Web Application Security Working Group - Activity in 2023
No matches.
TR publications
-
3 documents published.
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Permissions published as a Working Draft. History of Permissions
-
Participants
-
3 participants joined.
-
David Dworken (Google LLC) joined.
-
Luke Warlow (Igalia) joined.
-
Brian Kardell (Igalia) joined.
-
-
1 participant left.
-
Jack J (Google LLC) left.
-
-
1 organization joined.
-
Igalia joined.
-
GitHub
w3c/permissions
-
1 issue closed.
-
1 issue received 3 new comments.
-
Can 'prompt the user to choose' return deny after some implementation specific timeout? w3c/permissions#430 (3 comments by @marcoscaceres, @miketaylr)
-
-
1 pull request opened.
-
Editorial: add example of prompt timing out w3c/permissions#432, by @marcoscaceres.
-
-
1 pull request merged.
-
Editorial: add example of prompt timing out w3c/permissions#432.
-
-
2 pull requests received 9 new comments.
-
Introduce Browser Permissions for WebDriver BiDi w3c/permissions#431 (6 comments by @marcoscaceres, @miketaylr, @OrKoN)
-
Editorial: add example of prompt timing out w3c/permissions#432 (3 comments by @eladalon1983, @marcoscaceres, @miketaylr)
-
w3c/webappsec-csp
-
5 issues opened.
-
Resource hint blocking / "least restrictive" as specified does nothing? w3c/webappsec-csp#633, by @evilpie.
-
Some way to allow workers other than URL and strict-dynamic w3c/webappsec-csp#632, by @bakkot.
-
Problem with SecurityPolicyViolationEvent constructor and optional init dict w3c/webappsec-csp#631, by @evilpie.
-
Normative references to discontinued specs in Content Security Policy Level 3 w3c/webappsec-csp#629, by @dontcallmedom-bot.
-
CSP:EE does not support Trusted Types CSP directives w3c/webappsec-csp#628, by @tosmolka.
-
-
1 issue closed.
-
Normative references to discontinued specs in Content Security Policy Level 3 w3c/webappsec-csp#629.
-
-
6 issues received 25 new comments.
-
CSP not working for certain hostnames w3c/webappsec-csp#620 (8 comments by @annevk, @antosart, @enexusde, @mikewest, @mozfreddyb, @SaeidEid)
-
Behavior of `worker-src 'strict-dynamic'` w3c/webappsec-csp#609 (7 comments by @antosart, @bakkot, @evilpie)
-
Problem with SecurityPolicyViolationEvent constructor and optional init dict w3c/webappsec-csp#631 (7 comments by @annevk, @evilpie, @mikewest)
-
Resource hint blocking / "least restrictive" as specified does nothing? w3c/webappsec-csp#633 (1 comment by @noamr)
-
-
1 pull request opened.
-
Replace RFC7231 with RFC9110 w3c/webappsec-csp#630, by @antosart.
-
-
1 pull request merged.
-
Replace RFC7231 with RFC9110 w3c/webappsec-csp#630.
-
w3c/webappsec-dbsc
-
3 issues opened.
-
Support of different types of tokens is not clear w3c/webappsec-dbsc#11, by @alextok.
-
Start session can result in security bugs during implementation. w3c/webappsec-dbsc#7, by @alextok.
-
Can we clarify, if the challenges can be returned from negative responses as well. w3c/webappsec-dbsc#6, by @alextok.
-
-
1 issue closed.
-
Can we clarify, if the challenges can be returned from negative responses as well. w3c/webappsec-dbsc#6.
-
-
3 issues received 21 new comments.
-
Start session can result in security bugs during implementation. w3c/webappsec-dbsc#7 (16 comments by @alextok, @kmonsen)
-
Can we clarify, if the challenges can be returned from negative responses as well. w3c/webappsec-dbsc#6 (3 comments by @alextok, @arnar, @kmonsen)
-
Support of different types of tokens is not clear w3c/webappsec-dbsc#11 (2 comments by @arnar, @kmonsen)
-
-
3 pull requests opened.
-
move sequence diagram code into link in main doc for better discovera… w3c/webappsec-dbsc#10, by @mattjm.
-
remove reference to promise.resolve w3c/webappsec-dbsc#9, by @mattjm.
-
update sequence diagram with challenge per issue #7 w3c/webappsec-dbsc#8, by @mattjm.
-
-
3 pull requests merged.
-
move sequence diagram code into link in main doc for better discovera… w3c/webappsec-dbsc#10.
-
remove reference to promise.resolve w3c/webappsec-dbsc#9.
-
update sequence diagram with challenge per issue #7 w3c/webappsec-dbsc#8.
-
-
1 pull request received 1 new comment.
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (1 comment by @jayaddison)
-
w3c/webappsec-permissions-policy
-
1 issue received 1 new comment.
-
1 pull request merged.
-
Update features.md for `window-management` nee `window-placement` w3c/webappsec-permissions-policy#534.
-
-
1 pull request received 2 new comments.
-
Update features.md for `window-management` nee `window-placement` w3c/webappsec-permissions-policy#534 (2 comments by @clelland, @michaelwasserman)
-
w3c/webappsec-credential-management
-
1 pull request opened.
-
Add mediation to credential creation options w3c/webappsec-credential-management#224, by @pascoej.
-
w3c/webappsec
-
1 issue opened.
-
Planning 2024-01-17. w3c/webappsec#638, by @mikewest.
-
-
1 issue closed.
-
Planning 2023-11-15. w3c/webappsec#636.
-
-
1 issue received 1 new comment.
w3c/trusted-types
-
2 issues opened.
-
'Create a Trusted Type' algorithm returns error value in step 6 w3c/trusted-types#382, by @smaug----.
-
getAttributeType and getPropertyType should default to HTML namespace, not "" w3c/trusted-types#381, by @smaug----.
-
-
1 issue received 7 new comments.
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207 (7 comments by @caridy, @koto, @nicolo-ribaudo)
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Fix build w3c/webappsec-referrer-policy#170, by @domfarolino.
-
-
2 pull requests merged.
-
Use cross-spec section autolinks instead of absolute URLs w3c/webappsec-referrer-policy#169.
-
Fix build w3c/webappsec-referrer-policy#170.
-
-
1 pull request received 2 new comments.
-
Use cross-spec section autolinks instead of absolute URLs w3c/webappsec-referrer-policy#169 (2 comments by @domfarolino, @tidoust)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Normative references to discontinued specs in Clear Site Data w3c/webappsec-clear-site-data#79, by @dontcallmedom-bot.
-
w3c/webappsec-change-password-url
-
1 issue opened.
-
Normative references to discontinued specs in A Well-Known URL for Changing Passwords w3c/webappsec-change-password-url#42, by @dontcallmedom-bot.
-
TR publications
-
3 documents published.
-
Secure Contexts published as a Candidate Recommendation Draft. History of Secure Contexts
-
Permissions published twice as a Working Draft. History of Permissions
-
Participants
-
4 participants joined.
-
Kai Yuan Thng (Meta) joined.
-
Uday Bhaskar Seelamantula (Autodesk) joined.
-
Simon Friedberger (Mozilla Foundation) joined.
-
ㅤ Pascoe (Apple Inc.) joined.
-
-
1 organization joined.
-
Autodesk joined.
-
GitHub
w3c/webappsec
-
1 issue received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Update features.md for `window-management` nee `window-placement` w3c/webappsec-permissions-policy#534, by @michaelwasserman.
-
-
1 pull request received 3 new comments.
-
Update features.md for `window-management` nee `window-placement` w3c/webappsec-permissions-policy#534 (3 comments by @michaelwasserman)
-
w3c/permissions
-
2 issues opened.
-
Can 'prompt the user to choose' return deny after some implementation specific timeout? w3c/permissions#430, by @youennf.
-
Umbrella / Meta: Browser Permissions for WebDriver BiDi as an extension module w3c/permissions#424, by @thiagowfx.
-
-
1 issue received 1 new comment.
-
Umbrella / Meta: Browser Permissions for WebDriver BiDi as an extension module w3c/permissions#424 (1 comment by @thiagowfx)
-
-
6 pull requests opened.
-
Introduce Browser Permissions for WebDriver BiDi w3c/permissions#431, by @OrKoN.
-
Editorial: Replace all <a>foo</a> with [=foo=] w3c/permissions#428, by @thiagowfx.
-
Editorial: add <div class="algorithm"> in missing places w3c/permissions#427, by @thiagowfx.
-
Add Permissions Registry back to main document w3c/permissions#426, by @miketaylr.
-
Introduce Browser Permissions for WebDriver BiDi w3c/permissions#425, by @thiagowfx.
-
Create SECURITY.md w3c/permissions#423, by @Clemens-git76.
-
-
3 pull requests merged.
-
Editorial: add <div class="algorithm"> in missing places w3c/permissions#427.
-
Editorial: Replace all <a>foo</a> with [=foo=] w3c/permissions#428.
-
Add Permissions Registry back to main document w3c/permissions#426.
-
-
2 pull requests closed.
-
Introduce Browser Permissions for WebDriver BiDi w3c/permissions#425.
-
Create SECURITY.md w3c/permissions#423.
-
-
6 pull requests received 98 new comments.
-
Introduce Browser Permissions for WebDriver BiDi w3c/permissions#425 (88 comments by @jgraham, @marcoscaceres, @miketaylr, @OrKoN, @thiagowfx)
-
Add Permissions Registry back to main document w3c/permissions#426 (4 comments by @marcoscaceres, @miketaylr)
-
Introduce Browser Permissions for WebDriver BiDi w3c/permissions#431 (2 comments by @miketaylr, @OrKoN)
-
Editorial: add <div class="algorithm"> in missing places w3c/permissions#427 (2 comments by @miketaylr, @thiagowfx)
-
w3c/permissions#429 (1 comment by @w3cbot)
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Use cross-spec section autolinks instead of absolute URLs w3c/webappsec-referrer-policy#169, by @tidoust.
-
-
1 pull request received 4 new comments.
-
Use cross-spec section autolinks instead of absolute URLs w3c/webappsec-referrer-policy#169 (4 comments by @domfarolino, @tidoust)
-
w3c/webappsec-csp
-
3 issues opened.
-
Allow 'strict-dynamic' scripts to inject styles w3c/webappsec-csp#625, by @vejja.
-
frame-src using the fetch instead of the navigational check - can end up checking the wrong policies w3c/webappsec-csp#624, by @antosart.
-
Allow `script-src 'unsafe-hashes'` for `eval()` and `new Function` w3c/webappsec-csp#623, by @nicolo-ribaudo.
-
-
3 issues received 12 new comments.
-
Allow `script-src 'unsafe-hashes'` for `eval()` and `new Function` w3c/webappsec-csp#623 (8 comments by @arturjanc, @bakkot, @mikewest, @nicolo-ribaudo, @ptomato)
-
w3c/webappsec-passkey-endpoints
-
2 issues opened.
-
Should query params and fragments be allowed in entries? w3c/webappsec-passkey-endpoints#3, by @timcappalli.
-
Should redirects be allowed? w3c/webappsec-passkey-endpoints#2, by @timcappalli.
-
-
2 issues received 8 new comments.
-
Should redirects be allowed? w3c/webappsec-passkey-endpoints#2 (6 comments by @agl, @irew, @Progdrasil)
-
Should query params and fragments be allowed in entries? w3c/webappsec-passkey-endpoints#3 (2 comments by @irew, @Progdrasil)
-
-
1 pull request opened.
-
Suggestion: update change password references with passkey endpoints w3c/webappsec-passkey-endpoints#1, by @irew.
-
-
1 pull request closed.
-
Suggestion: update change password references with passkey endpoints w3c/webappsec-passkey-endpoints#1.
-
-
1 pull request received 1 new comment.
-
Suggestion: update change password references with passkey endpoints w3c/webappsec-passkey-endpoints#1 (1 comment by @timcappalli)
-
w3c/webcrypto
-
1 issue received 2 new comments.
w3c/webappsec-dbsc
-
2 issues closed.
-
Maintaining a session: essential optimization can be achieved w3c/webappsec-dbsc#3.
-
Adjust explainer for web platform naming convention w3c/webappsec-dbsc#4.
-
-
2 issues received 2 new comments.
-
Maintaining a session: essential optimization can be achieved w3c/webappsec-dbsc#3 (1 comment by @kmonsen)
-
-
1 pull request merged.
-
sequence diagram and cookie clarification w3c/webappsec-dbsc#5.
-
-
1 pull request received 1 new comment.
w3c/permissions-registry
-
1 pull request opened.
-
Update index.html window-placement to window-management w3c/permissions-registry#24, by @michaelwasserman.
-
-
1 pull request merged.
-
Update index.html window-placement to window-management w3c/permissions-registry#24.
-
-
1 pull request received 4 new comments.
-
Update index.html window-placement to window-management w3c/permissions-registry#24 (4 comments by @inexorabletash, @michaelwasserman)
-
w3c/webappsec-secure-contexts
-
2 pull requests opened.
-
Mark 'is origin trustworth' as exported definition of an algorithm w3c/webappsec-secure-contexts#102, by @dontcallmedom.
-
Update a few references and simplify some bikeshed-isms w3c/webappsec-secure-contexts#101, by @dontcallmedom.
-
-
2 pull requests merged.
-
Mark 'is origin trustworth' as exported definition of an algorithm w3c/webappsec-secure-contexts#102.
-
Update a few references and simplify some bikeshed-isms w3c/webappsec-secure-contexts#101.
-
-
1 pull request received 3 new comments.
-
Mark 'is origin trustworth' as exported definition of an algorithm w3c/webappsec-secure-contexts#102 (3 comments by @dontcallmedom, @mikewest)
-
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
-
Clear-site-data: cookies facilitates malicious cookie flushing by sibling domains w3c/webappsec-clear-site-data#55 (1 comment by @JannisBush)
-
-
1 pull request opened.
-
Fix Version History Link w3c/webappsec-clear-site-data#78, by @JannisBush.
-
-
1 pull request merged.
-
Fix Version History Link w3c/webappsec-clear-site-data#78.
-
-
2 pull requests received 9 new comments.
-
Add section for BFCache eviction in cache clearing w3c/webappsec-clear-site-data#77 (6 comments by @annevk, @fergald, @smaug----)
-
TR publications
-
5 documents published.
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Permissions Policy published 3 times as a Working Draft. History of Permissions Policy
-
Past meetings
-
1 meeting.
Participants
-
3 participants joined.
-
Ravinder Singh (HM Government) joined.
-
Arnar Birgisson (Google LLC) joined.
-
Samuel Weiler (W3C) joined.
-
-
1 participant left.
-
Max Froumentin (HM Government) left.
-
GitHub
w3c/webappsec-dbsc
-
1 issue opened.
-
Adjust explainer for web platform naming convention w3c/webappsec-dbsc#4, by @jeremyroman.
-
-
1 pull request opened.
-
sequence diagram and cookie clarification w3c/webappsec-dbsc#5, by @mattjm.
-
-
1 pull request received 1 new comment.
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Add `Sec-Fetch-Dest: json` for JSON Modules w3c/webappsec-fetch-metadata#87, by @petamoriken.
-
-
1 issue closed.
-
Add `Sec-Fetch-Dest: json` for JSON Modules w3c/webappsec-fetch-metadata#87.
-
-
1 issue received 4 new comments.
-
Add `Sec-Fetch-Dest: json` for JSON Modules w3c/webappsec-fetch-metadata#87 (4 comments by @annevk, @miketaylr, @mikewest)
-
-
1 pull request opened.
-
Editorial: link to Fetch's destinations for Sec-Fetch-Dest w3c/webappsec-fetch-metadata#88, by @miketaylr.
-
-
1 pull request merged.
-
Editorial: link to Fetch's destinations for Sec-Fetch-Dest w3c/webappsec-fetch-metadata#88.
-
-
1 pull request received 2 new comments.
-
Editorial: link to Fetch's destinations for Sec-Fetch-Dest w3c/webappsec-fetch-metadata#88 (2 comments by @miketaylr, @mikewest)
-
w3c/webappsec-permissions-policy
-
2 issues closed.
-
Reporting w3c/webappsec-permissions-policy#142.
-
Usefulness of reporting in Permissions Policy w3c/webappsec-permissions-policy#386.
-
-
3 issues received 5 new comments.
-
Usefulness of reporting in Permissions Policy w3c/webappsec-permissions-policy#386 (3 comments by @annevk, @clelland)
-
Set declared policy for powerful features to self by default w3c/webappsec-permissions-policy#532 (1 comment by @reillyeon)
-
-
1 pull request merged.
-
Add reporting and report-only mode. w3c/webappsec-permissions-policy#529.
-
-
1 pull request received 25 new comments.
-
Add reporting and report-only mode. w3c/webappsec-permissions-policy#529 (25 comments by @clelland, @domfarolino)
-
w3c/webappsec-csp
-
1 issue closed.
-
CSS and JSON module scripts w3c/webappsec-csp#573.
-
-
4 issues received 4 new comments.
-
1 pull request merged.
-
Add `"json"` destination for `"connect-src"` w3c/webappsec-csp#611.
-
-
2 pull requests received 3 new comments.
-
Add `"json"` destination for `"connect-src"` w3c/webappsec-csp#611 (2 comments by @annevk, @antosart)
-
w3c/permissions
-
1 issue opened.
-
1 issue received 3 new comments.
-
1 pull request received 3 new comments.
-
Inform users when a UA administrator overrides their permission choices. w3c/permissions#420 (3 comments by @jyasskin, @marcoscaceres)
-
w3c/webappsec
-
1 issue opened.
-
Planning 2023-11-15. w3c/webappsec#636, by @mikewest.
-
-
1 issue closed.
-
Planning 2023-10-18. w3c/webappsec#634.
-
-
2 issues received 2 new comments.
-
1 pull request opened.
-
Add small announcement for Source Code Transparency explainer and proposal w3c/webappsec#637, by @twiss.
-
-
2 pull requests merged.
-
Tpac2023 charter comments w3c/webappsec#635.
-
Add small announcement for Source Code Transparency explainer and proposal w3c/webappsec#637.
-
-
1 pull request received 4 new comments.
w3c/webcrypto
-
1 issue opened.
-
Unspecified `importKey` behavior for PKCS8-encoded raw private keys w3c/webcrypto#356, by @ArnaudBrousseau.
-
-
2 issues received 7 new comments.
-
Unspecified `importKey` behavior for PKCS8-encoded raw private keys w3c/webcrypto#356 (6 comments by @ArnaudBrousseau, @panva, @twiss)
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (1 comment by @RByers)
-
-
1 pull request received 2 new comments.
-
Make deriveBits length parameter optional and nullable w3c/webcrypto#345 (2 comments by @annevk, @javifernandez)
-
TR publications
-
4 documents published.
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Permissions Policy published twice as a Working Draft. History of Permissions Policy
-
Past meetings
Participants
-
3 participants joined.
-
Aaron Selya (Google LLC) joined.
-
Duy-Tung LUU (CANTON CONSULTING) joined.
-
Julien Rossi (CANTON CONSULTING) joined.
-
-
1 organization joined.
-
CANTON CONSULTING joined.
-
GitHub
w3c/webappsec-csp
-
1 issue opened.
-
CSP not working for certain hostnames w3c/webappsec-csp#620, by @enexusde.
-
-
3 issues closed.
-
CSP 3 draft does not conform to the HTTP/1.1 standard for headers w3c/webappsec-csp#361.
-
Integration with document.open() w3c/webappsec-csp#402.
-
Example 26 syntax error - missing 2 semicolons w3c/webappsec-csp#617.
-
-
1 issue reopened.
-
CSP not working for certain hostnames w3c/webappsec-csp#620, by @enexusde.
-
-
5 issues received 24 new comments.
-
CSP not working for certain hostnames w3c/webappsec-csp#620 (9 comments by @annevk, @bathos, @enexusde, @mikewest)
-
CSP 3 draft does not conform to the HTTP/1.1 standard for headers w3c/webappsec-csp#361 (6 comments by @annevk, @JannisBush, @mikewest)
-
Algorithms should be <dfn> in prose instead of linked to headers w3c/webappsec-csp#618 (6 comments by @annevk, @antosart, @johnathan79717, @mikewest)
-
-
3 pull requests opened.
-
Remove RECOMMENDATION to not send multiple CSP headers w3c/webappsec-csp#622, by @JannisBush.
-
[editorial] Make algorithm headers clickable w3c/webappsec-csp#621, by @antosart.
-
[editorial] Add missing semicolons in example CSP w3c/webappsec-csp#619, by @antosart.
-
-
2 pull requests merged.
-
Remove RECOMMENDATION to not send multiple CSP headers w3c/webappsec-csp#622.
-
[editorial] Add missing semicolons in example CSP w3c/webappsec-csp#619.
-
-
2 pull requests received 7 new comments.
-
[editorial] Make algorithm headers clickable w3c/webappsec-csp#621 (5 comments by @antosart, @mikewest)
-
Remove RECOMMENDATION to not send multiple CSP headers w3c/webappsec-csp#622 (2 comments by @annevk, @mikewest)
-
w3c/webappsec-permissions-policy
-
3 issues opened.
-
A request's "window" is never a Window w3c/webappsec-permissions-policy#533, by @jyasskin.
-
Set declared policy for powerful features to self by default w3c/webappsec-permissions-policy#532, by @shhnjk.
-
Add "mediasession" to the list of permission policies w3c/webappsec-permissions-policy#531, by @youennf.
-
-
3 issues received 10 new comments.
-
Set declared policy for powerful features to self by default w3c/webappsec-permissions-policy#532 (8 comments by @annevk, @clelland, @mikewest, @shhnjk)
-
Add "mediasession" to the list of permission policies w3c/webappsec-permissions-policy#531 (1 comment by @clelland)
-
-
2 pull requests opened.
-
Update self-link in IANA considerations w3c/webappsec-permissions-policy#530, by @clelland.
-
Add reporting and report-only mode. w3c/webappsec-permissions-policy#529, by @clelland.
-
-
1 pull request merged.
-
Update self-link in IANA considerations w3c/webappsec-permissions-policy#530.
-
-
1 pull request received 19 new comments.
-
Add reporting and report-only mode. w3c/webappsec-permissions-policy#529 (19 comments by @clelland, @domfarolino)
-
w3c/webappsec-dbsc
-
2 issues opened.
-
Maintaining a session: essential optimization can be achieved w3c/webappsec-dbsc#3, by @alextok.
-
Goal/Non-Goal definition has multiple interpretations. w3c/webappsec-dbsc#2, by @alextok.
-
-
2 issues received 6 new comments.
-
Maintaining a session: essential optimization can be achieved w3c/webappsec-dbsc#3 (3 comments by @alextok, @kmonsen)
-
Goal/Non-Goal definition has multiple interpretations. w3c/webappsec-dbsc#2 (3 comments by @alextok, @arnar, @kmonsen)
-
w3c/webappsec
-
1 issue opened.
-
Planning 2023-10-18. w3c/webappsec#634, by @mikewest.
-
-
1 issue closed.
-
Planning TPAC 2023. w3c/webappsec#627.
-
-
2 issues received 11 new comments.
-
5 pull requests opened.
-
Tpac2023 charter comments w3c/webappsec#635, by @plehegar.
-
Update 2023-09-14-TPAC-minutes.md w3c/webappsec#633, by @johnathan79717.
-
Correct typo in 2023-09-TPAC-agenda.md w3c/webappsec#632, by @johnathan79717.
-
TPAC 2023 agenda w3c/webappsec#631, by @mikewest.
-
Update Navigation Bar Styling and Adding Paragraph Break w3c/webappsec#630, by @Adrija-G.
-
-
3 pull requests merged.
-
Update 2023-09-14-TPAC-minutes.md w3c/webappsec#633.
-
Correct typo in 2023-09-TPAC-agenda.md w3c/webappsec#632.
-
TPAC 2023 agenda w3c/webappsec#631.
-
-
2 pull requests received 12 new comments.
-
Tpac2023 charter comments w3c/webappsec#635 (10 comments by @johannhof, @mikewest, @mnot, @plehegar)
-
w3c/permissions
-
2 issues opened.
-
PermissionStatus update steps touch DOM objects in parallel w3c/permissions#421, by @jan-ivar.
-
WebDriver: Make it possible to pass a different origin to "Set Permission" w3c/permissions#419, by @rakuco.
-
-
5 issues received 13 new comments.
-
Add another permission state "always-ask" (from one-time grants)? w3c/permissions#414 (5 comments by @jan-ivar, @miketaylr, @npdoty)
-
WebDriver: Make it possible to pass a different origin to "Set Permission" w3c/permissions#419 (4 comments by @miketaylr, @rakuco)
-
PermissionStatus update steps touch DOM objects in parallel w3c/permissions#421 (2 comments by @annevk, @jan-ivar)
-
One time permissions: exposing and specifying grant type w3c/permissions#418 (1 comment by @miketaylr)
-
-
1 pull request opened.
-
Inform users when a UA administrator overrides their permission choices. w3c/permissions#420, by @jyasskin.
-
-
1 pull request received 7 new comments.
-
Inform users when a UA administrator overrides their permission choices. w3c/permissions#420 (7 comments by @jyasskin, @miketaylr, @reillyeon)
-
w3c/webappsec-referrer-policy
-
1 issue received 2 new comments.
-
Add Referrer-Policy no-referrer-when-cross-origin w3c/webappsec-referrer-policy#167 (2 comments by @Amir-Herzberg, @domfarolino)
-
w3c/webcrypto
-
1 issue opened.
-
Null check operator used on a null value w3c/webcrypto#355, by @masadi.
-
-
3 issues received 4 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @devgs, @leoselig)
-
Allow `derivedKeyAlgorithm == 'HKDF'` for `deriveKey()` w3c/webcrypto#314 (1 comment by @Juraj-Masiar)
-
w3c/permissions-registry
-
1 issue opened.
-
Update doc so folks know we're going to move stuff back to Permissions w3c/permissions-registry#22, by @miketaylr.
-
-
1 pull request opened.
-
Typo fix (sorry, this is trivial) w3c/permissions-registry#23, by @tomayac.
-
w3c/webappsec-cspee
-
1 issue closed.
-
Buggy behavior with multiple nested frames w3c/webappsec-cspee#26.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Remove same-origin blanket enforcement w3c/webappsec-cspee#28, by @shhnjk.
-
-
1 pull request merged.
-
Remove same-origin blanket enforcement w3c/webappsec-cspee#28.
-
-
1 pull request received 2 new comments.
w3c/webappsec-clear-site-data
-
1 pull request received 1 new comment.
-
Add section for BFCache eviction in cache clearing w3c/webappsec-clear-site-data#77 (1 comment by @fergald)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 31 January 2024.
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Erez Kalman (Akamai Technologies) joined.
-
GitHub
w3c/webcrypto
-
2 issues opened.
-
enable device biometrics / PIN check to support web crypto operations w3c/webcrypto#352, by @prime2358.
-
2 issues closed.
-
enable device biometrics / PIN check to support web crypto operations w3c/webcrypto#352.
-
Out-of-date(?) ArrayBuffer usage in algorithmic text w3c/webcrypto#346.
-
-
7 issues received 33 new comments.
-
enable device biometrics / PIN check to support web crypto operations w3c/webcrypto#352 (8 comments by @prime2358, @r-jo, @twiss)
-
deriveBits length idl does not allow null w3c/webcrypto#322 (6 comments by @annevk, @davidben, @panva, @twiss)
-
Require deterministic ECDSA rather than random ECDSA w3c/webcrypto#163 (4 comments by @LeviSchuck, @twiss)
-
standardize device biometrics / PIN check as a 2nd factor to support web crypto operations w3c/webcrypto#354 (1 comment by @prime2358)
-
2 pull requests opened.
-
Reference UTF-8 encoding algorithm w3c/webcrypto#353, by @twiss.
-
Throw on truncation in the ECDH derive bits operation w3c/webcrypto#351, by @twiss.
-
-
2 pull requests merged.
-
Reference UTF-8 encoding algorithm w3c/webcrypto#353.
-
Refer to relevant realm instead of relevant global object w3c/webcrypto#347.
-
-
1 pull request received 20 new comments.
-
Make deriveBits length parameter optional and nullable w3c/webcrypto#345 (20 comments by @annevk, @davidben, @martinthomson, @saschanaz, @twiss)
-
w3c/webappsec
-
1 issue received 8 new comments.
-
Planning TPAC 2023. w3c/webappsec#627 (8 comments by @marcoscaceres, @mikewest, @shhnjk, @ShivanKaul, @twiss)
-
-
1 pull request opened.
-
Initial WG charter 2023 w3c/webappsec#629, by @plehegar.
-
-
1 pull request merged.
-
Initial WG charter 2023 w3c/webappsec#629.
-
w3c/webappsec-csp
-
3 issues opened.
-
Algorithms should be <dfn> in prose instead of linked to headers w3c/webappsec-csp#618, by @johnathan79717.
-
Example 26 syntax error - missing 2 semicolons w3c/webappsec-csp#617, by @AlbertWiersch.
-
Typo in 8.4 Allowing external JavaScript via hashes w3c/webappsec-csp#615, by @mauke.
-
-
1 issue closed.
-
Typo in 8.4 Allowing external JavaScript via hashes w3c/webappsec-csp#615.
-
-
4 issues received 4 new comments.
-
1 pull request opened.
-
[editorial] Fix typo w3c/webappsec-csp#616, by @antosart.
-
-
1 pull request merged.
-
[editorial] Fix typo w3c/webappsec-csp#616.
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Add `webAuthn` and/or `credentials` type w3c/webappsec-clear-site-data#76, by @Manouchehri.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Add section for BFCache eviction in cache clearing w3c/webappsec-clear-site-data#77, by @lozy219.
-
-
1 pull request received 17 new comments.
-
Add section for BFCache eviction in cache clearing w3c/webappsec-clear-site-data#77 (17 comments by @annevk, @domenic, @fergald, @lozy219)
-
w3c/webappsec-permissions-policy
-
2 issues closed.
-
Make GitHub the preferred way to give feedback w3c/webappsec-permissions-policy#427.
-
sh-dictionary link 404s w3c/webappsec-permissions-policy#433.
-
-
2 issues received 2 new comments.
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273 (1 comment by @josephrocca)
-
Proposal: allow grouping permissions by year w3c/webappsec-permissions-policy#481 (1 comment by @Seirdy)
-
-
2 pull requests merged.
-
Remove mailing list from header w3c/webappsec-permissions-policy#492.
-
Structured Field Values for HTTP are now RFC8941 w3c/webappsec-permissions-policy#526.
-
-
1 pull request received 1 new comment.
-
Structured Field Values for HTTP are now RFC8941 w3c/webappsec-permissions-policy#526 (1 comment by @clelland)
-
w3c/permissions
-
1 issue opened.
-
One time permissions: exposing and specifying grant type w3c/permissions#418, by @fjacky.
-
-
1 issue received 6 new comments.
-
Add another permission state "always-ask" (from one-time grants)? w3c/permissions#414 (6 comments by @fjacky, @jan-ivar, @mikewest)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Metadata to indicate if fetch was instigated as a result of 103 early hints w3c/webappsec-fetch-metadata#86, by @LPardue.
-
-
1 issue received 9 new comments.
-
Metadata to indicate if fetch was instigated as a result of 103 early hints w3c/webappsec-fetch-metadata#86 (9 comments by @arturjanc, @bashi, @LPardue, @tunetheweb)
-
TR publications
-
5 documents published.
-
Content Security Policy Level 3 published 3 times as a Working Draft. History of Content Security Policy Level 3
-
Permissions Policy published twice as a Working Draft. History of Permissions Policy
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Tim Cappalli (Okta) joined.
-
-
1 participant left.
-
Erhard Brand (Entersekt) left.
-
GitHub
w3c/webappsec-csp
-
2 issues opened.
-
CSP: Embedded Enforcement Links for issue 16 and 17 are dead w3c/webappsec-csp#610, by @JannisBush.
-
Behavior of `worker-src 'strict-dynamic'` w3c/webappsec-csp#609, by @evilpie.
-
-
4 issues received 12 new comments.
-
CSP: form-action and redirects w3c/webappsec-csp#8 (8 comments by @marek22k, @roberto-cisternino, @Sora2455)
-
-
4 pull requests opened.
-
[editorial] Change fallback effective directive to connect-src w3c/webappsec-csp#614, by @antosart.
-
[editorial] Fix reference to url w3c/webappsec-csp#613, by @antosart.
-
Reference the strict-dynamic issue for inline scripts w3c/webappsec-csp#612, by @evilpie.
-
Add `"json"` destination for `"connect-src"` w3c/webappsec-csp#611, by @nicolo-ribaudo.
-
-
3 pull requests merged.
-
Reference the strict-dynamic issue for inline scripts w3c/webappsec-csp#612.
-
[editorial] Change fallback effective directive to connect-src w3c/webappsec-csp#614.
-
[editorial] Fix reference to url w3c/webappsec-csp#613.
-
-
3 pull requests received 10 new comments.
-
Add `"json"` destination for `"connect-src"` w3c/webappsec-csp#611 (6 comments by @annevk, @antosart, @nicolo-ribaudo)
-
[editorial] Change fallback effective directive to connect-src w3c/webappsec-csp#614 (3 comments by @antosart, @mikewest)
-
Reference the strict-dynamic issue for inline scripts w3c/webappsec-csp#612 (1 comment by @mikewest)
-
w3c/permissions
-
1 issue received 5 new comments.
-
Add another permission state "always-ask" (from one-time grants)? w3c/permissions#414 (5 comments by @jan-ivar, @marcoscaceres, @tomayac)
-
w3c/webappsec
-
1 issue opened.
-
Support for clearing Client Hints in Clear-Site-Data header w3c/webappsec#628, by @arichiv.
-
-
1 issue closed.
-
Planning 2023-07-19. w3c/webappsec#626.
-
-
2 issues received 6 new comments.
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Inconsistency in text and parsing algorithm (invalid member value) w3c/webappsec-permissions-policy#527, by @JannisBush.
-
-
2 issues closed.
-
Does url match expression in origin with redirect count? takes a URL, not an origin w3c/webappsec-permissions-policy#519.
-
"If the allowlist contains an origin representing self" is unclear w3c/webappsec-permissions-policy#520.
-
-
1 issue received 1 new comment.
-
Does url match expression in origin with redirect count? takes a URL, not an origin w3c/webappsec-permissions-policy#519 (1 comment by @clelland)
-
-
2 pull requests opened.
-
In features.md: Rename FLEDGE to Protected Audience w3c/webappsec-permissions-policy#528, by @qingxinwu.
-
Structured Field Values for HTTP are now RFC8941 w3c/webappsec-permissions-policy#526, by @JannisBush.
-
-
3 pull requests merged.
-
In features.md: Rename FLEDGE to Protected Audience w3c/webappsec-permissions-policy#528.
-
Use exported DFNs from CSP w3c/webappsec-permissions-policy#523.
-
Clarify self and src origin naming w3c/webappsec-permissions-policy#522.
-
-
2 pull requests received 3 new comments.
-
Structured Field Values for HTTP are now RFC8941 w3c/webappsec-permissions-policy#526 (1 comment by @w3cbot)
w3c/webappsec-fetch-metadata
-
2 issues received 2 new comments.
-
Sec-Fetch-Site for navigations from outside the browser w3c/webappsec-fetch-metadata#77 (1 comment by @dav-oss)
-
w3c/webappsec-clear-site-data
-
1 pull request opened.
-
Fix Accept-CH Race Condition w3c/webappsec-clear-site-data#75, by @arichiv.
-
-
2 pull requests merged.
-
Fix Accept-CH Race Condition w3c/webappsec-clear-site-data#75.
-
Add client-hints clearing support w3c/webappsec-clear-site-data#74.
-
-
2 pull requests received 5 new comments.
-
Add client-hints clearing support w3c/webappsec-clear-site-data#74 (3 comments by @arichiv, @mikewest)
-
w3c/webappsec-credential-management
-
4 issues opened.
-
Replace iff w3c/webappsec-credential-management#222, by @lukewarlow.
-
Consider removal of FederatedCredential w3c/webappsec-credential-management#221, by @lukewarlow.
-
Consider web extension API w3c/webappsec-credential-management#220, by @lukewarlow.
-
[[store]] default implementation returns undefined, but maybe it should throw w3c/webappsec-credential-management#218, by @nsatragno.
-
-
5 issues closed.
-
Fix build w3c/webappsec-credential-management#213.
-
[[store]] default implementation returns undefined, but maybe it should throw w3c/webappsec-credential-management#218.
-
Consider removal of FederatedCredential w3c/webappsec-credential-management#221.
-
Spec is unclear on what the promise returned by store() is resolved with (Credential/undefined) w3c/webappsec-credential-management#98.
-
Return type of CredentialsContainer.store is wrong w3c/webappsec-credential-management#214.
-
-
2 issues received 6 new comments.
-
Consider removal of FederatedCredential w3c/webappsec-credential-management#221 (3 comments by @lukewarlow, @nsatragno)
-
Fix build w3c/webappsec-credential-management#213 (3 comments by @lukewarlow, @nsatragno, @sideshowbarker)
-
-
2 pull requests opened.
-
Use “navigable”+“parent”, not “parent browsing context”; fix fetch() refs w3c/webappsec-credential-management#223, by @sideshowbarker.
-
Change default store algorithm to throw (#218) w3c/webappsec-credential-management#219, by @lukewarlow.
-
-
4 pull requests merged.
-
Use “navigable”+“parent”, not “parent browsing context”; fix fetch() refs w3c/webappsec-credential-management#223.
-
Change default store algorithm to throw (#218) w3c/webappsec-credential-management#219.
-
Fix return type of CredentialsContainer.store w3c/webappsec-credential-management#215.
-
Fix typo w3c/webappsec-credential-management#212.
-
-
4 pull requests received 20 new comments.
-
Fix return type of CredentialsContainer.store w3c/webappsec-credential-management#215 (8 comments by @johannhof, @lukewarlow, @npm1, @nsatragno, @w3cbot)
-
Use “navigable”+“parent”, not “parent browsing context”; fix fetch() refs w3c/webappsec-credential-management#223 (6 comments by @domenic, @sideshowbarker, @w3cbot)
-
Change default store algorithm to throw (#218) w3c/webappsec-credential-management#219 (5 comments by @kalvdans, @lukewarlow)
-
w3c/webappsec-referrer-policy
-
1 issue closed.
-
Should JavaScript module imports respect referrer policy, and if so, how? w3c/webappsec-referrer-policy#111.
-
w3c/webcrypto
-
1 issue opened.
-
1 issue received 1 new comment.
w3c/webappsec-dbsc
-
1 pull request opened.
-
Replace "Device Bound Secure Credentials" with "Device Bound Session … w3c/webappsec-dbsc#1, by @danmarg.
-
-
1 pull request merged.
-
Replace "Device Bound Secure Credentials" with "Device Bound Session … w3c/webappsec-dbsc#1.
-
TR publications
-
5 documents published.
-
Permissions Policy published twice as a Working Draft. History of Permissions Policy
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Permissions published as a Working Draft. History of Permissions
-
Past meetings
-
1 meeting.
Participants
-
7 participants joined.
-
Michael Prorock (Tradeverifyd) joined.
-
nics moda (Ministry of Digital Affairs, Taiwan) joined.
-
nics moda (Ministry of Digital Affairs, Taiwan) joined.
-
zhilei zhang (360) joined.
-
Kyra Seevers (Google LLC) joined.
-
Margery Clacy (Centre for Inclusive Design) joined.
-
Shivan Kaul Sahib (Brave Software Inc.) joined.
-
-
2 participants left.
-
nics moda (Ministry of Digital Affairs, Taiwan) left.
-
Eric Rescorla (Mozilla Foundation) left.
-
-
4 organizations joined.
-
Tradeverifyd joined.
-
Ministry of Digital Affairs, Taiwan joined.
-
360 joined.
-
Centre for Inclusive Design joined.
-
-
1 organization left.
-
Ministry of Digital Affairs, Taiwan left.
-
GitHub
w3c/webappsec-permissions-policy
-
3 issues opened.
-
Editorial: "If origin is opaque" needs to use a cross reference w3c/webappsec-permissions-policy#521, by @annevk.
-
"If the allowlist contains an origin representing self" is unclear w3c/webappsec-permissions-policy#520, by @annevk.
-
Does url match expression in origin with redirect count? takes a URL, not an origin w3c/webappsec-permissions-policy#519, by @annevk.
-
-
3 issues closed.
-
Editorial: "If origin is opaque" needs to use a cross reference w3c/webappsec-permissions-policy#521.
-
Client Hint delegation to multiple subdomains w3c/webappsec-permissions-policy#479.
-
Potential bug in access delegation to cross-origin iframe for feature that has default allowlist value "self"? w3c/webappsec-permissions-policy#512.
-
-
3 issues received 11 new comments.
-
Does url match expression in origin with redirect count? takes a URL, not an origin w3c/webappsec-permissions-policy#519 (6 comments by @annevk, @clelland)
-
allow disabled-by-default features w3c/webappsec-permissions-policy#513 (3 comments by @annevk, @fergald)
-
"If the allowlist contains an origin representing self" is unclear w3c/webappsec-permissions-policy#520 (2 comments by @clelland)
-
-
5 pull requests opened.
-
Update [=opaque origin=] refs w3c/webappsec-permissions-policy#524, by @arichiv.
-
Use exported DFNs from CSP w3c/webappsec-permissions-policy#523, by @arichiv.
-
Clarify self and src origin naming w3c/webappsec-permissions-policy#522, by @arichiv.
-
Fix "Define an inherited policy for feature in container at origin" algo w3c/webappsec-permissions-policy#517, by @shuranhuang.
-
Wildcards in Permissions Policy Origins w3c/webappsec-permissions-policy#516, by @arichiv.
-
-
3 pull requests merged.
-
Update [=opaque origin=] refs w3c/webappsec-permissions-policy#524.
-
Wildcards in Permissions Policy Origins w3c/webappsec-permissions-policy#516.
-
Fix "Define an inherited policy for feature in container at origin" algo w3c/webappsec-permissions-policy#517.
-
-
1 pull request closed.
-
Wildcards in Permissions Policy Origins w3c/webappsec-permissions-policy#482.
-
-
6 pull requests received 22 new comments.
-
Wildcards in Permissions Policy Origins w3c/webappsec-permissions-policy#516 (12 comments by @arichiv, @clelland)
-
Clarify self and src origin naming w3c/webappsec-permissions-policy#522 (4 comments by @arichiv, @clelland)
-
Fix "Define an inherited policy for feature in container at origin" algo w3c/webappsec-permissions-policy#517 (3 comments by @clelland, @shuranhuang)
-
Wildcards in Permissions Policy Origins w3c/webappsec-permissions-policy#482 (1 comment by @arichiv)
-
w3c/webcrypto
-
2 issues opened.
-
JSON conversion w3c/webcrypto#349, by @annevk.
-
Out-of-date(?) ArrayBuffer usage in algorithmic text w3c/webcrypto#346, by @bathos.
-
-
2 issues received 4 new comments.
-
[security] Please strongly discourage pure javascript implementation w3c/webcrypto#277 (3 comments by @paulmillr, @twiss)
-
-
1 pull request opened.
-
Refer to relevant realm instead of relevant global object w3c/webcrypto#347, by @twiss.
-
-
1 pull request received 14 new comments.
-
Refer to relevant realm instead of relevant global object w3c/webcrypto#347 (14 comments by @annevk, @bathos, @twiss)
-
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
-
Normative spec doesn't necessarily terminate service workers w3c/webappsec-clear-site-data#54 (1 comment by @asutherland)
-
-
1 pull request opened.
-
Add client-hints clearing support w3c/webappsec-clear-site-data#74, by @arichiv.
-
-
1 pull request received 1 new comment.
w3c/webappsec-cspee
-
1 issue received 5 new comments.
-
Buggy behavior with multiple nested frames w3c/webappsec-cspee#26 (5 comments by @antosart, @shhnjk)
-
w3c/webappsec-post-spectre-webdev
-
1 pull request opened.
-
Replace CORB link with Chromium explainer w3c/webappsec-post-spectre-webdev#26, by @fmarier.
-
w3c/webappsec-csp
-
3 issues opened.
-
Remove WPTs for spec-removed `navigate-to` directive w3c/webappsec-csp#608, by @CanadaHonk.
-
[Editorial] Fix link to published CSP 2 in README.md w3c/webappsec-csp#605, by @bwbroersma.
-
Export DFNs used in Permissions-Policy w3c/webappsec-csp#604, by @arichiv.
-
-
2 issues closed.
-
Export DFNs used in Permissions-Policy w3c/webappsec-csp#604.
-
[Editorial] Fix link to published CSP 2 in README.md w3c/webappsec-csp#605.
-
-
1 issue reopened.
-
Export DFNs used in Permissions-Policy w3c/webappsec-csp#604, by @arichiv.
-
-
2 issues received 6 new comments.
-
Remove WPTs for spec-removed `navigate-to` directive w3c/webappsec-csp#608 (4 comments by @annevk, @CanadaHonk, @clelland)
-
host-char mismatches with the URL Standard w3c/webappsec-csp#592 (2 comments by @arichiv, @clelland)
-
-
2 pull requests opened.
-
Export DFNs used in Permissions-Policy w3c/webappsec-csp#607, by @arichiv.
-
[Editorial] Fix link to published CSP 2 w3c/webappsec-csp#606, by @bwbroersma.
-
-
2 pull requests merged.
-
Export DFNs used in Permissions-Policy w3c/webappsec-csp#607.
-
[Editorial] Fix link to published CSP 2 w3c/webappsec-csp#606.
-
-
2 pull requests received 3 new comments.
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Add Referrer-Policy to HTTP Field Name Registry w3c/webappsec-referrer-policy#168, by @stiiin.
-
w3c/permissions
-
1 issue opened.
-
Missing semicolon at the end of the "Aspect" WebIDL example w3c/permissions#415, by @johnathan79717.
-
-
1 issue closed.
-
Missing semicolon at the end of the "Aspect" WebIDL example w3c/permissions#415.
-
-
2 issues received 4 new comments.
-
Add another permission state "always-ask" (from one-time grants)? w3c/permissions#414 (3 comments by @fippo, @jan-ivar)
-
Missing semicolon at the end of the "Aspect" WebIDL example w3c/permissions#415 (1 comment by @miketaylr)
-
-
2 pull requests opened.
-
Add missing semicolon to WebIDL example w3c/permissions#417, by @miketaylr.
-
replace cdn.w3.org by www.w3.org w3c/permissions#416, by @deniak.
-
-
2 pull requests merged.
-
Add missing semicolon to WebIDL example w3c/permissions#417.
-
replace cdn.w3.org by www.w3.org w3c/permissions#416.
-
w3c/webappsec
-
2 issues opened.
-
Planning TPAC 2023. w3c/webappsec#627, by @mikewest.
-
Planning 2023-07-19. w3c/webappsec#626, by @mikewest.
-
-
1 issue closed.
-
Planning 2023-06-21 w3c/webappsec#624.
-
-
1 issue received 5 new comments.
w3c/trusted-types
-
1 issue received 2 new comments.
TR publications
-
1 document published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Participants
-
2 participants joined.
-
nics moda (Ministry of Digital Affairs, Taiwan) joined.
-
Anshuman Goel (Microsoft Corporation) joined.
-
-
2 participants left.
-
nics moda (Ministry of Digital Affairs, Taiwan) left.
-
Jungkee Song (Microsoft Corporation) left.
-
-
1 organization joined.
-
Ministry of Digital Affairs, Taiwan joined.
-
GitHub
w3c/webappsec-secure-contexts
-
1 issue received 1 new comment.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (1 comment by @jharris1993)
-
w3c/webcrypto
-
2 issues received 6 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @Zectbumo)
-
1 pull request opened.
-
Make deriveBits length parameter optional and nullable w3c/webcrypto#345, by @twiss.
-
-
1 pull request received 2 new comments.
-
Make deriveBits length parameter optional and nullable w3c/webcrypto#345 (2 comments by @javifernandez, @twiss)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
allow disabled-by-default features w3c/webappsec-permissions-policy#513, by @fergald.
-
Potential bug in access delegation to cross-origin iframe for feature that has default allowlist value "self"? w3c/webappsec-permissions-policy#512, by @shuranhuang.
-
-
1 issue closed.
-
"Process permissions policy attributes" unclear w3c/webappsec-permissions-policy#489.
-
-
2 issues received 4 new comments.
-
allow disabled-by-default features w3c/webappsec-permissions-policy#513 (2 comments by @clelland, @fergald)
-
Potential bug in access delegation to cross-origin iframe for feature that has default allowlist value "self"? w3c/webappsec-permissions-policy#512 (2 comments by @clelland, @shuranhuang)
-
-
3 pull requests opened.
-
add none as an allowed default w3c/webappsec-permissions-policy#515, by @fergald.
-
Fix typo double-apostrophe w3c/webappsec-permissions-policy#514, by @fergald.
-
Link to more rigorous definitions w3c/webappsec-permissions-policy#511, by @domfarolino.
-
-
2 pull requests merged.
-
Fix typo double-apostrophe w3c/webappsec-permissions-policy#514.
-
Link to more rigorous definitions w3c/webappsec-permissions-policy#511.
-
-
3 pull requests received 34 new comments.
-
Link to more rigorous definitions w3c/webappsec-permissions-policy#511 (32 comments by @clelland, @domfarolino)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Allow mediation to work for non-collected credentials w3c/webappsec-credential-management#217, by @npm1.
-
w3c/webappsec-csp
-
1 issue opened.
-
GIAO DICH. NHAN. TIEN CHUYEN? TIEN TREN KHAP' THE' GIOI' w3c/webappsec-csp#603, by @0924249460.
-
-
2 issues closed.
-
GIAO DICH. NHAN. TIEN CHUYEN? TIEN TREN KHAP' THE' GIOI' w3c/webappsec-csp#603.
-
port-part matches issues w3c/webappsec-csp#591.
-
-
1 pull request opened.
-
[editorial] Fix reference to navigable w3c/webappsec-csp#602, by @antosart.
-
-
2 pull requests merged.
-
Revise port matching logic w3c/webappsec-csp#596.
-
[editorial] Fix reference to navigable w3c/webappsec-csp#602.
-
-
2 pull requests received 9 new comments.
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
w3c/trusted-types
-
2 issues opened.
-
TrustedTypes bypass using iframes w3c/trusted-types#380, by @dejang.
-
should `null` & `undefined` for sinks requiring TT be a passthrough ? w3c/trusted-types#379, by @dejang.
-
-
1 issue received 1 new comment.
w3c/webappsec
-
1 issue opened.
-
Planning 2023-06-21 w3c/webappsec#624, by @mikewest.
-
-
1 issue closed.
-
Planning 2023-05-17. w3c/webappsec#622.
-
-
1 issue received 1 new comment.
TR publications
-
3 documents published.
-
Content Security Policy Level 3 published 3 times as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
GitHub
w3c/webcrypto
-
2 issues opened.
-
Can we expose Crypto/SubtleCrypto to all Worklet / all scopes? w3c/webcrypto#338, by @xyaoinum.
-
crypto.subtle.importKey should be readonly w3c/webcrypto#337, by @xxoo.
-
-
2 issues reopened.
-
deriveBits length idl does not allow null w3c/webcrypto#322, by @panva.
-
deriveBits length idl does not allow null w3c/webcrypto#322, by @annevk.
-
-
6 issues received 33 new comments.
-
deriveBits length idl does not allow null w3c/webcrypto#322 (18 comments by @annevk, @davidben, @javifernandez, @panva, @twiss)
-
Can we expose Crypto/SubtleCrypto to all Worklet / all scopes? w3c/webcrypto#338 (2 comments by @annevk, @twiss)
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (1 comment by @irux)
-
Bug 27774 - The KDFs either shouldn't allow importing extractable keys, or should support exportKey() w3c/webcrypto#76 (1 comment by @Kixunil)
-
-
3 pull requests merged.
-
Remove reference to DSA OID w3c/webcrypto#326.
-
Make length parameter nullable in deriveBits WebIDL w3c/webcrypto#324.
-
Remove support for importing RSA and ECC keys with alternative OIDs w3c/webcrypto#325.
-
-
2 pull requests received 10 new comments.
-
Remove support for importing RSA and ECC keys with alternative OIDs w3c/webcrypto#325 (8 comments by @colinbendell, @panva, @twiss)
-
Make length parameter nullable in deriveBits WebIDL w3c/webcrypto#324 (2 comments by @annevk, @sideshowbarker)
-
w3c/webappsec-csp
-
2 issues opened.
-
Algorithm variables should not be in parenthesis w3c/webappsec-csp#598, by @annevk.
-
Broken references in Content Security Policy Level 3 w3c/webappsec-csp#594, by @dontcallmedom-bot.
-
-
3 issues closed.
-
Algorithm variables should not be in parenthesis w3c/webappsec-csp#598.
-
host-part match issues w3c/webappsec-csp#590.
-
Broken references in Content Security Policy Level 3 w3c/webappsec-csp#594.
-
-
6 issues received 10 new comments.
-
host-char mismatches with the URL Standard w3c/webappsec-csp#592 (3 comments by @arichiv, @clelland)
-
Inconsistent treatment of base64url-encoded hash sources in CSP vs SRI w3c/webappsec-csp#423 (1 comment by @annevk)
-
-
7 pull requests opened.
-
[editorial] Remove backticks around null w3c/webappsec-csp#601, by @antosart.
-
[editorial] Add backticks around null w3c/webappsec-csp#600, by @antosart.
-
[editorial] Drop parentheses around algorithm variables w3c/webappsec-csp#599, by @antosart.
-
Fix issue with host-matching and non-ascii hosts w3c/webappsec-csp#597, by @arichiv.
-
Revise port matching logic w3c/webappsec-csp#596, by @arichiv.
-
[Editorial] Fix link to prefetch and preconnect in html w3c/webappsec-csp#595, by @antosart.
-
Specify the type of empty strings are w3c/webappsec-csp#593, by @arichiv.
-
-
7 pull requests merged.
-
[editorial] Drop parentheses around algorithm variables w3c/webappsec-csp#599.
-
[editorial] Remove backticks around null w3c/webappsec-csp#601.
-
[editorial] Add backticks around null w3c/webappsec-csp#600.
-
Fix issue with host-matching and non-ascii hosts w3c/webappsec-csp#597.
-
Update broken Wasm links w3c/webappsec-csp#557.
-
[Editorial] Fix link to prefetch and preconnect in html w3c/webappsec-csp#595.
-
Specify the type of empty strings are w3c/webappsec-csp#593.
-
-
6 pull requests received 49 new comments.
-
Fix issue with host-matching and non-ascii hosts w3c/webappsec-csp#597 (14 comments by @annevk, @antosart, @arichiv)
-
[editorial] Drop parentheses around algorithm variables w3c/webappsec-csp#599 (6 comments by @annevk, @antosart)
-
Specify the type of empty strings are w3c/webappsec-csp#593 (4 comments by @annevk, @arichiv, @mikewest)
w3c/webappsec-referrer-policy
-
1 issue received 10 new comments.
-
Should JavaScript module imports respect referrer policy, and if so, how? w3c/webappsec-referrer-policy#111 (10 comments by @annevk, @domenic, @domfarolino, @emilio, @naugtur, @noamr)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Prevent silent access flag proposed changes w3c/webappsec-credential-management#216, by @npm1.
-
-
1 issue received 2 new comments.
-
Prevent silent access flag proposed changes w3c/webappsec-credential-management#216 (2 comments by @npm1)
-
-
1 pull request received 1 new comment.
-
Fix return type of CredentialsContainer.store w3c/webappsec-credential-management#215 (1 comment by @rschristian)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
base64-related requirements are broken w3c/webappsec-subresource-integrity#121, by @annevk.
-
-
1 issue closed.
-
SRI is a Rec! What next? w3c/webappsec-subresource-integrity#49.
-
-
2 issues received 2 new comments.
-
Require that proxies do not modify integrity checked assets w3c/webappsec-subresource-integrity#60 (1 comment by @annevk)
-
1 pull request opened.
-
Define SRI Reports to inform site operators of integrity check failures w3c/webappsec-subresource-integrity#122, by @ScottHelme.
-
-
1 pull request received 4 new comments.
-
Define SRI Reports to inform site operators of integrity check failures w3c/webappsec-subresource-integrity#122 (4 comments by @annevk, @ScottHelme)
-
w3c/webappsec
-
2 issues opened.
-
suleymantokman92@gmail.com w3c/webappsec#623, by @tokmansulo.
-
Planning 2023-05-17. w3c/webappsec#622, by @mikewest.
-
-
2 issues closed.
-
suleymantokman92@gmail.com w3c/webappsec#623.
-
Planning the 2023-04-19. w3c/webappsec#620.
-
-
1 issue reopened.
-
suleymantokman92@gmail.com w3c/webappsec#623, by @tokmansulo.
-
-
3 issues received 7 new comments.
w3c/webappsec-secure-contexts
-
1 issue received 5 new comments.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (5 comments by @aerik, @holta, @jharris1993, @mikedawson, @tim-moody)
-
TR publications
-
1 document published.
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Past meetings
-
1 meeting.
Participants
-
2 participants joined.
-
ChangSeok Oh (ByteDance) joined.
-
Emma Zuehlcke (Mozilla Foundation) joined.
-
-
1 organization joined.
-
Rakuten Group, Inc. joined.
-
GitHub
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Should Blob URLs created in data URLs in secure contexts be potentially trustworthy? w3c/webappsec-secure-contexts#99, by @johnathan79717.
-
-
2 issues received 2 new comments.
-
Should Blob URLs created in data URLs in secure contexts be potentially trustworthy? w3c/webappsec-secure-contexts#99 (1 comment by @annevk)
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (1 comment by @jharris1993)
-
w3c/permissions-registry
-
1 issue opened.
-
Lost admin rights? w3c/permissions-registry#21, by @marcoscaceres.
-
-
1 issue closed.
-
Lost admin rights? w3c/permissions-registry#21.
-
-
1 issue received 1 new comment.
w3c/webappsec
-
1 issue opened.
-
Planning the 2023-04-19. w3c/webappsec#620, by @mikewest.
-
-
1 issue closed.
-
Planning the 2023-03-15 call. w3c/webappsec#618.
-
-
3 issues received 17 new comments.
-
Planning the 2023-03-15 call. w3c/webappsec#618 (11 comments by @hober, @johnwilander, @mikewest, @shhnjk, @tomvangoethem)
-
CSP: Consider a flag to turn off console logging for Report-Only w3c/webappsec#508 (2 comments by @antosart, @saviour123)
-
-
1 pull request opened.
-
Add to attendees list for 2023-03-15 meeting w3c/webappsec#621, by @0xedward.
-
-
1 pull request merged.
-
Add to attendees list for 2023-03-15 meeting w3c/webappsec#621.
-
w3c/webappsec-subresource-integrity
-
1 issue received 8 new comments.
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (8 comments by @arjunindia, @ArneBab, @AviKav, @brillout, @Summertime)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Clarify the expected usage of "Should request be allowed to use feature?" w3c/webappsec-permissions-policy#510, by @xyaoinum.
-
-
1 issue received 1 new comment.
-
Client Hint delegation to multiple subdomains w3c/webappsec-permissions-policy#479 (1 comment by @arichiv)
-
-
1 pull request merged.
-
add experimental features join-ad-interest-group and run-ad-auction w3c/webappsec-permissions-policy#438.
-
-
1 pull request received 3 new comments.
-
add experimental features join-ad-interest-group and run-ad-auction w3c/webappsec-permissions-policy#438 (3 comments by @clelland, @qingxinwu)
-
w3c/webappsec-credential-management
-
2 issues opened.
-
Return type of CredentialsContainer.store is wrong w3c/webappsec-credential-management#214, by @lukewarlow.
-
Fix build w3c/webappsec-credential-management#213, by @nsatragno.
-
-
1 pull request opened.
-
Fix return type of CredentialsContainer.store w3c/webappsec-credential-management#215, by @lukewarlow.
-
-
1 pull request merged.
-
Add support for publickey-credentials-create permission policy w3c/webappsec-credential-management#209.
-
w3c/permissions
-
1 pull request closed.
-
add accessibility considerations w3c/permissions#412.
-
-
1 pull request received 1 new comment.
w3c/webappsec-csp
-
4 issues opened.
-
host-char mismatches with the URL Standard w3c/webappsec-csp#592, by @annevk.
-
port-part matches issues w3c/webappsec-csp#591, by @annevk.
-
host-part match issues w3c/webappsec-csp#590, by @annevk.
-
how do i run my computer the way i want w3c/webappsec-csp#589, by @Vargason.
-
-
1 issue closed.
-
how do i run my computer the way i want w3c/webappsec-csp#589.
-
-
1 issue received 1 new comment.
w3c/webcrypto
-
1 issue received 1 new comment.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @fabiospampinato)
-
TR publications
-
4 documents published.
-
Mixed Content published as a Candidate Recommendation Draft. History of Mixed Content
-
Permissions Policy published twice as a Working Draft. History of Permissions Policy
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Participants
-
2 participants left.
-
Daniel Fishkov (RingCentral) left.
-
Wendy Seltzer (W3C) left.
-
-
1 organization left.
-
RingCentral left.
-
GitHub
w3c/webappsec-credential-management
-
1 pull request opened.
-
Fix typo w3c/webappsec-credential-management#212, by @martinthomson.
-
-
1 pull request reopened.
-
Add support for publickey-credentials-create permission policy w3c/webappsec-credential-management#209, by @stephenmcgruer.
-
-
1 pull request received 4 new comments.
-
Add support for publickey-credentials-create permission policy w3c/webappsec-credential-management#209 (4 comments by @aaahlam621997, @nsatragno, @stephenmcgruer)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Deploy to W3C action failing w3c/webappsec-mixed-content#68, by @carlosjoan91.
-
-
1 issue closed.
-
Deploy to W3C action failing w3c/webappsec-mixed-content#68.
-
-
2 issues received 5 new comments.
-
"strict mixed content checking flag" not defined for environment settings objects w3c/webappsec-mixed-content#18 (3 comments by @annevk, @carlosjoan91)
-
w3c/webappsec-permissions-policy
-
1 issue received 2 new comments.
-
Proposal: allow grouping permissions by year w3c/webappsec-permissions-policy#481 (2 comments by @annevk, @darobin)
-
-
2 pull requests opened.
-
Update publickey-credentials-get shipped status w3c/webappsec-permissions-policy#509, by @bdewater.
-
Add browser support to display-capture w3c/webappsec-permissions-policy#508, by @beaufortfrancois.
-
-
2 pull requests merged.
-
Update publickey-credentials-get shipped status w3c/webappsec-permissions-policy#509.
-
Add browser support to display-capture w3c/webappsec-permissions-policy#508.
-
-
2 pull requests received 5 new comments.
-
Update publickey-credentials-get shipped status w3c/webappsec-permissions-policy#509 (3 comments by @bdewater, @clelland, @w3cbot)
-
Add browser support to display-capture w3c/webappsec-permissions-policy#508 (2 comments by @beaufortfrancois, @clelland)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Add Referrer-Policy no-referrer-when-cross-origin w3c/webappsec-referrer-policy#167, by @Shamar.
-
-
1 issue received 5 new comments.
-
Add Referrer-Policy no-referrer-when-cross-origin w3c/webappsec-referrer-policy#167 (5 comments by @domfarolino, @Shamar)
-
w3c/webcrypto
-
1 issue opened.
-
[feature request] importing SPKI from X.509 Certificates w3c/webcrypto#332, by @panva.
-
-
3 issues received 7 new comments.
-
[feature request] importing SPKI from X.509 Certificates w3c/webcrypto#332 (5 comments by @panva, @twiss)
-
w3c/webappsec-csp
-
2 issues received 2 new comments.
-
1 pull request opened.
-
Fix link text for "run CSP initialization for a global object" w3c/webappsec-csp#588, by @jakearchibald.
-
-
1 pull request merged.
-
Fix link text for "run CSP initialization for a global object" w3c/webappsec-csp#588.
-
w3c/webappsec-cspee
-
1 issue received 2 new comments.
-
Buggy behavior with multiple nested frames w3c/webappsec-cspee#26 (2 comments by @arturjanc, @qabandi)
-
w3c/permissions
-
2 issues opened.
-
Add another permission state "always-ask" (from one-time grants)? w3c/permissions#414, by @jan-ivar.
-
Add a hook for implicitly granting or denying before requesting permission to use w3c/permissions#413, by @johannhof.
-
-
2 issues received 4 new comments.
-
Add another permission state "always-ask" (from one-time grants)? w3c/permissions#414 (2 comments by @annevk, @jan-ivar)
-
Add a hook for implicitly granting or denying before requesting permission to use w3c/permissions#413 (2 comments by @annevk, @jyasskin)
-
-
2 pull requests received 4 new comments.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Script not blocked when integrity attribute is malformed ? w3c/webappsec-subresource-integrity#120, by @MarchantLucas.
-
-
2 issues received 5 new comments.
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (3 comments by @dveditz, @jayaddison, @tdelmas)
-
Script not blocked when integrity attribute is malformed ? w3c/webappsec-subresource-integrity#120 (2 comments by @annevk, @MarchantLucas)
-
w3c/webappsec
-
1 issue received 4 new comments.
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Broken references in Upgrade Insecure Requests w3c/webappsec-upgrade-insecure-requests#33, by @dontcallmedom-bot.
-
TR publications
-
6 documents published.
-
Permissions Policy published 4 times as a Working Draft. History of Permissions Policy
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
Participants
-
1 Team contact appointed.
-
Philippe Le Hegaret became a Team contact.
-
-
2 Team contacts stepped down.
-
Wendy Seltzer stepped down as a Team contact.
-
Samuel Weiler stepped down as a Team contact.
-
-
7 participants joined.
-
Sunil Jolapara (Skynet Technologies) joined.
-
Sergey Kataev (Google LLC) joined.
-
Philippe Le Hegaret (W3C) joined.
-
Ari Chivukula (Google LLC) joined.
-
Mert Coskuner (Yahoo Holdings Inc.) joined.
-
Noam Rosenthal (Google LLC) joined.
-
Paul Semel (Google LLC) joined.
-
-
2 participants left.
-
Samuel Weiler (W3C) left.
-
Jun Kokatsu (Microsoft Corporation) left.
-
-
2 organizations joined.
-
Skynet Technologies joined.
-
Yahoo Holdings Inc. joined.
-
GitHub
w3c/webcrypto
-
2 issues received 2 new comments.
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (1 comment by @matthiasgeihs)
-
w3c/webappsec
-
2 issues opened.
-
Planning the 2023-03-15 call. w3c/webappsec#618, by @mikewest.
-
Planning the 2023-01-18 call. w3c/webappsec#617, by @mikewest.
-
-
1 issue closed.
-
Planning the 2023-01-18 call. w3c/webappsec#617.
-
-
2 issues received 17 new comments.
-
Planning the 2023-01-18 call. w3c/webappsec#617 (14 comments by @arturjanc, @clelland, @dveditz, @hober, @johnwilander, @mikewest, @mozfreddyb, @tomvangoethem)
-
-
1 pull request opened.
-
Update 2023-01-18-minutes.md w3c/webappsec#619, by @johnathan79717.
-
-
1 pull request merged.
-
Update 2023-01-18-minutes.md w3c/webappsec#619.
-
-
1 pull request received 1 new comment.
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Broken references in Referrer Policy w3c/webappsec-referrer-policy#166, by @dontcallmedom-bot.
-
-
3 issues closed.
-
Strip url check for null url appears redundant w3c/webappsec-referrer-policy#139.
-
Referrer policy of referencing in SVG? w3c/webappsec-referrer-policy#108.
-
Broken references in Referrer Policy w3c/webappsec-referrer-policy#166.
-
-
2 issues received 2 new comments.
-
Strip url check for null url appears redundant w3c/webappsec-referrer-policy#139 (1 comment by @domfarolino)
-
Referrer policy of referencing in SVG? w3c/webappsec-referrer-policy#108 (1 comment by @domfarolino)
-
-
1 pull request received 1 new comment.
-
CI: Switch to https://github.com/w3c/spec-prod w3c/webappsec-referrer-policy#150 (1 comment by @domfarolino)
-
w3c/trusted-types
-
1 issue opened.
-
Broken references in Trusted Types w3c/trusted-types#378, by @dontcallmedom-bot.
-
w3c/webappsec-csp
-
2 issues opened.
-
Logic issue with resource hint check with multiple conflicting policies w3c/webappsec-csp#587, by @noamr.
-
unique app id in reported violation object w3c/webappsec-csp#584, by @telelvis.
-
-
2 issues closed.
-
unique app id in reported violation object w3c/webappsec-csp#584.
-
Consider relaxing `prefetch-src` and preload `as` w3c/webappsec-csp#542.
-
-
5 issues received 13 new comments.
-
Integration with document.open() w3c/webappsec-csp#402 (4 comments by @annevk, @antosart, @mikewest)
-
Logic issue with resource hint check with multiple conflicting policies w3c/webappsec-csp#587 (3 comments by @mikewest, @noamr)
-
unique app id in reported violation object w3c/webappsec-csp#584 (3 comments by @mikewest, @telelvis)
-
Consider relaxing `prefetch-src` and preload `as` w3c/webappsec-csp#542 (2 comments by @jeremyroman, @noamr)
-
-
3 pull requests opened.
-
Fix references and fix build w3c/webappsec-csp#586, by @antosart.
-
Fix return value of resource hint check w3c/webappsec-csp#585, by @antosart.
-
Fix HTML link-rel links w3c/webappsec-csp#583, by @noamr.
-
-
4 pull requests merged.
-
Fix return value of resource hint check w3c/webappsec-csp#585.
-
Fix references and fix build w3c/webappsec-csp#586.
-
Fix HTML link-rel links w3c/webappsec-csp#583.
-
Use "least restrictive" directive instead of `prefetch-src` w3c/webappsec-csp#582.
-
-
1 pull request reopened.
-
Use "least restrictive" directive instead of `prefetch-src` w3c/webappsec-csp#582, by @noamr.
-
-
3 pull requests received 8 new comments.
-
Use "least restrictive" directive instead of `prefetch-src` w3c/webappsec-csp#582 (2 comments by @noamr)
w3c/webappsec-mixed-content
-
2 issues opened.
-
Spec should explain why do we not upgrade when a request's initiator is `imageset` w3c/webappsec-mixed-content#64, by @mozfreddyb.
-
Difference between spec and practice in mixed content upgrade w3c/webappsec-mixed-content#63, by @moztomer.
-
-
3 issues closed.
-
Difference between spec and practice in mixed content upgrade w3c/webappsec-mixed-content#63.
-
Broken references in Mixed Content w3c/webappsec-mixed-content#61.
-
Spec should explain why do we not upgrade when a request's initiator is `imageset` w3c/webappsec-mixed-content#64.
-
-
5 issues received 33 new comments.
-
Difference between spec and practice in mixed content upgrade w3c/webappsec-mixed-content#63 (16 comments by @annevk, @estark37, @mikewest, @mozfreddyb, @moztomer)
-
Clarify mixed content behavior for access to origins in CIDR 127.0.0.0/8 or ::1/128 w3c/webappsec-mixed-content#17 (7 comments by @annevk, @carlosjoan91, @letitz, @mikewest, @paulsemel)
-
Spec should explain why do we not upgrade when a request's initiator is `imageset` w3c/webappsec-mixed-content#64 (4 comments by @annevk, @carlosjoan91, @estark37, @mozfreddyb)
-
Broken references in Mixed Content w3c/webappsec-mixed-content#61 (3 comments by @carlosjoan91, @domenic)
-
"strict mixed content checking flag" not defined for environment settings objects w3c/webappsec-mixed-content#18 (3 comments by @annevk, @carlosjoan91, @mikewest)
-
-
4 pull requests opened.
-
Remove CORS exception for upgrade algorithm [FIXES: #63] w3c/webappsec-mixed-content#67, by @moztomer.
-
Remove reference to "responsible document" w3c/webappsec-mixed-content#66, by @carlosjoan91.
-
Add note about imageset not being upgradeable due to historical reasons w3c/webappsec-mixed-content#65, by @carlosjoan91.
-
Clarify behaviour for public IP addresses w3c/webappsec-mixed-content#62, by @paulsemel.
-
-
4 pull requests merged.
-
Remove CORS exception for upgrade algorithm [FIXES: #63] w3c/webappsec-mixed-content#67.
-
Remove reference to "responsible document" w3c/webappsec-mixed-content#66.
-
Add note about imageset not being upgradeable due to historical reasons w3c/webappsec-mixed-content#65.
-
Clarify behaviour for public IP addresses w3c/webappsec-mixed-content#62.
-
-
4 pull requests received 35 new comments.
-
Clarify behaviour for public IP addresses w3c/webappsec-mixed-content#62 (19 comments by @annevk, @carlosjoan91, @johnathan79717, @paulsemel)
-
Remove CORS exception for upgrade algorithm [FIXES: #63] w3c/webappsec-mixed-content#67 (7 comments by @mikewest, @mozfreddyb, @moztomer)
-
Add note about imageset not being upgradeable due to historical reasons w3c/webappsec-mixed-content#65 (5 comments by @annevk, @carlosjoan91, @estark37, @mozfreddyb)
-
Remove reference to "responsible document" w3c/webappsec-mixed-content#66 (4 comments by @annevk, @carlosjoan91, @domenic)
-
w3c/permissions
-
1 issue opened.
-
No references to accessibility w3c/permissions#411, by @sheribyrne.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
add accessibility considerations w3c/permissions#412, by @chaals.
-
-
1 pull request received 1 new comment.
w3c/webappsec-permissions-policy
-
4 issues opened.
-
document.featurePolicy vs document.permissionsPolicy w3c/webappsec-permissions-policy#507, by @evilpie.
-
support <meta http-equiv> mechanism to set the policy w3c/webappsec-permissions-policy#506, by @justadreamer.
-
can anyone help me? w3c/webappsec-permissions-policy#504, by @pollokyoungteam.
-
can anyone help me w3c/webappsec-permissions-policy#503, by @pollokyoungteam.
-
-
4 issues closed.
-
document.featurePolicy vs document.permissionsPolicy w3c/webappsec-permissions-policy#507.
-
support <meta http-equiv> mechanism to set the policy w3c/webappsec-permissions-policy#506.
-
can anyone help me w3c/webappsec-permissions-policy#503.
-
can anyone help me? w3c/webappsec-permissions-policy#504.
-
-
3 issues received 5 new comments.
-
document.featurePolicy vs document.permissionsPolicy w3c/webappsec-permissions-policy#507 (2 comments by @annevk, @evilpie)
-
support <meta http-equiv> mechanism to set the policy w3c/webappsec-permissions-policy#506 (2 comments by @annevk, @justadreamer)
-
Should we support `<meta http-equiv>` mechanism to set the policy? w3c/webappsec-permissions-policy#15 (1 comment by @justadreamer)
-
-
1 pull request opened.
-
Update for new navigable concepts. w3c/webappsec-permissions-policy#505, by @clelland.
-
-
6 pull requests merged.
-
Remove old note for enabling Serial w3c/webappsec-permissions-policy#494.
-
Add User-Agent Client Hints ch-ua-* features w3c/webappsec-permissions-policy#493.
-
Propose shared-autofill feature w3c/webappsec-permissions-policy#495.
-
Update for new navigable concepts. w3c/webappsec-permissions-policy#505.
-
Fixes based on build warnings w3c/webappsec-permissions-policy#498.
-
Fix `Define an inherited policy for feature in container at origin` w3c/webappsec-permissions-policy#501.
-
-
6 pull requests received 19 new comments.
-
Update for new navigable concepts. w3c/webappsec-permissions-policy#505 (10 comments by @clelland, @domenic)
-
Add User-Agent Client Hints ch-ua-* features w3c/webappsec-permissions-policy#493 (3 comments by @clelland, @w3cbot)
-
Remove old note for enabling Serial w3c/webappsec-permissions-policy#494 (2 comments by @clelland, @w3cbot)
-
Fix `Define an inherited policy for feature in container at origin` w3c/webappsec-permissions-policy#501 (1 comment by @clelland)
-
w3c/webappsec-subresource-integrity
-
2 issues received 9 new comments.
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (7 comments by @alexshpilkin, @annevk, @brillout, @mozfreddyb)
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (2 comments by @jayaddison)
-
w3c/webappsec-fetch-metadata
-
1 issue closed.
-
Define `Sec-Purpose: Prefetch` w3c/webappsec-fetch-metadata#84.
-
w3c/webappsec-credential-management
-
1 issue opened.
-
DiscoverFromExternalSource setup needs some fixes w3c/webappsec-credential-management#211, by @npm1.
-
-
1 issue received 1 new comment.
-
DiscoverFromExternalSource setup needs some fixes w3c/webappsec-credential-management#211 (1 comment by @npm1)
-