec-mixed-content#41, by @youennf.
-
-
1 issue closed.
-
WebSocket section needs updating w3c/webappsec-mixed-content#27.
-
-
3 issues received 14 new comments.
-
Spec is not clear about blobs created in sandboxed iframes w3c/webappsec-mixed-content#41 (11 comments by @annevk, @jimmywarting, @letitz, @mkruisselbrink, @youennf)
-
-
8 pull requests opened.
-
Remove TR reference from MIX2 w3c/webappsec-mixed-content#49, by @carlosjoan91.
-
Add note about redirections on form submissions w3c/webappsec-mixed-content#48, by @carlosjoan91.
-
Editorial: correct browsing context reference w3c/webappsec-mixed-content#47, by @annevk.
-
CI: Disable HTML validation until fixed w3c/webappsec-mixed-content#46, by @sideshowbarker.
-
Ediorial: Fix problems in Bikeshed markup w3c/webappsec-mixed-content#45, by @sideshowbarker.
-
Editorial: remove WebSocket remnants w3c/webappsec-mixed-content#44, by @annevk.
-
Editorial: several fields are now called URL (uppercase) w3c/webappsec-mixed-content#43, by @annevk.
-
CI: Switch to using GitHub Actions w3c/webappsec-mixed-content#42, by @sideshowbarker.
-
-
9 pull requests merged.
-
Remove TR reference from MIX2 w3c/webappsec-mixed-content#49.
-
Add note about redirections on form submissions w3c/webappsec-mixed-content#48.
-
Editorial: correct browsing context reference w3c/webappsec-mixed-content#47.
-
Ediorial: Fix problems in Bikeshed markup w3c/webappsec-mixed-content#45.
-
CI: Disable HTML validation until fixed w3c/webappsec-mixed-content#46.
-
Editorial: several fields are now called URL (uppercase) w3c/webappsec-mixed-content#43.
-
Editorial: remove WebSocket remnants w3c/webappsec-mixed-content#44.
-
CI: Switch to using GitHub Actions w3c/webappsec-mixed-content#42.
-
Fix typo: upgrade should turn scheme into https w3c/webappsec-mixed-content#37.
-
-
5 pull requests received 11 new comments.
-
Remove TR reference from MIX2 w3c/webappsec-mixed-content#49 (5 comments by @carlosjoan91, @sideshowbarker)
-
Editorial: correct browsing context reference w3c/webappsec-mixed-content#47 (2 comments by @annevk, @tabatkins)
-
CI: Switch to using GitHub Actions w3c/webappsec-mixed-content#42 (2 comments by @annevk, @sideshowbarker)
-
Add note about redirections on form submissions w3c/webappsec-mixed-content#48 (1 comment by @carlosjoan91)
-
Editorial: several fields are now called URL (uppercase) w3c/webappsec-mixed-content#43 (1 comment by @annevk)
-
w3c/webappsec-upgrade-insecure-requests
-
3 issues closed.
-
Upstream WebSocket bits to Fetch w3c/webappsec-upgrade-insecure-requests#11.
-
"a priori authenticated" w3c/webappsec-upgrade-insecure-requests#13.
-
URL's `port` is `null` if default value. w3c/webappsec-upgrade-insecure-requests#18.
-
-
5 pull requests opened.
-
Editorial: Use "Previous Version: from biblio" w3c/webappsec-upgrade-insecure-requests#25, by @sideshowbarker.
-
Modernize a bit w3c/webappsec-upgrade-insecure-requests#24, by @annevk.
-
Editorial: Update the Version History link URL w3c/webappsec-upgrade-insecure-requests#23, by @sideshowbarker.
-
Reference current HTML standard, not old fork w3c/webappsec-upgrade-insecure-requests#22, by @sideshowbarker.
-
CI: Switch to using GitHub Actions w3c/webappsec-upgrade-insecure-requests#21, by @sideshowbarker.
-
-
5 pull requests merged.
-
Modernize a bit w3c/webappsec-upgrade-insecure-requests#24.
-
Editorial: Use "Previous Version: from biblio" w3c/webappsec-upgrade-insecure-requests#25.
-
Editorial: Update the Version History link URL w3c/webappsec-upgrade-insecure-requests#23.
-
Reference current HTML standard, not old fork w3c/webappsec-upgrade-insecure-requests#22.
-
CI: Switch to using GitHub Actions w3c/webappsec-upgrade-insecure-requests#21.
-
-
1 pull request received 4 new comments.
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
Consider integrity check violation reporting w3c/webappsec-subresource-integrity#20 (1 comment by @briansmith)
-
-
1 pull request opened.
-
Switch to GitHub Actions build-validate-publish w3c/webappsec-subresource-integrity#100, by @sideshowbarker.
-
-
1 pull request merged.
-
Switch to GitHub Actions build-validate-publish w3c/webappsec-subresource-integrity#100.
-
-
1 pull request closed.
-
Updated index.html w3c/webappsec-subresource-integrity#93.
-
-
2 pull requests received 5 new comments.
-
Switch to GitHub Actions build-validate-publish w3c/webappsec-subresource-integrity#100 (4 comments by @mozfreddyb, @sideshowbarker)
-
w3c/trusted-types
-
3 issues closed.
-
`npm spec` eats translation errors w3c/trusted-types#112.
-
require-trusted-types-for 'wasm' w3c/trusted-types#256.
-
Restrict to secure contexts w3c/trusted-types#259.
-
-
3 issues received 5 new comments.
-
Make input argument to createHTML, createScript, and createScriptURL optional w3c/trusted-types#278 (1 comment by @koto)
-
5 pull requests opened.
-
Added privacy considerations section. w3c/trusted-types#337, by @koto.
-
Editorial: Removed bikeshed warnings & errors. w3c/trusted-types#336, by @koto.
-
Similified use case from #158 w3c/trusted-types#335, by @koto.
-
Fix the type of partial WindowOrWorkerGlobalScope w3c/trusted-types#334, by @foolip.
-
Added support for enforcing Trusted Types in workers. w3c/trusted-types#332, by @koto.
-
-
7 pull requests merged.
-
Added privacy considerations section. w3c/trusted-types#337.
-
Editorial: Removed bikeshed warnings & errors. w3c/trusted-types#336.
-
Similified use case from #158 w3c/trusted-types#335.
-
Fix the type of partial WindowOrWorkerGlobalScope w3c/trusted-types#334.
-
Added support for enforcing Trusted Types in workers. w3c/trusted-types#332.
-
Removed the secure context restrictions. w3c/trusted-types#279.
-
Fix remaining Web IDL issues w3c/trusted-types#308.
-
-
3 pull requests closed.
-
Adds use case to spec section 1.3. w3c/trusted-types#158.
-
First attempt at fixing #176. w3c/trusted-types#211.
-
Added attribute validate steps w3c/trusted-types#233.
-
-
1 pull request reopened.
-
Bump rollup from 1.17.0 to 2.40.0 w3c/trusted-types#311, by @koto.
-
-
21 pull requests received 24 new comments.
-
Added support for enforcing Trusted Types in workers. w3c/trusted-types#332 (2 comments by @foolip, @koto)
-
w3c/trusted-types#309 (2 comments by @koto)
-
w3c/trusted-types#333 (1 comment by @koto)
-
w3c/trusted-types#310 (1 comment by @koto)
-
w3c/trusted-types#314 (1 comment by @koto)
-
w3c/trusted-types#315 (1 comment by @koto)
-
w3c/trusted-types#319 (1 comment by @koto)
-
w3c/trusted-types#320 (1 comment by @koto)
-
w3c/trusted-types#322 (1 comment by @koto)
-
w3c/trusted-types#323 (1 comment by @koto)
-
w3c/trusted-types#324 (1 comment by @koto)
-
w3c/trusted-types#325 (1 comment by @koto)
-
w3c/trusted-types#326 (1 comment by @koto)
-
w3c/trusted-types#327 (1 comment by @koto)
-
w3c/trusted-types#328 (1 comment by @koto)
-
w3c/trusted-types#329 (1 comment by @koto)
-
w3c/trusted-types#330 (1 comment by @koto)
-
w3c/trusted-types#331 (1 comment by @koto)
-
w3c/trusted-types#304 (1 comment by @sideshowbarker)
-
w3c/webappsec-cowl
-
1 issue opened.
-
Mark spec as no longer being worked on? And archive this repo? w3c/webappsec-cowl#81, by @sideshowbarker.
-
-
1 issue received 3 new comments.
-
Mark spec as no longer being worked on? And archive this repo? w3c/webappsec-cowl#81 (3 comments by @deian, @sideshowbarker)
-
Participants
-
1 Team contact appointed.
-
Michael[tm] Smith (sideshowbarker) became a Team contact.
-
-
3 participants joined.
-
Francis McCabe (Google LLC) joined.
-
Michael[tm] Smith (sideshowbarker) (W3C) joined.
-
Abdulrahman Alqabandi (Microsoft Corporation) joined.
-
GitHub
w3c/webappsec-csp
-
2 issues opened.
-
Add report samples to security considerations w3c/webappsec-csp#470, by @jonathanKingston.
-
CSP report referrer property in reports with frame-ancestors CSP directive violations w3c/webappsec-csp#460, by @mxschmitt.
-
-
4 issues closed.
-
Consider removing plugin-types w3c/webappsec-csp#394.
-
Percent-decode is used incorrectly w3c/webappsec-csp#448.
-
hash-algo w3c/webappsec-csp#418.
-
Remove gh-pages branch? w3c/webappsec-csp#296.
-
-
7 issues received 13 new comments.
-
CSP report referrer property in reports with frame-ancestors CSP directive violations w3c/webappsec-csp#460 (2 comments by @annevk, @antosart)
-
9 pull requests opened.
-
Follow Bikeshed filename convention: Use index.bs w3c/webappsec-csp#469, by @sideshowbarker.
-
Meta: Remove index.html from version control w3c/webappsec-csp#468, by @sideshowbarker.
-
Change to "main" branch in Version History link w3c/webappsec-csp#467, by @sideshowbarker.
-
Auto-deploy/publish to gh-pages w/ GitHub Actions w3c/webappsec-csp#466, by @sideshowbarker.
-
Serialize JSON by reference to Infra spec w3c/webappsec-csp#465, by @sideshowbarker.
-
Match hash-algorithm parts case-insensitively (as CSP2) w3c/webappsec-csp#464, by @sideshowbarker.
-
Use “hash-algorithm” name (not old CSP2 “hash-algo” name) w3c/webappsec-csp#463, by @sideshowbarker.
-
Fix calls to “percent-decode” algorithm w3c/webappsec-csp#462, by @sideshowbarker.
-
Meta: align with Fetch w3c/webappsec-csp#461, by @annevk.
-
-
6 pull requests merged.
-
Remove plugin-types w3c/webappsec-csp#456.
-
Meta: Remove index.html from version control w3c/webappsec-csp#468.
-
Change to "main" branch in Version History link w3c/webappsec-csp#467.
-
Auto-deploy/publish to gh-pages w/ GitHub Actions w3c/webappsec-csp#466.
-
Fix calls to “percent-decode” algorithm w3c/webappsec-csp#462.
-
Use “hash-algorithm” name (not old CSP2 “hash-algo” name) w3c/webappsec-csp#463.
-
-
1 pull request reopened.
-
Introduce 'webrtc' as a simple on/off switch w3c/webappsec-csp#457, by @mikewest.
-
-
10 pull requests received 49 new comments.
-
Introduce 'webrtc' as a simple on/off switch w3c/webappsec-csp#457 (10 comments by @annevk, @mikewest, @sideshowbarker, @zenhack)
-
Match hash-algorithm parts case-insensitively (as CSP2) w3c/webappsec-csp#464 (9 comments by @annevk, @antosart, @ArthurSonzogni, @mikewest, @sideshowbarker)
-
Serialize JSON by reference to Infra spec w3c/webappsec-csp#465 (9 comments by @annevk, @mikewest, @sideshowbarker)
-
Fix calls to “percent-decode” algorithm w3c/webappsec-csp#462 (5 comments by @annevk, @mikewest, @sideshowbarker)
-
Use correct set of source expressions in script directives pre-request check w3c/webappsec-csp#424 (4 comments by @annevk, @sideshowbarker, @w3cbot)
-
Use “hash-algorithm” name (not old CSP2 “hash-algo” name) w3c/webappsec-csp#463 (4 comments by @annevk, @mikewest, @sideshowbarker)
-
Change to "main" branch in Version History link w3c/webappsec-csp#467 (3 comments by @annevk, @sideshowbarker)
-
Meta: Remove index.html from version control w3c/webappsec-csp#468 (2 comments by @annevk, @sideshowbarker)
-
Auto-deploy/publish to gh-pages w/ GitHub Actions w3c/webappsec-csp#466 (2 comments by @sideshowbarker)
-
w3c/webcrypto
-
1 issue opened.
-
support streaming hashing w3c/webcrypto#250, by @ianopolous.
-
-
2 issues received 6 new comments.
-
Key usages too granular? w3c/webcrypto#240 (5 comments by @ByteEater-pl, @pwombwell, @sideshowbarker)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @TheUltDev)
-
w3c/webappsec-post-spectre-webdev
-
9 issues opened.
-
Maybe add a note about cross-origin isolation w3c/webappsec-post-spectre-webdev#9, by @shhnjk.
-
Is there any benefit on explicitly setting default headers? w3c/webappsec-post-spectre-webdev#8, by @shhnjk.
-
Try asking for requesting CORS for default no-cors subresources? w3c/webappsec-post-spectre-webdev#7, by @shhnjk.
-
What do you mean by this? w3c/webappsec-post-spectre-webdev#6, by @shhnjk.
-
Better wording for process boundary w3c/webappsec-post-spectre-webdev#5, by @shhnjk.
-
Should we have TAO * even for static subresources? w3c/webappsec-post-spectre-webdev#4, by @camillelamy.
-
Clarify the risk coming from embedded iframes w3c/webappsec-post-spectre-webdev#3, by @camillelamy.
-
Make recommendations around local-schemed frames. w3c/webappsec-post-spectre-webdev#2, by @mikewest.
-
Does `Content-Disposition` have useful meaning? w3c/webappsec-post-spectre-webdev#1, by @mikewest.
-
-
7 issues closed.
-
Try asking for requesting CORS for default no-cors subresources? w3c/webappsec-post-spectre-webdev#7.
-
Does `Content-Disposition` have useful meaning? w3c/webappsec-post-spectre-webdev#1.
-
What do you mean by this? w3c/webappsec-post-spectre-webdev#6.
-
Maybe add a note about cross-origin isolation w3c/webappsec-post-spectre-webdev#9.
-
Is there any benefit on explicitly setting default headers? w3c/webappsec-post-spectre-webdev#8.
-
Better wording for process boundary w3c/webappsec-post-spectre-webdev#5.
-
Clarify the risk coming from embedded iframes w3c/webappsec-post-spectre-webdev#3.
-
-
9 issues received 24 new comments.
-
Try asking for requesting CORS for default no-cors subresources? w3c/webappsec-post-spectre-webdev#7 (7 comments by @arturjanc, @mikewest, @shhnjk)
-
Does `Content-Disposition` have useful meaning? w3c/webappsec-post-spectre-webdev#1 (4 comments by @arturjanc, @mikewest, @shhnjk)
-
Make recommendations around local-schemed frames. w3c/webappsec-post-spectre-webdev#2 (4 comments by @mikewest, @shhnjk)
-
Maybe add a note about cross-origin isolation w3c/webappsec-post-spectre-webdev#9 (2 comments by @mikewest, @shhnjk)
-
Better wording for process boundary w3c/webappsec-post-spectre-webdev#5 (2 comments by @mikewest, @shhnjk)
-
Is there any benefit on explicitly setting default headers? w3c/webappsec-post-spectre-webdev#8 (1 comment by @mikewest)
-
Clarify the risk coming from embedded iframes w3c/webappsec-post-spectre-webdev#3 (1 comment by @mikewest)
-
Should we have TAO * even for static subresources? w3c/webappsec-post-spectre-webdev#4 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Clarify the threat model's browser process description. w3c/webappsec-post-spectre-webdev#10, by @mikewest.
-
-
1 pull request merged.
-
Clarify the threat model's browser process description. w3c/webappsec-post-spectre-webdev#10.
-
-
1 pull request received 1 new comment.
-
Clarify the threat model's browser process description. w3c/webappsec-post-spectre-webdev#10 (1 comment by @shhnjk)
-
w3c/permissions
-
1 issue closed.
-
PermissionName not defined as proper IDL block w3c/permissions#205.
-
-
1 issue received 1 new comment.
-
1 pull request merged.
-
Expose PermissionName as IDL w3c/permissions#229.
-
-
1 pull request received 5 new comments.
w3c/webappsec-credential-management
-
1 issue opened.
-
section 5.2. Requiring User Mediation, point 1: should be return `true` w3c/webappsec-credential-management#154, by @equalsJeffH.
-
-
9 pull requests opened.
-
Add .gitignore (to ignore index.html file) w3c/webappsec-credential-management#163, by @sideshowbarker.
-
CI: Drop Travis, git rm index.html, use index.bs w3c/webappsec-credential-management#162, by @sideshowbarker.
-
CI: Disable link checker w3c/webappsec-credential-management#161, by @sideshowbarker.
-
Meta: Change to "main" branch in Version History link w3c/webappsec-credential-management#160, by @sideshowbarker.
-
Cite HTML for postMessage(), not WEBMESSAGING fork w3c/webappsec-credential-management#159, by @sideshowbarker.
-
Meta: Build, validate, and publish spec automatically w3c/webappsec-credential-management#158, by @sideshowbarker.
-
Jeffh update editorship (rebuild index.html) w3c/webappsec-credential-management#157, by @equalsJeffH.
-
update editorship w3c/webappsec-credential-management#156, by @equalsJeffH.
-
Add "conditional mediation" w3c/webappsec-credential-management#155, by @equalsJeffH.
-
-
8 pull requests merged.
-
Add .gitignore (to ignore index.html file) w3c/webappsec-credential-management#163.
-
CI: Drop Travis, git rm index.html, use index.bs w3c/webappsec-credential-management#162.
-
CI: Disable link checker w3c/webappsec-credential-management#161.
-
Meta: Build, validate, and publish spec automatically w3c/webappsec-credential-management#158.
-
Meta: Change to "main" branch in Version History link w3c/webappsec-credential-management#160.
-
Cite HTML for postMessage(), not WEBMESSAGING fork w3c/webappsec-credential-management#159.
-
Jeffh update editorship (rebuild index.html) w3c/webappsec-credential-management#157.
-
update editorship w3c/webappsec-credential-management#156.
-
-
1 pull request received 4 new comments.
-
Add "conditional mediation" w3c/webappsec-credential-management#155 (4 comments by @mikewest, @nsatragno)
-
w3c/webappsec
-
1 issue opened.
-
editorial issues with 2021 draft charter w3c/webappsec#573, by @dveditz.
-
-
2 issues closed.
-
editorial issues with 2021 draft charter w3c/webappsec#573.
-
TPAC 2019 Agenda. w3c/webappsec#555.
-
-
1 issue received 3 new comments.
-
3 pull requests opened.
-
Charter 2021 first draft w3c/webappsec#574, by @samuelweiler.
-
mark 2 specs as abandoned or obsolete w3c/webappsec#572, by @samuelweiler.
-
number agreement, oxford commas, and other editorial nits w3c/webappsec#571, by @samuelweiler.
-
-
5 pull requests merged.
-
Charter 2021 first draft w3c/webappsec#574.
-
framing security needs for Web Payments w3c/webappsec#552.
-
number agreement, oxford commas, and other editorial nits w3c/webappsec#571.
-
Add the two change-password-url specs to the list. w3c/webappsec#569.
-
mark 2 specs as abandoned or obsolete w3c/webappsec#572.
-
-
1 pull request closed.
-
Updated the page title to 2019 w3c/webappsec#542.
-
-
2 pull requests received 3 new comments.
w3c/webappsec-subresource-integrity
-
5 issues closed.
-
Remove the `integrity` IDL attributes w3c/webappsec-subresource-integrity#92.
-
"Apply algorithm to response" is recursive with no base case w3c/webappsec-subresource-integrity#63.
-
Bikeshed generated a garbage at the top w3c/webappsec-subresource-integrity#72.
-
[CORS] reference is wrong w3c/webappsec-subresource-integrity#41.
-
Consider require integrity metadata for Fetch w3c/webappsec-subresource-integrity#51.
-
-
3 issues received 3 new comments.
-
Bikeshed generated a garbage at the top w3c/webappsec-subresource-integrity#72 (1 comment by @annevk)
-
Consider require integrity metadata for Fetch w3c/webappsec-subresource-integrity#51 (1 comment by @annevk)
-
-
5 pull requests opened.
-
Remove text redundant with HTML w3c/webappsec-subresource-integrity#99, by @annevk.
-
Editorial: correct heading level w3c/webappsec-subresource-integrity#98, by @annevk.
-
Let Fetch be in charge of extracting the bytes w3c/webappsec-subresource-integrity#97, by @annevk.
-
Reference Fetch spec rather than CORS spec w3c/webappsec-subresource-integrity#96, by @sideshowbarker.
-
chore: Remove quotes in URL w3c/webappsec-subresource-integrity#95, by @nschonni.
-
-
5 pull requests merged.
-
chore: Remove quotes in URL w3c/webappsec-subresource-integrity#95.
-
Remove text redundant with HTML w3c/webappsec-subresource-integrity#99.
-
Editorial: correct heading level w3c/webappsec-subresource-integrity#98.
-
Let Fetch be in charge of extracting the bytes w3c/webappsec-subresource-integrity#97.
-
Reference Fetch spec rather than CORS spec w3c/webappsec-subresource-integrity#96.
-
-
1 pull request closed.
-
Correct spelling for other GitHub w3c/webappsec-subresource-integrity#88.
-
-
3 pull requests received 5 new comments.
-
Let Fetch be in charge of extracting the bytes w3c/webappsec-subresource-integrity#97 (2 comments by @annevk, @mozfreddyb)
-
Reference Fetch spec rather than CORS spec w3c/webappsec-subresource-integrity#96 (2 comments by @annevk, @sideshowbarker)
-
w3c/webappsec-permissions-policy
-
1 pull request opened.
-
Add .circleci/config.yml w3c/webappsec-permissions-policy#417, by @Brenoamandobg.
-
w3c/webappsec-change-password-url
-
1 issue closed.
-
Migrate to WebAppSec? w3c/webappsec-change-password-url#18.
-
-
1 issue received 1 new comment.
w3c/webappsec-clear-site-data
-
1 issue opened.
-
What happens when the server tells the UA to clear site data while sending new data? w3c/webappsec-clear-site-data#69, by @cqueern.
-
-
1 issue closed.
-
What happens when the server tells the UA to clear site data while sending new data? w3c/webappsec-clear-site-data#69.
-
-
1 issue received 2 new comments.
-
What happens when the server tells the UA to clear site data while sending new data? w3c/webappsec-clear-site-data#69 (2 comments by @annevk, @cqueern)
-
-
1 pull request opened.
-
Update index.html w3c/webappsec-clear-site-data#70, by @sideshowbarker.
-
-
1 pull request merged.
-
Update index.html w3c/webappsec-clear-site-data#70.
-
w3c/trusted-types
-
1 issue closed.
-
Trusted Type instances JSON.stringify as empty objects w3c/trusted-types#306.
-
-
1 pull request opened.
-
Fix remaining Web IDL issues w3c/trusted-types#308, by @foolip.
-
-
1 pull request closed.
-
Fix invalid Web IDL syntax w3c/trusted-types#282.
-
-
1 pull request received 1 new comment.
w3c/webappsec-mixed-content
-
2 pull requests opened.
-
Update index.html w3c/webappsec-mixed-content#40, by @sideshowbarker.
-
Travis CI: Use "main" branch, not "master" w3c/webappsec-mixed-content#39, by @sideshowbarker.
-
-
1 pull request merged.
-
Update index.html w3c/webappsec-mixed-content#40.
-
-
1 pull request closed.
-
Travis CI: Use "main" branch, not "master" w3c/webappsec-mixed-content#39.
-
w3c/webappsec-fetch-metadata
-
3 pull requests opened.
-
Set a structured header→Set a structured field value w3c/webappsec-fetch-metadata#63, by @sideshowbarker.
-
Regenerate index.html file w3c/webappsec-fetch-metadata#62, by @sideshowbarker.
-
Chore: Remove Explainer metadata w3c/webappsec-fetch-metadata#61, by @nschonni.
-
-
2 pull requests merged.
-
Set a structured header→Set a structured field value w3c/webappsec-fetch-metadata#63.
-
Chore: Remove Explainer metadata w3c/webappsec-fetch-metadata#61.
-
-
1 pull request closed.
-
Meta: generate HTML w3c/webappsec-fetch-metadata#53.
-
-
3 pull requests received 8 new comments.
w3c/webappsec-secure-contexts
-
1 issue received 4 new comments.
-
Surprising inheritance behavior for opened windows w3c/webappsec-secure-contexts#82 (4 comments by @annevk, @letitz)
-
w3c/webappsec-uisecurity
-
1 pull request opened.
-
fix: HTML validation errors from Bikeshed w3c/webappsec-uisecurity#14, by @nschonni.
-
-
1 pull request received 2 new comments.
-
fix: HTML validation errors from Bikeshed w3c/webappsec-uisecurity#14 (2 comments by @nschonni, @w3cbot)
-
Participants
-
2 participants joined.
-
Jonathan Kingston (Duck Duck Go, Inc.) joined.
-
Josh Carlson (Brightcove) joined.
-
-
3 organizations joined.
-
Duck Duck Go, Inc. joined.
-
Brightcove joined.
-
Igalia joined.
-
GitHub
w3c/webcrypto
-
3 issues opened.
-
New editor for the Web Crypto spec w3c/webcrypto#249, by @sideshowbarker.
-
Allow add external algorithm bridge w3c/webcrypto#248, by @septs.
-
Author link w3c/webcrypto#247, by @zBugi.
-
-
9 issues closed.
-
Support for window.crypto.signText w3c/webcrypto#195.
-
UUID generation as part of crypto.subtle? w3c/webcrypto#215.
-
Add a note directing future proposals to WICG w3c/webcrypto#165.
-
TypeMismatchError is deprecated w3c/webcrypto#183.
-
Update the Algorith Interop Table w3c/webcrypto#12.
-
Add note on IV re-use in AES-GCM w3c/webcrypto#209.
-
Author link w3c/webcrypto#247.
-
EdDSA support w3c/webcrypto#219.
-
26 issues received 48 new comments.
-
UUID generation as part of crypto.subtle? w3c/webcrypto#215 (5 comments by @ctavan, @sideshowbarker)
-
Accept shared ArrayBufferView also? w3c/webcrypto#213 (4 comments by @jimmywarting, @sideshowbarker)
-
support for Curve25519 in WebCrypto. w3c/webcrypto#233 (2 comments by @dontcallmedom, @sideshowbarker)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @mikeal, @sideshowbarker)
-
AES-CBC decryption should not throw error while dealing with bad padded ciphers w3c/webcrypto#177 (1 comment by @sideshowbarker)
-
Should window.crypto be specified to be non-configurable and non-writable? w3c/webcrypto#169 (1 comment by @sideshowbarker)
-
2 pull requests merged.
-
Fix name of EMSA-PSS-Encode operation w3c/webcrypto#243.
-
Add missing adjective: "cryptographically strong" w3c/webcrypto#230.
-
w3c/webappsec-csp
-
3 issues opened.
-
Clarify meaning of 'self' for CSPs in meta tags of local-scheme documents w3c/webappsec-csp#459, by @antosart.
-
Accessing the `nonce` from JS, effectively makes all nonce based CSPs `strict-dynamic` w3c/webappsec-csp#458, by @shaialon.
-
Use Infra for JSON w3c/webappsec-csp#455, by @annevk.
-
-
5 issues received 26 new comments.
-
Clarify meaning of 'self' for CSPs in meta tags of local-scheme documents w3c/webappsec-csp#459 (12 comments by @annevk, @antosart, @mikewest)
-
Accessing the `nonce` from JS, effectively makes all nonce based CSPs `strict-dynamic` w3c/webappsec-csp#458 (6 comments by @arturjanc, @mikewest, @mikispag, @shaialon)
-
-
3 pull requests opened.
-
Introduce 'webrtc' as a simple on/off switch w3c/webappsec-csp#457, by @zenhack.
-
Remove plugin-types w3c/webappsec-csp#456, by @antosart.
-
Restore CSP Level 2 reporting envelope w3c/webappsec-csp#454, by @clelland.
-
-
1 pull request merged.
-
Restore CSP Level 2 reporting envelope w3c/webappsec-csp#454.
-
-
4 pull requests received 25 new comments.
-
Introduce 'webrtc' as a simple on/off switch w3c/webappsec-csp#457 (11 comments by @annevk, @mozfreddyb, @samuelweiler, @zenhack)
-
Restore CSP Level 2 reporting envelope w3c/webappsec-csp#454 (3 comments by @ArthurSonzogni, @clelland)
-
w3c/webappsec-change-password-url
-
1 pull request merged.
-
Add Elaine Knight as an editor of the HTTP response code reliability document. w3c/webappsec-change-password-url#33.
-
w3c/trusted-types
-
2 issues opened.
-
Trusted Type instances JSON.stringify as empty objects w3c/trusted-types#306, by @koto.
-
Maybe remove plugin enforcement from Trusted Types? w3c/trusted-types#305, by @shhnjk.
-
-
1 issue received 7 new comments.
-
Maybe remove plugin enforcement from Trusted Types? w3c/trusted-types#305 (7 comments by @koto, @mikewest, @shhnjk)
-
-
1 pull request opened.
-
Update full.js w3c/trusted-types#307, by @mamunbcd21.
-
-
1 pull request closed.
-
Update full.js w3c/trusted-types#307.
-
w3c/permissions
-
2 issues opened.
-
The "prompt" permission state maps poorly across browsers w3c/permissions#230, by @jan-ivar.
-
Clarify when a site is allowed to display the permission prompt w3c/permissions#245, by @collimarco.
-
-
1 issue received 1 new comment.
-
The "prompt" permission state maps poorly across browsers w3c/permissions#230 (1 comment by @youennf)
-
w3c/webappsec-referrer-policy
-
2 issues closed.
-
Typo: space between “non-” and “potentially trustworthy” w3c/webappsec-referrer-policy#118.
-
What default policy should new features use? w3c/webappsec-referrer-policy#121.
-
-
2 issues received 2 new comments.
-
Typo: space between “non-” and “potentially trustworthy” w3c/webappsec-referrer-policy#118 (1 comment by @domfarolino)
-
What default policy should new features use? w3c/webappsec-referrer-policy#121 (1 comment by @domfarolino)
-
-
4 pull requests opened.
-
Clarify the rare inheritance of referrer policy w3c/webappsec-referrer-policy#148, by @domfarolino.
-
Use GitHub workflows to publish the spec w3c/webappsec-referrer-policy#147, by @domfarolino.
-
No need to use the word "associated" when referring to referrer policy w3c/webappsec-referrer-policy#146, by @domfarolino.
-
Rebuild spec to correct a few things w3c/webappsec-referrer-policy#145, by @domfarolino.
-
-
4 pull requests merged.
-
Clarify the rare inheritance of referrer policy w3c/webappsec-referrer-policy#148.
-
Use GitHub workflows to publish the spec w3c/webappsec-referrer-policy#147.
-
No need to use the word "associated" when referring to referrer policy w3c/webappsec-referrer-policy#146.
-
Rebuild spec to correct a few things w3c/webappsec-referrer-policy#145.
-
-
2 pull requests received 21 new comments.
-
Clarify the rare inheritance of referrer policy w3c/webappsec-referrer-policy#148 (15 comments by @annevk, @domenic, @domfarolino)
-
Use GitHub workflows to publish the spec w3c/webappsec-referrer-policy#147 (6 comments by @domenic, @domfarolino)
-
w3c/webappsec-secure-contexts
-
3 issues opened.
-
Potentially trustworthy URL algo should explicitly treat authenticated schemes as non-opaque w3c/webappsec-secure-contexts#85, by @fred-wang.
-
Data URL iframes are considered secure contexts only if sandboxed w3c/webappsec-secure-contexts#83, by @letitz.
-
Surprising inheritance behavior for opened windows w3c/webappsec-secure-contexts#82, by @letitz.
-
-
7 issues closed.
-
Data URL iframes are considered secure contexts only if sandboxed w3c/webappsec-secure-contexts#83.
-
Surprising inheritance behavior for opened windows w3c/webappsec-secure-contexts#82.
-
secure contexts and Workers created from data URLs w3c/webappsec-secure-contexts#74.
-
Consider "potentially trustworthy" for responses w3c/webappsec-secure-contexts#63.
-
"Is an environment settings object contextually secure?" does not work for worklets w3c/webappsec-secure-contexts#57.
-
"Is an environment settings object contextually secure?" does not deal with nested workers w3c/webappsec-secure-contexts#56.
-
Upstream monkey-patches to HTML and delete in this spec w3c/webappsec-secure-contexts#79.
-
-
10 issues received 25 new comments.
-
Potentially trustworthy URL algo should explicitly treat authenticated schemes as non-opaque w3c/webappsec-secure-contexts#85 (8 comments by @anforowicz, @annevk, @fred-wang)
-
Data URL iframes are considered secure contexts only if sandboxed w3c/webappsec-secure-contexts#83 (5 comments by @annevk, @domenic, @letitz, @sideshowbarker)
-
Surprising inheritance behavior for opened windows w3c/webappsec-secure-contexts#82 (4 comments by @annevk, @letitz)
-
about:blank" or "about:srcdoc" with query string or fragment should be potentially trustworthy w3c/webappsec-secure-contexts#81 (2 comments by @annevk, @fred-wang)
-
secure contexts and Workers created from data URLs w3c/webappsec-secure-contexts#74 (1 comment by @annevk)
-
Consider "potentially trustworthy" for responses w3c/webappsec-secure-contexts#63 (1 comment by @annevk)
-
"Is an environment settings object contextually secure?" does not work for worklets w3c/webappsec-secure-contexts#57 (1 comment by @annevk)
-
"Is an environment settings object contextually secure?" does not deal with nested workers w3c/webappsec-secure-contexts#56 (1 comment by @annevk)
-
Upstream monkey-patches to HTML and delete in this spec w3c/webappsec-secure-contexts#79 (1 comment by @annevk)
-
-
2 pull requests opened.
-
Fix typo and remove duplicate words w3c/webappsec-secure-contexts#86, by @shisama.
-
Update for HTML integration w3c/webappsec-secure-contexts#84, by @domenic.
-
-
4 pull requests merged.
-
Fix typo and remove duplicate words w3c/webappsec-secure-contexts#86.
-
Fix typo in example description w3c/webappsec-secure-contexts#80.
-
Improve origin trustworthiness algorithm w3c/webappsec-secure-contexts#77.
-
Update for HTML integration w3c/webappsec-secure-contexts#84.
-
-
3 pull requests closed.
-
Secure sheets w3c/webappsec-secure-contexts#51.
-
Always use creation URL to determine trustworthiness w3c/webappsec-secure-contexts#75.
-
Meta: no more fork of WHATWG HTML w3c/webappsec-secure-contexts#76.
-
-
5 pull requests received 5 new comments.
-
Always use creation URL to determine trustworthiness w3c/webappsec-secure-contexts#75 (1 comment by @annevk)
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
1 pull request opened.
-
typo: content-encoding w3c/webappsec-subresource-integrity#94, by @ioggstream.
-
-
1 pull request merged.
-
typo: content-encoding w3c/webappsec-subresource-integrity#94.
-
-
1 pull request received 2 new comments.
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue received 5 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (5 comments by @gapple, @ghost, @vphantom)
-