Web Application Security Working Group - Activity in 2025
No matches.
Participants
-
4 participants joined.
-
Le Zhang (ByteDance) joined.
-
Maitane Zotes Resines (Client side development Inc) joined.
-
Cody Miller (Client side development Inc) joined.
-
Martijn Cuppens (Client side development Inc) joined.
-
GitHub
w3c/webappsec-mixed-content
-
1 issue opened.
-
Boss w3c/webappsec-mixed-content#76, by @tanverh3131-sketch.
-
-
1 issue closed.
-
Boss w3c/webappsec-mixed-content#76.
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Use API base URL when determining referrer w3c/webappsec-referrer-policy#177, by @TimvdLippe.
-
-
1 pull request closed.
-
Use API base URL when determining referrer w3c/webappsec-referrer-policy#177.
-
-
1 pull request received 9 new comments.
-
Use API base URL when determining referrer w3c/webappsec-referrer-policy#177 (9 comments by @domfarolino, @TimvdLippe)
-
w3c/webappsec-credential-management
-
4 issues opened.
-
The new A51 is 509 w3c/webappsec-credential-management#284, by @cryptogada-sudo.
-
Proposal: Capability-based Credential Fill for Multi-Step Logins w3c/webappsec-credential-management#283, by @lkraider.
-
Add accessibility section for Credential Chooser w3c/webappsec-credential-management#281, by @marcoscaceres.
-
wAkO w3c/webappsec-credential-management#280, by @KotChernyj.
-
-
2 issues closed.
-
The new A51 is 509 w3c/webappsec-credential-management#284.
-
wAkO w3c/webappsec-credential-management#280.
-
-
1 issue received 1 new comment.
-
Consider extracting PasswordCredential and FederatedCredential to separate specs? w3c/webappsec-credential-management#255 (1 comment by @alsoLut)
-
-
1 pull request opened.
-
Remove willRequestConditionalCreation method from Credential w3c/webappsec-credential-management#282, by @marcoscaceres.
-
w3c/webappsec
-
1 issue opened.
-
Planning 2026-01-21 w3c/webappsec#698, by @mikewest.
-
-
2 issues received 4 new comments.
-
Working mode for specs we're shifting to the CR snapshot model. w3c/webappsec#688 (1 comment by @marcoscaceres)
w3c/webappsec-clear-site-data
-
1 issue opened.
-
صحفاتي الفيسبوك. w3c/webappsec-clear-site-data#92, by @mhmdabnalhajaldby-sys.
-
-
1 issue closed.
-
صحفاتي الفيسبوك. w3c/webappsec-clear-site-data#92.
-
w3c/webappsec-csp
-
1 issue received 2 new comments.
-
Attackers can exploit CSP to block requests to legitimate domains w3c/webappsec-csp#792 (2 comments by @dveditz, @MartijnCuppens)
-
-
1 pull request opened.
-
Add "text" destination type, for JavaScript text imports w3c/webappsec-csp#794, by @eemeli.
-
-
3 pull requests received 8 new comments.
-
Add 'unsafe-webtransport-hashes' keyword to connect-src w3c/webappsec-csp#791 (5 comments by @antosart, @jan-ivar)
-
Add "text" destination type, for JavaScript text imports w3c/webappsec-csp#794 (2 comments by @eemeli, @mikewest)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Support for `include_site` on a subdomain instead of just root domain (eTLD+1) w3c/webappsec-dbsc#241, by @PawelMaj.
-
-
3 issues received 5 new comments.
-
Sessions can register from a subdomain without `.well-known` config? w3c/webappsec-dbsc#239 (2 comments by @drubery, @snandy-ts)
-
Alternative short-lived refresh design w3c/webappsec-dbsc#238 (2 comments by @benweissmann, @martinthomson)
-
Support for `include_site` on a subdomain instead of just root domain (eTLD+1) w3c/webappsec-dbsc#241 (1 comment by @drubery)
-
-
1 pull request opened.
-
Specify that we do not include credentials on .well-known fetches w3c/webappsec-dbsc#240, by @drubery.
-
-
1 pull request merged.
-
Specify that we do not include credentials on .well-known fetches w3c/webappsec-dbsc#240.
-
w3c/webappsec-subresource-integrity
-
1 issue closed.
-
Manifest should be sent as base64 w3c/webappsec-subresource-integrity#166.
-
-
3 issues received 3 new comments.
-
Support for multiple resources per Hash (Multiple resources in a JS file) w3c/webappsec-subresource-integrity#163 (1 comment by @rozbb)
-
Supporting WAICT Manifest in Integrity-Policy w3c/webappsec-subresource-integrity#158 (1 comment by @rozbb)
-
w3c/webcrypto
-
2 pull requests merged.
-
Align hash property format for HS512 mapping w3c/webcrypto#418.
-
prepare methods for additional KeyFormat enum values w3c/webcrypto#419.
-
w3c/permissions-registry
-
1 issue received 1 new comment.
TR publications
-
2 documents published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Past meetings
Participants
-
5 participants joined.
-
B Karsono (W3C Invited Experts) joined.
-
Keeley Hammond (Salesforce) joined.
-
Max Crone (1Password) joined.
-
Rene Leveille (1Password) joined.
-
Dennis Jackson (Mozilla Foundation) joined.
-
GitHub
w3c/webappsec
-
1 issue closed.
-
Planning TPAC 2025 w3c/webappsec#689.
-
-
2 issues received 14 new comments.
-
Planning TPAC 2025 w3c/webappsec#689 (12 comments by @antosart, @azaika, @dennisjackson, @Frosne, @johannhof, @miketaylr, @mikewest, @simoneonofri, @swijckmans)
-
Working mode for specs we're shifting to the CR snapshot model. w3c/webappsec#688 (2 comments by @drubery, @mikewest)
-
-
2 pull requests opened.
-
Update 2025-11-TPAC-minutes.md w3c/webappsec#697, by @hubertchao.
-
Add MLS explainer to the schedule w3c/webappsec#696, by @Frosne.
-
-
2 pull requests merged.
-
Update 2025-11-TPAC-minutes.md w3c/webappsec#697.
-
Add MLS explainer to the schedule w3c/webappsec#696.
-
w3c/webappsec-dbsc
-
4 issues opened.
-
Sessions can register from a subdomain without `.well-known` config? w3c/webappsec-dbsc#239, by @snandy-ts.
-
Alternative short-lived refresh design w3c/webappsec-dbsc#238, by @martinthomson.
-
Server-triggered DBSC session refresh on risk events w3c/webappsec-dbsc#236, by @ynojima.
-
Partitioned cookie support w3c/webappsec-dbsc#234, by @drubery.
-
-
1 issue closed.
-
Server-triggered DBSC session refresh on risk events w3c/webappsec-dbsc#236.
-
-
2 issues received 4 new comments.
-
Server-triggered DBSC session refresh on risk events w3c/webappsec-dbsc#236 (3 comments by @drubery, @ynojima)
-
Sessions can register from a subdomain without `.well-known` config? w3c/webappsec-dbsc#239 (1 comment by @drubery)
-
-
3 pull requests opened.
-
Add note about self-redirects w3c/webappsec-dbsc#237, by @drubery.
-
Allow signed challenge caching and recommend challenge lifetime w3c/webappsec-dbsc#233, by @thefrog-gh.
-
Update language around Max-Age in credential attribute, followup w3c/webappsec-dbsc#232, by @drubery.
-
-
3 pull requests merged.
-
Add note about self-redirects w3c/webappsec-dbsc#237.
-
Allow signed challenge caching and recommend challenge lifetime w3c/webappsec-dbsc#233.
-
Update language around Max-Age in credential attribute, followup w3c/webappsec-dbsc#232.
-
-
2 pull requests received 3 new comments.
-
Update language around Max-Age in credential attribute w3c/webappsec-dbsc#231 (1 comment by @thefrog-gh)
w3c/webcrypto
-
1 pull request opened.
-
prepare methods for additional KeyFormat enum values w3c/webcrypto#419, by @panva.
-
-
1 pull request received 1 new comment.
w3c/webappsec-csp
-
2 issues opened.
-
Attackers can exploit CSP to block requests to legitimate domains w3c/webappsec-csp#792, by @MartijnCuppens.
-
Broken links in Content Security Policy Level 3 w3c/webappsec-csp#789, by @dontcallmedom-bot.
-
-
1 issue received 9 new comments.
-
Attackers can exploit CSP to block requests to legitimate domains w3c/webappsec-csp#792 (9 comments by @annevk, @MartijnCuppens, @mikewest)
-
-
3 pull requests opened.
-
`immutable` Specification w3c/webappsec-csp#793, by @MartijnCuppens.
-
Add 'unsafe-webtransport-hashes' keyword to connect-src w3c/webappsec-csp#791, by @jan-ivar.
-
[Editorial] Fix broken references to Trusted Types spec w3c/webappsec-csp#790, by @antosart.
-
-
1 pull request merged.
-
[Editorial] Fix broken references to Trusted Types spec w3c/webappsec-csp#790.
-
-
3 pull requests received 13 new comments.
-
Add 'unsafe-webtransport-hashes' keyword to connect-src w3c/webappsec-csp#791 (8 comments by @annevk, @antosart, @jan-ivar, @mikewest)
-
[Editorial] Fix broken references to Trusted Types spec w3c/webappsec-csp#790 (1 comment by @annevk)
-
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
Clarify interaction between WAICT integrity and DOM-modifying code/plugins w3c/webappsec-subresource-integrity#167, by @rozbb.
-
Manifest should be sent as base64 w3c/webappsec-subresource-integrity#166, by @rozbb.
-
-
4 issues received 16 new comments.
-
Script coverage is non-exhaustive w3c/webappsec-subresource-integrity#157 (6 comments by @rich-hansen, @rozbb, @tomrittervg)
-
Manifest should be sent as base64 w3c/webappsec-subresource-integrity#166 (2 comments by @dveditz, @rozbb)
-
Supporting WAICT Manifest in Integrity-Policy w3c/webappsec-subresource-integrity#158 (2 comments by @rich-hansen, @tomrittervg)
w3c/permissions-registry
-
1 issue opened.
-
Permission registry moved back into main spec w3c/permissions-registry#26, by @marcoscaceres.
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Field naming inconsistency w3c/webappsec-permissions-policy#579, by @Synchro.
-
-
1 issue received 7 new comments.
-
Field naming inconsistency w3c/webappsec-permissions-policy#579 (7 comments by @ScottHelme, @Synchro)
-
w3c/webappsec-credential-management
-
2 pull requests received 10 new comments.
-
Define and export 'credential manager' w3c/webappsec-credential-management#275 (1 comment by @mohamedamir)
w3c/permissions
-
1 issue received 1 new comment.
-
WebDriver: Make it possible to pass a different origin to "Set Permission" w3c/permissions#419 (1 comment by @whimboo)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Payjoy w3c/webappsec-fetch-metadata#96, by @jesusamtrax7973-svg.
-
-
1 issue closed.
-
Payjoy w3c/webappsec-fetch-metadata#96.
-
w3c/webappsec-passkey-endpoints
-
2 pull requests opened.
-
Adds support for redirects w3c/webappsec-passkey-endpoints#17, by @timcappalli.
-
Add Recommended Usage by Clients section w3c/webappsec-passkey-endpoints#16, by @timcappalli.
-
-
1 pull request received 9 new comments.
-
Adds support for redirects w3c/webappsec-passkey-endpoints#17 (9 comments by @abergs, @MasterKale, @Progdrasil, @timcappalli)
-
w3c/trusted-types
-
1 issue received 3 new comments.
-
1 pull request opened.
-
Export the "Does sink type require trusted types?" algorithm w3c/trusted-types#603, by @antosart.
-
-
1 pull request merged.
-
Export the "Does sink type require trusted types?" algorithm w3c/trusted-types#603.
-
-
1 pull request received 1 new comment.
-
Export the "Does sink type require trusted types?" algorithm w3c/trusted-types#603 (1 comment by @lukewarlow)
-
TR publications
-
6 documents published.
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Trusted Types published twice as a Working Draft. History of Trusted Types
-
Permissions published twice as a Working Draft. History of Permissions
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Past meetings
-
1 meeting.
Participants
-
3 participants joined.
-
Robert Liu (Google LLC) joined.
-
Matthew Miller (Cisco) joined.
-
Masashi Hirano (Cybozu) joined.
-
-
2 participants left.
-
Zbigniew Tenerowicz (Consensys) left.
-
gal weizman (Consensys) left.
-
-
1 organization joined.
-
Cisco joined.
-
-
1 organization left.
-
Consensys left.
-
GitHub
w3c/webappsec-dbsc
-
3 issues opened.
-
Max-Age cookie attribute in JSON session credentials resulting in registration failure w3c/webappsec-dbsc#230, by @e-aakash.
-
Changing which cookies are bound can be complex w3c/webappsec-dbsc#227, by @drubery.
-
Teen w3c/webappsec-dbsc#226, by @patrickcardinal857-tech.
-
-
2 issues closed.
-
Teen w3c/webappsec-dbsc#226.
-
1 issue received 3 new comments.
-
Max-Age cookie attribute in JSON session credentials resulting in registration failure w3c/webappsec-dbsc#230 (3 comments by @drubery, @e-aakash)
-
-
3 pull requests opened.
-
Update language around Max-Age in credential attribute w3c/webappsec-dbsc#231, by @drubery.
-
Allow "none" as an algorithm for JWTs w3c/webappsec-dbsc#229, by @drubery.
-
Clarify that allowed_refresh_initiators is only out-of-scope hosts w3c/webappsec-dbsc#228, by @drubery.
-
-
3 pull requests merged.
-
Update language around Max-Age in credential attribute w3c/webappsec-dbsc#231.
-
Allow "none" as an algorithm for JWTs w3c/webappsec-dbsc#229.
-
Clarify that allowed_refresh_initiators is only out-of-scope hosts w3c/webappsec-dbsc#228.
-
-
3 pull requests received 23 new comments.
-
Update language around Max-Age in credential attribute w3c/webappsec-dbsc#231 (6 comments by @drubery, @thefrog-gh)
-
Clarify that allowed_refresh_initiators is only out-of-scope hosts w3c/webappsec-dbsc#228 (5 comments by @drubery, @thefrog-gh)
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Exact behavior for navigating iframes w3c/webappsec-permissions-policy#578, by @simon-friedberger.
-
How to format report-to directives? w3c/webappsec-permissions-policy#577, by @Synchro.
-
-
3 issues received 6 new comments.
-
Exact behavior for navigating iframes w3c/webappsec-permissions-policy#578 (4 comments by @clelland, @simon-friedberger)
-
-
1 pull request merged.
-
Add `monetization` feature w3c/webappsec-permissions-policy#571.
-
w3c/trusted-types
-
1 issue opened.
-
Keep [ReflectURL] on HTMLScriptElement.src in TT partial; type (TrustedScriptURL or USVString) w3c/trusted-types#600, by @shlyakpavel.
-
-
1 issue closed.
-
2 issues received 24 new comments.
-
Streaming support w3c/trusted-types#594 (20 comments by @annevk, @foolip, @lukewarlow, @mozfreddyb, @noamr)
-
Keep [ReflectURL] on HTMLScriptElement.src in TT partial; type (TrustedScriptURL or USVString) w3c/trusted-types#600 (4 comments by @lukewarlow, @shlyakpavel)
-
-
2 pull requests opened.
-
Remove abstract-ops from the spec w3c/trusted-types#602, by @lukewarlow.
-
Add missing getter steps for HTMLScriptElement.src w3c/trusted-types#601, by @lukewarlow.
-
-
2 pull requests merged.
-
Remove abstract-ops from the spec w3c/trusted-types#602.
-
Add missing getter steps for HTMLScriptElement.src w3c/trusted-types#601.
-
-
1 pull request received 1 new comment.
w3c/webappsec-passkey-endpoints
-
3 issues opened.
-
Can we permit server-relative URLs w3c/webappsec-passkey-endpoints#15, by @sbweeden.
-
Add "Recommended Use by Clients" section w3c/webappsec-passkey-endpoints#12, by @timcappalli.
-
Add new member for PRF usage w3c/webappsec-passkey-endpoints#11, by @timcappalli.
-
-
2 issues closed.
-
Add new member for PRF usage w3c/webappsec-passkey-endpoints#11.
-
Add Matt Miller as co-editor w3c/webappsec-passkey-endpoints#10.
-
-
1 issue received 3 new comments.
-
Can we permit server-relative URLs w3c/webappsec-passkey-endpoints#15 (3 comments by @annevk, @sbweeden, @timcappalli)
-
-
2 pull requests opened.
-
Add Matt Miller as co-editor w3c/webappsec-passkey-endpoints#14, by @timcappalli.
-
Add prfUsageDetails member w3c/webappsec-passkey-endpoints#13, by @timcappalli.
-
-
2 pull requests merged.
-
Add prfUsageDetails member w3c/webappsec-passkey-endpoints#13.
-
Add Matt Miller as co-editor w3c/webappsec-passkey-endpoints#14.
-
w3c/webappsec-csp
-
1 issue opened.
-
Incorrect assertion in Obtain the deprecated serialization of violation w3c/webappsec-csp#788, by @Lubrsi.
-
-
1 issue closed.
-
Does `strict-dynamic` allow dynamically adding inline scripts? w3c/webappsec-csp#426.
-
-
1 issue received 4 new comments.
-
Making CSP more usable for organizations at scale w3c/webappsec-csp#736 (4 comments by @bakkot, @quantumpacket, @swijckmans)
-
-
1 pull request opened.
-
Apply `strict-dynamic` to inline scripts. w3c/webappsec-csp#787, by @mikewest.
-
-
1 pull request merged.
-
Apply `strict-dynamic` to inline scripts. w3c/webappsec-csp#787.
-
-
1 pull request received 2 new comments.
w3c/webappsec-credential-management
-
1 issue opened.
-
Do we still want willRequestConditionalCreation? w3c/webappsec-credential-management#279, by @marcoscaceres.
-
-
4 pull requests opened.
-
Editorial: link digital wallets w3c/webappsec-credential-management#278, by @marcoscaceres.
-
Editorial: unlink digital wallets w3c/webappsec-credential-management#277, by @marcoscaceres.
-
Editorial: fix bikeshed warnings w3c/webappsec-credential-management#276, by @marcoscaceres.
-
Define and export 'credential manager' w3c/webappsec-credential-management#275, by @marcoscaceres.
-
-
3 pull requests merged.
-
Editorial: unlink digital wallets w3c/webappsec-credential-management#277.
-
Editorial: fix bikeshed warnings w3c/webappsec-credential-management#276.
-
Define and export 'credential manager' w3c/webappsec-credential-management#275.
-
-
1 pull request received 2 new comments.
-
Define and export 'credential manager' w3c/webappsec-credential-management#275 (2 comments by @marcoscaceres, @nsatragno)
-
w3c/webappsec-subresource-integrity
-
10 issues opened.
-
Integrity for source maps w3c/webappsec-subresource-integrity#165, by @mozfreddyb.
-
Proposed covered resource types w3c/webappsec-subresource-integrity#164, by @ezzak.
-
Support for multiple resources per Hash (Multiple resources in a JS file) w3c/webappsec-subresource-integrity#163, by @ezzak.
-
Manifest Hashes Format w3c/webappsec-subresource-integrity#162, by @ezzak.
-
Multiple Manifests w3c/webappsec-subresource-integrity#161, by @ezzak.
-
Inline Manifest w3c/webappsec-subresource-integrity#160, by @ezzak.
-
WAICT enforcement modes w3c/webappsec-subresource-integrity#159, by @ezzak.
-
Supporting WAICT Manifest in Integrity-Policy w3c/webappsec-subresource-integrity#158, by @ezzak.
-
Script coverage is non-exhaustive w3c/webappsec-subresource-integrity#157, by @ezzak.
-
Integrity-Policy gaps for WAICT w3c/webappsec-subresource-integrity#156, by @ezzak.
-
-
1 issue received 1 new comment.
w3c/webappsec
-
6 issues opened.
-
شیخالشیوخ w3c/webappsec#694, by @hadifatehi443-dotcom.
-
CR preparation for CSP-3 w3c/webappsec#693, by @simoneonofri.
-
CR preparation for Fetch Metadata w3c/webappsec#692, by @simoneonofri.
-
CR preparation for SRI-2 w3c/webappsec#691, by @simoneonofri.
-
CR preparation for WebCrypto-2 w3c/webappsec#690, by @simoneonofri.
-
2 issues closed.
-
شیخالشیوخ w3c/webappsec#694.
-
9 issues received 25 new comments.
-
Planning TPAC 2025 w3c/webappsec#689 (11 comments by @arturjanc, @azaika, @dveditz, @Frosne, @johannhof, @simoneonofri, @swijckmans, @torgo)
-
Working mode for specs we're shifting to the CR snapshot model. w3c/webappsec#688 (2 comments by @simoneonofri, @tidoust)
-
CSP: Consider a flag to turn off console logging for Report-Only w3c/webappsec#508 (1 comment by @swijckmans)
-
w3c/permissions
-
1 issue opened.
-
Can permissions.setPermission not use context? w3c/permissions#471, by @annevk.
-
-
2 issues received 7 new comments.
-
Can permissions.setPermission not use context? w3c/permissions#471 (6 comments by @annevk, @bvandersloot-mozilla, @cfredric, @johannhof)
-
Add an optional `topLevelOrigin` argument to `permissions.setPermission` WebDriver BiDi command w3c/permissions#450 (1 comment by @whimboo)
-
-
2 pull requests opened.
-
chore(tidy): tidy up document w3c/permissions#470, by @miketaylr.
-
Use embeddedOrigin instead of topLevelOrigin in setPermission w3c/permissions#469, by @jalonthomas.
-
-
2 pull requests merged.
-
chore(tidy): tidy up document w3c/permissions#470.
-
Use embeddedOrigin instead of topLevelOrigin in setPermission w3c/permissions#469.
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Remove w3c/webappsec-fetch-metadata#95, by @mandyhart1924-hash.
-
-
1 issue closed.
-
Remove w3c/webappsec-fetch-metadata#95.
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
schema/openldap/eduperson.ldif w3c/webappsec-secure-contexts#114, by @nikybenakova9038.
-
-
1 issue closed.
-
schema/openldap/eduperson.ldif w3c/webappsec-secure-contexts#114.
-
w3c/webcrypto
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Align hash property format for HS512 mapping w3c/webcrypto#418, by @cardoso.
-
-
1 pull request received 1 new comment.
w3c/webappsec-referrer-policy
-
1 pull request merged.
-
Handle the null fetch client case w3c/webappsec-referrer-policy#175.
-
-
1 pull request received 3 new comments.
-
Handle the null fetch client case w3c/webappsec-referrer-policy#175 (3 comments by @domenic, @domfarolino, @mikewest)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Use URL standard terms w3c/webappsec-clear-site-data#91, by @annevk.
-
TR publications
-
1 document published.
-
Permissions published as a Working Draft. History of Permissions
-
Participants
-
2 participants joined.
-
Zoher Ghadyali (Microsoft Corporation) joined.
-
Kristian Monsen (Apple Inc.) joined.
-
-
4 participants left.
-
Erez Kalman (Akamai Technologies) left.
-
David Dworken (Google LLC) left.
-
Jonathan Hao (Google LLC) left.
-
Fatih Kilic (Mozilla Foundation) left.
-
GitHub
w3c/webappsec-dbsc
-
5 issues opened.
-
Strategy for rejecting any non compliant DBSC user agent on the server side w3c/webappsec-dbsc#223, by @reda-alaoui.
-
Chrome browser does not initiate DBSC request on Mac w3c/webappsec-dbsc#221, by @krishshenoy.
-
A way to manipulate DBSC Chrome flags via the launch command? w3c/webappsec-dbsc#219, by @reda-alaoui.
-
Refresh not working as of Chrome version 140 w3c/webappsec-dbsc#218, by @MohamedBeydoun.
-
MacOS support without software keys w3c/webappsec-dbsc#217, by @MohamedBeydoun.
-
-
4 issues closed.
-
Chrome browser does not initiate DBSC request on Mac w3c/webappsec-dbsc#221.
-
A way to manipulate DBSC Chrome flags via the launch command? w3c/webappsec-dbsc#219.
-
Refresh not working as of Chrome version 140 w3c/webappsec-dbsc#218.
-
MacOS support without software keys w3c/webappsec-dbsc#217.
-
-
5 issues received 14 new comments.
-
Refresh not working as of Chrome version 140 w3c/webappsec-dbsc#218 (7 comments by @drubery, @MohamedBeydoun)
-
A way to manipulate DBSC Chrome flags via the launch command? w3c/webappsec-dbsc#219 (4 comments by @arnar, @reda-alaoui)
-
Strategy for rejecting any non compliant DBSC user agent on the server side w3c/webappsec-dbsc#223 (1 comment by @arnar)
-
Chrome browser does not initiate DBSC request on Mac w3c/webappsec-dbsc#221 (1 comment by @krishshenoy)
-
-
5 pull requests opened.
-
Re-run challenge header processing after creating a session w3c/webappsec-dbsc#225, by @drubery.
-
Update a few more "Sec-" header name references to "Secure-" w3c/webappsec-dbsc#224, by @thefrog-gh.
-
Update explainer due to spec changes w3c/webappsec-dbsc#222, by @drubery.
-
Clarify that cookie name is required but attributes optional w3c/webappsec-dbsc#220, by @drubery.
-
Update JWT format w3c/webappsec-dbsc#216, by @drubery.
-
-
8 pull requests merged.
-
Re-run challenge header processing after creating a session w3c/webappsec-dbsc#225.
-
Update a few more "Sec-" header name references to "Secure-" w3c/webappsec-dbsc#224.
-
Update explainer due to spec changes w3c/webappsec-dbsc#222.
-
Clarify that cookie name is required but attributes optional w3c/webappsec-dbsc#220.
-
Update JWT format w3c/webappsec-dbsc#216.
-
Specify base64url and no padding for JWK thumbprints w3c/webappsec-dbsc#214.
-
provider_id -> provider_session_id w3c/webappsec-dbsc#213.
-
Fix example of `Secure-Session-Skipped` w3c/webappsec-dbsc#215.
-
-
3 pull requests received 21 new comments.
w3c/webappsec-passkey-endpoints
-
3 issues opened.
-
Add Matt Miller as co-editor w3c/webappsec-passkey-endpoints#10, by @timcappalli.
-
Add security considerations w3c/webappsec-passkey-endpoints#9, by @timcappalli.
-
Add privacy considerations w3c/webappsec-passkey-endpoints#8, by @timcappalli.
-
w3c/webappsec
-
1 issue opened.
-
Planning TPAC 2025 w3c/webappsec#689, by @mikewest.
-
-
2 issues received 7 new comments.
-
Planning 2025-10-15. w3c/webappsec#686 (6 comments by @lukewarlow, @mikewest, @MinhAnhL, @simon-friedberger)
-
w3c/permissions
-
1 issue closed.
-
1 pull request merged.
-
1 pull request received 7 new comments.
-
Add an optional `topLevelOrigin` parameter to the `permissions.setPermission` command w3c/permissions#468 (7 comments by @cfredric, @jalonthomas, @marcoscaceres, @miketaylr)
-
w3c/webappsec-fetch-metadata
-
1 pull request opened.
-
[WIP] Proposal: `Sec-Fetch-Agent` HTTP request header w3c/webappsec-fetch-metadata#94, by @igrigorik.
-
-
1 pull request received 3 new comments.
-
[WIP] Proposal: `Sec-Fetch-Agent` HTTP request header w3c/webappsec-fetch-metadata#94 (3 comments by @igrigorik, @krgovind, @mikewest)
-
w3c/webappsec-csp
-
2 issues received 4 new comments.
-
Should font-src reporting kick in on font-face reference or font request? w3c/webappsec-csp#677 (2 comments by @Mhmodkhl1980)
-
Implementation differences with "Strip URL for use in reports" w3c/webappsec-csp#735 (2 comments by @annevk, @evilpie)
-
-
2 pull requests received 6 new comments.
w3c/webappsec-clear-site-data
-
1 issue received 3 new comments.
-
Clear-Site-Data and bfcache w3c/webappsec-clear-site-data#73 (3 comments by @anthonyryan1, @westonruter)
-
w3c/webappsec-credential-management
-
2 pull requests received 4 new comments.
-
Remove Password and Federated Credentials w3c/webappsec-credential-management#274 (2 comments by @lukewarlow, @marcoscaceres)
-
Define with types are allowed in the same get() request w3c/webappsec-credential-management#261 (2 comments by @marcoscaceres)
-
w3c/trusted-types
-
3 issues opened.
-
Specification Enhancement: Add blob navigation enforcement to Trusted Types w3c/trusted-types#599, by @reconsumeralization.
-
Sample for eval is wrong in WPT w3c/trusted-types#598, by @TimvdLippe.
-
panic: MESA: error: dri3_alloc_render_buffer:1634 xcb_dri3_pixmap_from_buffer[s] failed w3c/trusted-types#596, by @fred-wang.
-
-
2 issues closed.
-
Sample for eval is wrong in WPT w3c/trusted-types#598.
-
panic: MESA: error: dri3_alloc_render_buffer:1634 xcb_dri3_pixmap_from_buffer[s] failed w3c/trusted-types#596.
-
-
3 issues received 23 new comments.
-
panic: MESA: error: dri3_alloc_render_buffer:1634 xcb_dri3_pixmap_from_buffer[s] failed w3c/trusted-types#596 (3 comments by @fred-wang, @lukewarlow)
-
1 pull request opened.
-
Add TrustedTransformStream for streaming injection sinks w3c/trusted-types#597, by @foolip.
-
-
1 pull request closed.
-
Add TrustedTransformStream for streaming injection sinks w3c/trusted-types#597.
-
w3c/webappsec-referrer-policy
-
1 issue received 1 new comment.
w3c/webcrypto
-
2 issues received 6 new comments.
w3c/webappsec-mixed-content
-
1 issue received 1 new comment.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Integrity check should be strict and throw by default w3c/webappsec-subresource-integrity#155, by @LiviaMedeiros.
-
-
1 issue closed.
-
Script not blocked when integrity attribute is malformed ? w3c/webappsec-subresource-integrity#120.
-
-
2 issues received 8 new comments.
-
Integrity check should be strict and throw by default w3c/webappsec-subresource-integrity#155 (6 comments by @LiviaMedeiros, @mozfreddyb, @quantumpacket)
-
Script not blocked when integrity attribute is malformed ? w3c/webappsec-subresource-integrity#120 (2 comments by @clukhei)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
[focus-without-user-activation] Behavior of programmatically setting focus w3c/webappsec-permissions-policy#576, by @ffiori.
-
-
1 issue received 1 new comment.
-
[focus-without-user-activation] Behavior of programmatically setting focus w3c/webappsec-permissions-policy#576 (1 comment by @ffiori)
-
TR publications
-
3 documents published.
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
A Well-Known URL for Relying Party Passkey Endpoints published as a First Public Working Draft. History of A Well-Known URL for Relying Party Passkey Endpoints
-
Device Bound Session Credentials published as a First Public Working Draft. History of Device Bound Session Credentials
-
Past meetings
-
1 meeting.
Participants
-
3 participants joined.
-
Victor Huang (Microsoft Corporation) joined.
-
Junki Yuasa (Cybozu) joined.
-
Cybozu W3C (Cybozu) joined.
-
-
1 organization joined.
-
Cybozu joined.
-
GitHub
w3c/webappsec-permissions-policy
-
1 issue opened.
-
PermissionsPolicyViolationReportBody still uses old ReportBody definition w3c/webappsec-permissions-policy#575, by @freyalaluna.
-
-
2 pull requests opened.
-
[focus-without-user-activation] Add pseudo algorithm and examples w3c/webappsec-permissions-policy#574, by @ffiori.
-
Add Permissions Policy for Digital Credentials Issuance w3c/webappsec-permissions-policy#573, by @mohamedamir.
-
-
1 pull request merged.
-
Add Permissions Policy for Digital Credentials Issuance w3c/webappsec-permissions-policy#573.
-
-
3 pull requests received 9 new comments.
-
[focus-without-user-activation] Add pseudo algorithm and examples w3c/webappsec-permissions-policy#574 (6 comments by @dandclark, @ffiori, @tayloregivens)
-
Allow for User Agent discretion when checking permission policy w3c/webappsec-permissions-policy#572 (2 comments by @domfarolino, @jkarlin)
-
Add Permissions Policy for Digital Credentials Issuance w3c/webappsec-permissions-policy#573 (1 comment by @clelland)
-
w3c/webappsec-dbsc
-
3 issues opened.
-
Evaluate new possible credential types w3c/webappsec-dbsc#211, by @drubery.
-
Make challenge lifetime browser-enforced w3c/webappsec-dbsc#210, by @drubery.
-
Request going through before session is refreshed w3c/webappsec-dbsc#209, by @MohamedBeydoun.
-
-
1 issue closed.
-
Request going through before session is refreshed w3c/webappsec-dbsc#209.
-
-
3 issues received 6 new comments.
-
Request going through before session is refreshed w3c/webappsec-dbsc#209 (4 comments by @drubery, @MohamedBeydoun)
-
-
5 pull requests opened.
-
Fix example of `Secure-Session-Skipped` w3c/webappsec-dbsc#215, by @0x626f726973.
-
Specify base64url and no padding for JWK thumbprints w3c/webappsec-dbsc#214, by @drubery.
-
provider_id -> provider_session_id w3c/webappsec-dbsc#213, by @drubery.
-
[Editorial] Shift Kristian Monsen to emeritus status. w3c/webappsec-dbsc#212, by @mikewest.
-
Do not check .well-known for refreshes w3c/webappsec-dbsc#208, by @drubery.
-
-
3 pull requests merged.
-
[Editorial] Shift Kristian Monsen to emeritus status. w3c/webappsec-dbsc#212.
-
Do not check .well-known for refreshes w3c/webappsec-dbsc#208.
-
Move include_site comments to correct spot w3c/webappsec-dbsc#207.
-
-
1 pull request received 1 new comment.
-
[Editorial] Shift Kristian Monsen to emeritus status. w3c/webappsec-dbsc#212 (1 comment by @kmonsen)
-
w3c/webappsec-csp
-
1 issue opened.
-
Mish w3c/webappsec-csp#783, by @mishoslah.
-
-
1 issue closed.
-
Mish w3c/webappsec-csp#783.
-
-
3 issues received 3 new comments.
-
Making CSP more usable for organizations at scale w3c/webappsec-csp#736 (1 comment by @simon-friedberger)
-
host-part matching should allow IPv6 "[::1]" as it does for "127.0.0.1" w3c/webappsec-csp#440 (1 comment by @josh-hemphill)
-
1 pull request opened.
-
Extend CSP script-src hashes w3c/webappsec-csp#784, by @carlosjoan91.
-
-
2 pull requests received 12 new comments.
w3c/permissions
-
1 pull request opened.
-
Add an optional `topLevelOrigin` parameter to the `permissions.setPermission` command w3c/permissions#468, by @jalonthomas.
-
-
1 pull request received 16 new comments.
-
Add an optional `topLevelOrigin` parameter to the `permissions.setPermission` command w3c/permissions#468 (16 comments by @cfredric, @jalonthomas, @miketaylr)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Proposal: `schemeful-site` Referrer-Policy w3c/webappsec-referrer-policy#176, by @arichiv.
-
-
1 issue received 4 new comments.
-
Proposal: `schemeful-site` Referrer-Policy w3c/webappsec-referrer-policy#176 (4 comments by @arichiv, @domenic, @mikewest)
-
w3c/webappsec
-
3 issues opened.
-
Working mode for specs we're shifting to the CR snapshot model. w3c/webappsec#688, by @mikewest.
-
Planning 2025-10-15. w3c/webappsec#686, by @mikewest.
-
Planning 2025-08-20. w3c/webappsec#685, by @mikewest.
-
-
5 issues closed.
-
CfC to publish DBSC as a FPWD < 2025-07-12 w3c/webappsec#677.
-
Planning 2025-08-20. w3c/webappsec#685.
-
Planning 2025-07-16. w3c/webappsec#675.
-
Planning 2025-06-18. w3c/webappsec#674.
-
-
5 issues received 8 new comments.
-
CfC to publish Well-Known URL for Relying Party Passkey Endpoints as a FPWD < 2025-07-16 w3c/webappsec#678 (1 comment by @simoneonofri)
w3c/webappsec-credential-management
-
1 issue received 2 new comments.
-
Consider extracting PasswordCredential and FederatedCredential to separate specs? w3c/webappsec-credential-management#255 (2 comments by @lukewarlow)
-
-
1 pull request opened.
-
Remove Password and Federated Credentials w3c/webappsec-credential-management#274, by @lukewarlow.
-
-
1 pull request received 1 new comment.
-
Remove Password and Federated Credentials w3c/webappsec-credential-management#274 (1 comment by @lukewarlow)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Form submission warning with `javascript:` w3c/webappsec-mixed-content#75, by @nicolo-ribaudo.
-
-
1 issue received 2 new comments.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
current bytesMatch algorithm ineffective and in worst case scenario sec. vuln. w3c/webappsec-subresource-integrity#154, by @Uzlopak.
-
-
1 issue closed.
-
Integrity-Policy - multiple observed reports w3c/webappsec-subresource-integrity#143.
-
-
1 issue received 2 new comments.
-
Integrity-Policy - multiple observed reports w3c/webappsec-subresource-integrity#143 (2 comments by @yoavweiss)
-
-
1 pull request opened.
-
feat: better bytesMatch algorithm w3c/webappsec-subresource-integrity#153, by @Uzlopak.
-
-
1 pull request closed.
-
feat: better bytesMatch algorithm w3c/webappsec-subresource-integrity#153.
-
-
2 pull requests received 2 new comments.
-
feat: better bytesMatch algorithm w3c/webappsec-subresource-integrity#153 (1 comment by @mozfreddyb)
-
reduce complexity of get strongest metadata w3c/webappsec-subresource-integrity#151 (1 comment by @Uzlopak)
-
w3c/webcrypto
-
3 issues received 4 new comments.
-
Unclear whether key valiation should be performed on import w3c/webcrypto#399 (1 comment by @rgret-dev)
-
Consider dropping the secure context requirement for `randomUUID()` w3c/webcrypto#408 (1 comment by @pnappa)
-
2 pull requests opened.
-
Fix HMAC JWK import key "use" check w3c/webcrypto#413, by @panva.
-
Fixed typo in a few statements of the EC key import operation w3c/webcrypto#412, by @javifernandez.
-
-
1 pull request merged.
-
Fix HMAC JWK import key "use" check w3c/webcrypto#413.
-
-
1 pull request closed.
-
Fixed typo in a few statements of the EC key import operation w3c/webcrypto#412.
-
-
3 pull requests received 20 new comments.
-
Fixed typo in a few statements of the EC key import operation w3c/webcrypto#412 (12 comments by @Frosne, @javifernandez, @panva)
-
w3c/trusted-types
-
2 issues opened.
-
3.5. Process value with a default policy doesn't take into account `default_policy` could be null w3c/trusted-types#595, by @tete17.
-
Streaming support w3c/trusted-types#594, by @noamr.
-
-
2 issues received 8 new comments.
-
3.5. Process value with a default policy doesn't take into account `default_policy` could be null w3c/trusted-types#595 (5 comments by @lukewarlow, @tete17)
-
TR publications
-
8 documents published.
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Subresource Integrity published 4 times as a Working Draft. History of Subresource Integrity
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Past meetings
-
1 meeting.
Participants
-
1 participant left.
-
Mirko Brodesser (Igalia) left.
-
GitHub
w3c/webappsec-dbsc
-
3 issues opened.
-
Why is session expiration updated during refresh lookup in section 8.5? w3c/webappsec-dbsc#204, by @ynojima.
-
Server-Initiated DBSC Signature Request w3c/webappsec-dbsc#202, by @ynojima.
-
-
4 issues closed.
-
Why is session expiration updated during refresh lookup in section 8.5? w3c/webappsec-dbsc#204.
-
iat is a number and jwk is json w3c/webappsec-dbsc#178.
-
Server-Initiated DBSC Signature Request w3c/webappsec-dbsc#202.
-
StartSession requests only include cookies with `SameSite=None` w3c/webappsec-dbsc#106.
-
-
4 issues received 16 new comments.
-
Use more standard claims for `/securesession/startsession` and `/securesession/refresh` and don't provide the public key in the refresh endpoint w3c/webappsec-dbsc#201 (7 comments by @arianvp, @arnar, @drubery)
-
Why is session expiration updated during refresh lookup in section 8.5? w3c/webappsec-dbsc#204 (2 comments by @drubery, @ynojima)
-
-
6 pull requests opened.
-
Move include_site comments to correct spot w3c/webappsec-dbsc#207, by @thefrog-gh.
-
Host patterns should not allow wildcards on IP addresses w3c/webappsec-dbsc#206, by @drubery.
-
Specify provider_keys are JWK thumbprints w3c/webappsec-dbsc#205, by @drubery.
-
Update types of JWT fields w3c/webappsec-dbsc#203, by @drubery.
-
Update challenge serialization and COOKIES references w3c/webappsec-dbsc#200, by @drubery.
-
Remove currently unused defer_requests field from the example w3c/webappsec-dbsc#199, by @ynojima.
-
-
5 pull requests merged.
-
Host patterns should not allow wildcards on IP addresses w3c/webappsec-dbsc#206.
-
Specify provider_keys are JWK thumbprints w3c/webappsec-dbsc#205.
-
Update types of JWT fields w3c/webappsec-dbsc#203.
-
Update challenge serialization and COOKIES references w3c/webappsec-dbsc#200.
-
Remove currently unused defer_requests field from the example w3c/webappsec-dbsc#199.
-
-
5 pull requests received 6 new comments.
-
Update challenge serialization and COOKIES references w3c/webappsec-dbsc#200 (2 comments by @drubery, @thefrog-gh)
-
Host patterns should not allow wildcards on IP addresses w3c/webappsec-dbsc#206 (1 comment by @thefrog-gh)
-
Remove currently unused defer_requests field from the example w3c/webappsec-dbsc#199 (1 comment by @w3cbot)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Xxx w3c/webappsec-secure-contexts#113, by @pkup4369-eng.
-
-
1 issue closed.
-
Xxx w3c/webappsec-secure-contexts#113.
-
w3c/webappsec-permissions-policy
-
2 pull requests opened.
-
Allow for User Agent discretion when checking permission policy w3c/webappsec-permissions-policy#572, by @jkarlin.
-
Add `monetization` feature w3c/webappsec-permissions-policy#571, by @lukewarlow.
-
-
4 pull requests merged.
-
[focus-without-user-activation] Add alternative solutions w3c/webappsec-permissions-policy#563.
-
Add proposed features from Chrome's Built-In AI APIs w3c/webappsec-permissions-policy#570.
-
Replace `shared-autofill` with `autofill` and `manual-text` w3c/webappsec-permissions-policy#560.
-
Do not use request's window concept w3c/webappsec-permissions-policy#565.
-
-
4 pull requests received 14 new comments.
-
[focus-without-user-activation] Add alternative solutions w3c/webappsec-permissions-policy#563 (10 comments by @clelland, @dandclark, @ffiori)
-
Add `monetization` feature w3c/webappsec-permissions-policy#571 (2 comments by @clelland, @lukewarlow)
-
Allow for User Agent discretion when checking permission policy w3c/webappsec-permissions-policy#572 (1 comment by @domfarolino)
-
w3c/webcrypto
-
4 issues opened.
-
Remove Curve25519 w3c/webcrypto#411, by @panva.
-
Consider dropping the secure context requirement for `randomUUID()` w3c/webcrypto#408, by @Psychpsyo.
-
Provide a way to derive a public key from a private key? w3c/webcrypto#406, by @twiss.
-
-
3 issues closed.
-
Remove Curve25519 w3c/webcrypto#411.
-
Unclear whether key valiation should be performed on import w3c/webcrypto#399.
-
-
6 issues received 18 new comments.
-
Importing a raw X25519 key with an incorrect number of bytes does not throw an throw an error w3c/webcrypto#409 (6 comments by @annevk, @hopafoot)
-
Consider dropping the secure context requirement for `randomUUID()` w3c/webcrypto#408 (4 comments by @Frosne, @Psychpsyo, @twiss)
-
Provide a way to derive a public key from a private key? w3c/webcrypto#406 (2 comments by @Frosne, @panva)
-
-
2 pull requests opened.
-
Check length when importing raw X25519 and Ed25519 keys w3c/webcrypto#410, by @hopafoot.
-
Update auto-publish.yml w3c/webcrypto#407, by @simoneonofri.
-
-
2 pull requests merged.
-
Check length when importing raw X25519 and Ed25519 keys w3c/webcrypto#410.
-
Edits for FPWD publication w3c/webcrypto#403.
-
-
3 pull requests received 16 new comments.
-
Accept (async) iterables in `crypto.subtle.digest` w3c/webcrypto#390 (3 comments by @MattiasBuelens, @twiss)
w3c/webappsec-csp
-
6 issues opened.
-
Incorrect assertion in form-action Pre-Navigation Check w3c/webappsec-csp#782, by @Lubrsi.
-
`report-multiple-violations-{01,02}` don't conform with the spec w3c/webappsec-csp#781, by @TimvdLippe.
-
CSP report referrer should adhere to referrer policy w3c/webappsec-csp#775, by @imolorhe-stripe.
-
setting cssText rather than style w3c/webappsec-csp#774, by @johanneswilm.
-
-
3 issues closed.
-
Upstream trusted type changes w3c/webappsec-csp#651.
-
Alllo w3c/webappsec-csp#780.
-
FF w3c/webappsec-csp#779.
-
-
4 issues received 7 new comments.
-
Making CSP more usable for organizations at scale w3c/webappsec-csp#736 (3 comments by @mikewest, @swijckmans)
-
Implementation differences with "Strip URL for use in reports" w3c/webappsec-csp#735 (1 comment by @wolfbeast)
-
-
3 pull requests opened.
-
[Editorial] Reference algorithm instead of section for parse-metadata in SRI w3c/webappsec-csp#778, by @antosart.
-
[Editorial] Fix reference to parse-metadata in SRI w3c/webappsec-csp#777, by @antosart.
-
Integrate with speculation rules w3c/webappsec-csp#776, by @domenic.
-
-
2 pull requests merged.
-
[Editorial] Reference algorithm instead of section for parse-metadata in SRI w3c/webappsec-csp#778.
-
[Editorial] Fix reference to parse-metadata in SRI w3c/webappsec-csp#777.
-
-
2 pull requests received 5 new comments.
-
[Editorial] Reference algorithm instead of section for parse-metadata in SRI w3c/webappsec-csp#778 (2 comments by @annevk, @antosart)
w3c/webappsec-credential-management
-
2 issues received 5 new comments.
-
Consider extracting PasswordCredential and FederatedCredential to separate specs? w3c/webappsec-credential-management#255 (4 comments by @lukewarlow, @mikewest)
-
Should mediation be defaulted at all? w3c/webappsec-credential-management#256 (1 comment by @mohamedamir)
-
-
2 pull requests received 3 new comments.
-
Let specs define their own default mediation requirement w3c/webappsec-credential-management#258 (1 comment by @marcoscaceres)
w3c/webappsec-subresource-integrity
-
2 issues received 3 new comments.
-
Integrity-Policy - multiple observed reports w3c/webappsec-subresource-integrity#143 (2 comments by @ezzak, @mozfreddyb)
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (1 comment by @amark)
-
-
7 pull requests opened.
-
[Editorial] Export the parse-metadata algorithm w3c/webappsec-subresource-integrity#152, by @antosart.
-
reduce complexity of get strongest metadata w3c/webappsec-subresource-integrity#151, by @Uzlopak.
-
avoid strict splitting in parseMetada to allow base64url w3c/webappsec-subresource-integrity#150, by @Uzlopak.
-
Add issue & pull request template w3c/webappsec-subresource-integrity#149, by @mozfreddyb.
-
Add style to possible destinations list w3c/webappsec-subresource-integrity#148, by @FKLC.
-
parseMetadata: first check algorithm validity w3c/webappsec-subresource-integrity#147, by @Uzlopak.
-
Extend integrity policy's coverage to include stylesheets w3c/webappsec-subresource-integrity#146, by @FKLC.
-
-
5 pull requests merged.
-
[Editorial] Export the parse-metadata algorithm w3c/webappsec-subresource-integrity#152.
-
parseMetadata: first check algorithm validity w3c/webappsec-subresource-integrity#147.
-
Add issue & pull request template w3c/webappsec-subresource-integrity#149.
-
Add style to possible destinations list w3c/webappsec-subresource-integrity#148.
-
Extend integrity policy's coverage to include stylesheets w3c/webappsec-subresource-integrity#146.
-
-
4 pull requests received 22 new comments.
-
reduce complexity of get strongest metadata w3c/webappsec-subresource-integrity#151 (7 comments by @annevk, @mozfreddyb, @Uzlopak)
-
parseMetadata: first check algorithm validity w3c/webappsec-subresource-integrity#147 (6 comments by @evilpie, @mozfreddyb, @Uzlopak, @w3cbot)
-
Extend integrity policy's coverage to include stylesheets w3c/webappsec-subresource-integrity#146 (6 comments by @annevk, @ezzak, @FKLC)
-
avoid strict splitting in parseMetada to allow base64url w3c/webappsec-subresource-integrity#150 (3 comments by @mozfreddyb, @Uzlopak)
-
w3c/trusted-types
-
2 issues opened.
-
Duplicate trusted-type policy should invalidate the existing policy too w3c/trusted-types#593, by @kkmuffme.
-
Deprecate "allow-duplicates" - it's insecure and makes trusted types useless w3c/trusted-types#592, by @kkmuffme.
-
-
1 issue closed.
-
2 pull requests opened.
-
Cleanup calling of some algorithms w3c/trusted-types#591, by @lukewarlow.
-
Make get trusted types-compliant attribute value take strings instead… w3c/trusted-types#590, by @lukewarlow.
-
-
3 pull requests merged.
-
Add missing parameter name for algorithm w3c/trusted-types#585.
-
Make get trusted types-compliant attribute value take strings instead… w3c/trusted-types#590.
-
Use WebIDL Invoke Callback w3c/trusted-types#589.
-
-
1 pull request reopened.
-
Add missing parameter name for algorithm w3c/trusted-types#585, by @fred-wang.
-
-
2 pull requests received 15 new comments.
-
Add missing parameter name for algorithm w3c/trusted-types#585 (7 comments by @fred-wang, @lukewarlow, @TimvdLippe, @w3cbot)
w3c/permissions
w3c/webappsec
-
6 issues opened.
-
CfC to move CSP-3 to CR < 2025-07-16 w3c/webappsec#682, by @simoneonofri.
-
CfC to move Fetch Metadata to CR < 2025-07-16 w3c/webappsec#681, by @simoneonofri.
-
CfC to move SRI-2 to CR < 2025-07-16 w3c/webappsec#680, by @simoneonofri.
-
CfC to move WebCrypto-2 to CR < 2025-07-16 w3c/webappsec#679, by @simoneonofri.
-
CfC to publish DBSC as a FPWD < 2025-07-12 w3c/webappsec#677, by @simoneonofri.
-
-
8 issues received 15 new comments.
-
Planning 2025-07-16. w3c/webappsec#675 (8 comments by @drubery, @evilpie, @kmonsen, @mikewest, @swijckmans)
-
CfC to publish Well-Known URL for Relying Party Passkey Endpoints as a FPWD < 2025-07-16 w3c/webappsec#678 (1 comment by @simoneonofri)
-
-
2 pull requests opened.
-
Update 2025-07-16-agenda.md w3c/webappsec#684, by @twiss.
-
Update 2025-07-16-agenda.md w3c/webappsec#683, by @simoneonofri.
-
-
2 pull requests merged.
-
Update 2025-07-16-agenda.md w3c/webappsec#684.
-
Update 2025-07-16-agenda.md w3c/webappsec#683.
-
-
1 pull request received 1 new comment.
TR publications
-
6 documents published.
-
Content Security Policy Level 3 published 4 times as a Working Draft. History of Content Security Policy Level 3
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Permissions published as a Working Draft. History of Permissions
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Fatih Kilic (Mozilla Foundation) joined.
-
GitHub
w3c/webappsec-dbsc
-
1 issue opened.
-
Session persistence across browser restarts: Long-lived vs short-lived cookie strategy w3c/webappsec-dbsc#192, by @maronnjapan.
-
-
1 issue closed.
-
Session persistence across browser restarts: Long-lived vs short-lived cookie strategy w3c/webappsec-dbsc#192.
-
-
1 issue received 7 new comments.
-
Session persistence across browser restarts: Long-lived vs short-lived cookie strategy w3c/webappsec-dbsc#192 (7 comments by @drubery, @maronnjapan)
-
-
7 pull requests opened.
-
Editorial changes to introduction. w3c/webappsec-dbsc#198, by @arnar.
-
Update required fields in JSON session instruction format w3c/webappsec-dbsc#197, by @drubery.
-
Third part of spec feedback w3c/webappsec-dbsc#196, by @drubery.
-
Second part of spec feedback w3c/webappsec-dbsc#195, by @drubery.
-
First part of spec feedback w3c/webappsec-dbsc#194, by @drubery.
-
Add user agent considerations section w3c/webappsec-dbsc#193, by @drubery.
-
Correct GitHub links in Overview.md w3c/webappsec-dbsc#191, by @jdoerrie.
-
-
8 pull requests merged.
-
Editorial changes to introduction. w3c/webappsec-dbsc#198.
-
Update required fields in JSON session instruction format w3c/webappsec-dbsc#197.
-
Third part of spec feedback w3c/webappsec-dbsc#196.
-
Second part of spec feedback w3c/webappsec-dbsc#195.
-
First part of spec feedback w3c/webappsec-dbsc#194.
-
Add user agent considerations section w3c/webappsec-dbsc#193.
-
Correct GitHub links in Overview.md w3c/webappsec-dbsc#191.
-
Add Origin Trial token to DBSC test server w3c/webappsec-dbsc#190.
-
-
1 pull request closed.
-
Add linked description for a use case w3c/webappsec-dbsc#48.
-
-
7 pull requests received 27 new comments.
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
Integrity-Policy - multiple observed reports w3c/webappsec-subresource-integrity#143, by @yoavweiss.
-
Spec doesn't mention blob and data protocol exemption w3c/webappsec-subresource-integrity#136, by @FKLC.
-
-
1 issue closed.
-
Spec doesn't mention blob and data protocol exemption w3c/webappsec-subresource-integrity#136.
-
-
1 issue received 1 new comment.
-
Spec doesn't mention blob and data protocol exemption w3c/webappsec-subresource-integrity#136 (1 comment by @yoavweiss)
-
-
8 pull requests opened.
-
fix: initialize strongest with null w3c/webappsec-subresource-integrity#145, by @Uzlopak.
-
Remove integration section, now that it is not needed w3c/webappsec-subresource-integrity#144, by @yoavweiss.
-
Integrity policy example w3c/webappsec-subresource-integrity#142, by @yoavweiss.
-
Fix the report type to match implementations w3c/webappsec-subresource-integrity#141, by @yoavweiss.
-
Integrity-Policy: remove spurious HTML integration w3c/webappsec-subresource-integrity#140, by @yoavweiss.
-
[editorial] Make JSON valid w3c/webappsec-subresource-integrity#139, by @tabatkins.
-
Remove url ref and rename integrity policy struct w3c/webappsec-subresource-integrity#138, by @yoavweiss.
-
Add blob and data url exemption w3c/webappsec-subresource-integrity#137, by @FKLC.
-
-
8 pull requests merged.
-
fix: initialize strongest with null w3c/webappsec-subresource-integrity#145.
-
Integrity policy example w3c/webappsec-subresource-integrity#142.
-
Fix the report type to match implementations w3c/webappsec-subresource-integrity#141.
-
Remove integration section, now that it is not needed w3c/webappsec-subresource-integrity#144.
-
Integrity-Policy: remove spurious HTML integration w3c/webappsec-subresource-integrity#140.
-
Add blob and data url exemption w3c/webappsec-subresource-integrity#137.
-
[editorial] Make JSON valid w3c/webappsec-subresource-integrity#139.
-
Remove url ref and rename integrity policy struct w3c/webappsec-subresource-integrity#138.
-
-
5 pull requests received 44 new comments.
-
fix: initialize strongest with null w3c/webappsec-subresource-integrity#145 (23 comments by @annevk, @mozfreddyb, @Uzlopak, @w3cbot)
-
Add blob and data url exemption w3c/webappsec-subresource-integrity#137 (18 comments by @annevk, @FKLC, @mikewest, @mozfreddyb, @yoavweiss)
-
Fix the report type to match implementations w3c/webappsec-subresource-integrity#141 (1 comment by @yoavweiss)
-
Add Integrity-Policy for scripts w3c/webappsec-subresource-integrity#133 (1 comment by @quantumpacket)
-
w3c/webappsec-csp
-
4 issues opened.
-
URL matching expression in origin with redirect count fails to match if there is a path-part w3c/webappsec-csp#772, by @Lubrsi.
-
Making CSP more usable for organizations at scale w3c/webappsec-csp#736, by @swijckmans.
-
Implementation differences with "Strip URL for use in reports" w3c/webappsec-csp#735, by @evilpie.
-
Add Back The `prefetch-src` Directive to The CSP Header w3c/webappsec-csp#733, by @zphrs.
-
-
3 issues closed.
-
URL matching expression in origin with redirect count fails to match if there is a path-part w3c/webappsec-csp#772.
-
Conflicting SRI test cases for integrity checks and cross-origin hosts. w3c/webappsec-csp#728.
-
-
8 issues received 23 new comments.
-
Implementation differences with "Strip URL for use in reports" w3c/webappsec-csp#735 (6 comments by @annevk, @evilpie, @mikewest, @yoavweiss)
-
report-to directive to support multiple endpoints w3c/webappsec-csp#785 (5 comments by @armenzg, @lobsterkatie, @mmocny, @yoavweiss)
-
Making CSP more usable for organizations at scale w3c/webappsec-csp#736 (3 comments by @annevk, @mikewest, @swijckmans)
-
Allow 'strict-dynamic' scripts to inject styles w3c/webappsec-csp#625 (3 comments by @salceson, @vejja)
-
Add Back The `prefetch-src` Directive to The CSP Header w3c/webappsec-csp#733 (3 comments by @noamr, @zphrs)
-
Introduce new CSP keyword 'unsafe-webtransport-hashes' w3c/webappsec-csp#683 (1 comment by @dveditz)
-
Consider recommending the usage of events instead of CSP reports for CSP WPTs w3c/webappsec-csp#690 (1 comment by @dveditz)
-
-
5 pull requests opened.
-
Fix path matching in match-url-to-source-expression w3c/webappsec-csp#773, by @antosart.
-
Change CSPViolationReportBody to dictionary w3c/webappsec-csp#737, by @TimvdLippe.
-
Use "Strip URL" from the Reporting API w3c/webappsec-csp#734, by @yoavweiss.
-
[Editorial] Fix missing input param of match-response-source-list w3c/webappsec-csp#732, by @antosart.
-
Fix URL in report-uri request w3c/webappsec-csp#731, by @TimvdLippe.
-
-
5 pull requests merged.
-
Fix path matching in match-url-to-source-expression w3c/webappsec-csp#773.
-
Change CSPViolationReportBody to dictionary w3c/webappsec-csp#737.
-
Further clarify post-request check w3c/webappsec-csp#730.
-
Fix URL in report-uri request w3c/webappsec-csp#731.
-
[Editorial] Fix missing input param of match-response-source-list w3c/webappsec-csp#732.
-
-
5 pull requests received 14 new comments.
-
Use "Strip URL" from the Reporting API w3c/webappsec-csp#734 (5 comments by @annevk, @evilpie, @yoavweiss)
-
Further clarify post-request check w3c/webappsec-csp#730 (3 comments by @antosart, @TimvdLippe, @w3cbot)
-
Fix URL in report-uri request w3c/webappsec-csp#731 (3 comments by @antosart, @mikewest, @TimvdLippe)
-
Fix path matching in match-url-to-source-expression w3c/webappsec-csp#773 (2 comments by @annevk, @antosart)
-
w3c/webappsec-suborigins
-
1 issue reopened.
-
Mark spec as no longer being worked on? And archive this repo? w3c/webappsec-suborigins#81, by @tidoust.
-
-
1 issue received 1 new comment.
-
Mark spec as no longer being worked on? And archive this repo? w3c/webappsec-suborigins#81 (1 comment by @tidoust)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Clear-Site-Data and credentialless iframes w3c/webappsec-clear-site-data#90, by @ukusormus.
-
-
2 issues received 2 new comments.
w3c/webcrypto
-
1 issue opened.
-
ECDSA signature verification include derivation of s1 and s2 w3c/webcrypto#404, by @winstonDeGreef.
-
-
1 issue closed.
-
ECDSA signature verification include derivation of s1 and s2 w3c/webcrypto#404.
-
-
2 issues received 31 new comments.
-
ECDSA signature verification include derivation of s1 and s2 w3c/webcrypto#404 (18 comments by @davidben, @Frosne, @twiss, @winstonDeGreef)
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (13 comments by @davidben, @kdenhartog, @lennybacon, @reitowo, @twiss, @yawn)
-
-
1 pull request opened.
-
Properly specify the encoding when verifying ECDSA signatures w3c/webcrypto#405, by @twiss.
-
-
1 pull request merged.
-
Properly specify the encoding when verifying ECDSA signatures w3c/webcrypto#405.
-
-
1 pull request received 6 new comments.
-
Properly specify the encoding when verifying ECDSA signatures w3c/webcrypto#405 (6 comments by @davidben, @twiss)
-
w3c/trusted-types
-
1 issue opened.
-
Asynchronous createHTML/createScript/createScriptURL w3c/trusted-types#588, by @fred-wang.
-
-
1 issue closed.
-
[meta] The build currently fails w3c/trusted-types#582.
-
-
3 issues received 10 new comments.
-
Why is "callback **this** value set to null" required in step 5 of "Get Trusted Type policy value"? w3c/trusted-types#468 (7 comments by @annevk, @fred-wang, @lukewarlow, @TimvdLippe)
-
Asynchronous createHTML/createScript/createScriptURL w3c/trusted-types#588 (2 comments by @annevk, @lukewarlow)
-
-
2 pull requests opened.
-
Use WebIDL Invoke Callback w3c/trusted-types#589, by @lukewarlow.
-
Fix bikeshed error w3c/trusted-types#587, by @fred-wang.
-
-
1 pull request merged.
-
Fix bikeshed error w3c/trusted-types#587.
-
-
1 pull request received 1 new comment.
w3c/permissions
-
1 issue closed.
-
Proposed Testing Plan for Geolocation Permission w3c/permissions#460.
-
-
3 issues received 3 new comments.
-
Provide guidelines or heuristics to prevent fingerprinting in case permission is denied w3c/permissions#361 (1 comment by @eladalon1983)
-
-
1 pull request opened.
-
Editorial: Adapt CDDL declarations to new version of Bikeshed w3c/permissions#464, by @sadym-chromium.
-
-
1 pull request merged.
-
Editorial: Adapt CDDL declarations to new version of Bikeshed w3c/permissions#464.
-
-
1 pull request received 1 new comment.
-
Editorial: Adapt CDDL declarations to new version of Bikeshed w3c/permissions#464 (1 comment by @sadym-chromium)
-
w3c/webappsec
-
1 issue opened.
-
Planning 2025-07-16. w3c/webappsec#675, by @mikewest.
-
-
2 issues received 4 new comments.
-
1 pull request opened.
-
Update 2025-06-18-agenda.md w3c/webappsec#676, by @simoneonofri.
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Maybe provide a guidance for UA developers w.r.t. unknown permissions w3c/webappsec-permissions-policy#569, by @misha-drozd.
-
-
1 pull request opened.
-
Add proposed features from Chrome's Built-In AI APIs w3c/webappsec-permissions-policy#570, by @michaelwasserman.
-
-
1 pull request received 1 new comment.
-
Add proposed features from Chrome's Built-In AI APIs w3c/webappsec-permissions-policy#570 (1 comment by @michaelwasserman)
-
w3c/webappsec-credential-management
-
3 issues closed.
-
Not all paths resolve/reject the promise in the `Request a Credential` algorithm w3c/webappsec-credential-management#271.
-
unauthorized & redirected w3c/webappsec-credential-management#268.
-
node tests/promptTestingSuite.js w3c/webappsec-credential-management#273.
-
-
3 issues received 3 new comments.
-
Not all paths resolve/reject the promise in the `Request a Credential` algorithm w3c/webappsec-credential-management#271 (1 comment by @nsatragno)
-
`PasswordCredential`'s partial `CredentialRequestOptions` has bogus default value w3c/webappsec-credential-management#270 (1 comment by @nsatragno)
-
Missing interfaces size check when creating a credential w3c/webappsec-credential-management#267 (1 comment by @nsatragno)
-
w3c/webappsec-passkey-endpoints
-
1 issue closed.
-
Should query params and fragments be allowed in entries? w3c/webappsec-passkey-endpoints#3.
-
-
1 issue received 1 new comment.
-
Should query params and fragments be allowed in entries? w3c/webappsec-passkey-endpoints#3 (1 comment by @timcappalli)
-
-
1 pull request merged.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-passkey-endpoints#7.
-
w3c/webappsec-secure-contexts
-
1 issue received 1 new comment.
-
Is "file:" protocol considered a "secure context", if not why? w3c/webappsec-secure-contexts#66 (1 comment by @rbbydotdev)
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Handle the null fetch client case w3c/webappsec-referrer-policy#175, by @domenic.
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Incorrect link to "same site" concept for `sec-fetch-site` header w3c/webappsec-fetch-metadata#93, by @TimvdLippe.
-
TR publications
-
2 documents published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Participants
-
1 Team contact stepped down.
-
Philippe Le Hegaret stepped down as a Team contact.
-
-
1 participant joined.
-
Matthew Finkel (Apple Inc.) joined.
-
-
1 participant left.
-
Philippe Le Hegaret (W3C) left.
-
GitHub
w3c/webappsec-dbsc
-
5 issues opened.
-
Appropriate Prefix for Server initiated header field (`Secure-` ?) w3c/webappsec-dbsc#186, by @Jxck.
-
iat is a number and jwk is json w3c/webappsec-dbsc#178, by @bc-pi.
-
JS bindings for usage of session keys w3c/webappsec-dbsc#177, by @drubery.
-
JS bindings for session registration w3c/webappsec-dbsc#176, by @drubery.
-
Use ECDH + HS256 to sign all requests? w3c/webappsec-dbsc#167, by @reitowo.
-
-
12 issues closed.
-
Appropriate Prefix for Server initiated header field (`Secure-` ?) w3c/webappsec-dbsc#186.
-
Required/optional credential cookie attributes need to be defined w3c/webappsec-dbsc#104.
-
Login Status API? w3c/webappsec-dbsc#32.
-
MVP Recommendation: TOTP w3c/webappsec-dbsc#36.
-
[Fetch] What's stopping us from using the Fetch API configuration to support this? w3c/webappsec-dbsc#39.
-
jti/nonce/challenge value? w3c/webappsec-dbsc#43.
-
how are endpoints conveyed from server to browser? w3c/webappsec-dbsc#45.
-
`Sec-` prefix for a server header w3c/webappsec-dbsc#59.
-
Failure to create DBSC session with __Host prefix cookie w3c/webappsec-dbsc#148.
-
Use ECDH + HS256 to sign all requests? w3c/webappsec-dbsc#167.
-
Infinite spinner and network service crash w3c/webappsec-dbsc#145.
-
What is the purpose of storing the initial public key in Device Bound Session Credentials w3c/webappsec-dbsc#157.
-
-
2 issues reopened.
-
Use ECDH + HS256 to sign all requests? w3c/webappsec-dbsc#167, by @reitowo.
-
StartSession requests only include cookies with `SameSite=None` w3c/webappsec-dbsc#106, by @frankeld.
-
-
16 issues received 39 new comments.
-
StartSession requests only include cookies with `SameSite=None` w3c/webappsec-dbsc#106 (6 comments by @drubery, @frankeld)
-
Failure to create DBSC session with __Host prefix cookie w3c/webappsec-dbsc#148 (3 comments by @drubery, @Jxck)
-
Appropriate Prefix for Server initiated header field (`Secure-` ?) w3c/webappsec-dbsc#186 (3 comments by @arnar, @drubery, @Jxck)
-
Required/optional credential cookie attributes need to be defined w3c/webappsec-dbsc#104 (2 comments by @drubery, @sbweeden)
-
Where does the challenge value go in the Registration JWT? w3c/webappsec-dbsc#56 (1 comment by @bc-pi)
-
Consider Renaming "Device Bound Session Credentials" for Clarity w3c/webappsec-dbsc#152 (1 comment by @drubery)
-
[Fetch] What's stopping us from using the Fetch API configuration to support this? w3c/webappsec-dbsc#39 (1 comment by @drubery)
-
What is the purpose of storing the initial public key in Device Bound Session Credentials w3c/webappsec-dbsc#157 (1 comment by @maronnjapan)
-
25 pull requests opened.
-
Add Origin Trial token to DBSC test server w3c/webappsec-dbsc#190, by @drubery.
-
Tweaks to spec w3c/webappsec-dbsc#189, by @thefrog-gh.
-
tweaks w3c/webappsec-dbsc#188, by @thefrog-gh.
-
There are three .well-known keys w3c/webappsec-dbsc#187, by @drubery.
-
Mention proactive refreshes in the spec w3c/webappsec-dbsc#185, by @drubery.
-
`Secure-` to `Sec-` in HTTP header fields w3c/webappsec-dbsc#184, by @Jxck.
-
Add spec.html to .gitignore w3c/webappsec-dbsc#183, by @drubery.
-
Change some field defaults w3c/webappsec-dbsc#182, by @drubery.
-
Improve key sharing section w3c/webappsec-dbsc#181, by @drubery.
-
Minor updates w3c/webappsec-dbsc#180, by @drubery.
-
Describe future Login Status API integration w3c/webappsec-dbsc#179, by @drubery.
-
Detail WebAuthn alternative w3c/webappsec-dbsc#175, by @drubery.
-
Small polish improvements w3c/webappsec-dbsc#174, by @drubery.
-
Add "and return" when terminating session w3c/webappsec-dbsc#173, by @drubery.
-
Replace "whatever_cookies_apply_to_this_request" w3c/webappsec-dbsc#172, by @drubery.
-
Describe session key sharing mechanism w3c/webappsec-dbsc#171, by @drubery.
-
Fix links to session scope and session credentials w3c/webappsec-dbsc#170, by @drubery.
-
DBSC state should only update when cookies can be set w3c/webappsec-dbsc#169, by @drubery.
-
Update redirect handling for DBSC requests w3c/webappsec-dbsc#168, by @drubery.
-
Make bikeshed warning-clean w3c/webappsec-dbsc#166, by @drubery.
-
Rework type mismatches around origin vs URL vs host w3c/webappsec-dbsc#165, by @drubery.
-
Only allow refresh of same session w3c/webappsec-dbsc#164, by @drubery.
-
Specify that session store is owned by the user agent w3c/webappsec-dbsc#163, by @drubery.
-
Specify timing side-channel solution w3c/webappsec-dbsc#162, by @drubery.
-
Cherry pick bad PR management w3c/webappsec-dbsc#161, by @drubery.
-
-
26 pull requests merged.
-
Tweaks to spec w3c/webappsec-dbsc#189.
-
tweaks w3c/webappsec-dbsc#188.
-
There are three .well-known keys w3c/webappsec-dbsc#187.
-
Mention proactive refreshes in the spec w3c/webappsec-dbsc#185.
-
Minor updates w3c/webappsec-dbsc#180.
-
Improve key sharing section w3c/webappsec-dbsc#181.
-
Change some field defaults w3c/webappsec-dbsc#182.
-
Add spec.html to .gitignore w3c/webappsec-dbsc#183.
-
Detail WebAuthn alternative w3c/webappsec-dbsc#175.
-
Describe future Login Status API integration w3c/webappsec-dbsc#179.
-
Small polish improvements w3c/webappsec-dbsc#174.
-
Describe session key sharing mechanism w3c/webappsec-dbsc#171.
-
Fix links to session scope and session credentials w3c/webappsec-dbsc#170.
-
DBSC state should only update when cookies can be set w3c/webappsec-dbsc#169.
-
Add "and return" when terminating session w3c/webappsec-dbsc#173.
-
Replace "whatever_cookies_apply_to_this_request" w3c/webappsec-dbsc#172.
-
Update redirect handling for DBSC requests w3c/webappsec-dbsc#168.
-
Make bikeshed warning-clean w3c/webappsec-dbsc#166.
-
Rework type mismatches around origin vs URL vs host w3c/webappsec-dbsc#165.
-
Only allow refresh of same session w3c/webappsec-dbsc#164.
-
Remove Sec- prefixes w3c/webappsec-dbsc#160.
-
Specify that session store is owned by the user agent w3c/webappsec-dbsc#163.
-
Specify timing side-channel solution w3c/webappsec-dbsc#162.
-
Cherry pick bad PR management w3c/webappsec-dbsc#161.
-
Specify session scope matching more precisely w3c/webappsec-dbsc#156.
-
Wording clarifications w3c/webappsec-dbsc#154.
-
-
4 pull requests closed.
-
`Secure-` to `Sec-` in HTTP header fields w3c/webappsec-dbsc#184.
-
Specify that session store is owned by the user agent w3c/webappsec-dbsc#159.
-
Specify timing side-channel solution w3c/webappsec-dbsc#158.
-
DBSC refreshes are copies of original requests w3c/webappsec-dbsc#155.
-
-
23 pull requests received 129 new comments.
-
Describe session key sharing mechanism w3c/webappsec-dbsc#171 (37 comments by @drubery, @thefrog-gh)
-
Fix links to session scope and session credentials w3c/webappsec-dbsc#170 (5 comments by @drubery, @thefrog-gh)
-
Specify session scope matching more precisely w3c/webappsec-dbsc#156 (5 comments by @drubery, @thefrog-gh)
-
DBSC state should only update when cookies can be set w3c/webappsec-dbsc#169 (3 comments by @drubery, @thefrog-gh)
-
Specify that session store is owned by the user agent w3c/webappsec-dbsc#163 (3 comments by @thefrog-gh)
-
`Secure-` to `Sec-` in HTTP header fields w3c/webappsec-dbsc#184 (2 comments by @drubery, @pfreitag)
-
DBSC refreshes are copies of original requests w3c/webappsec-dbsc#155 (2 comments by @drubery, @thefrog-gh)
-
Specify that session store is owned by the user agent w3c/webappsec-dbsc#159 (1 comment by @drubery)
-
w3c/webappsec-csp
-
4 issues opened.
-
Conflicting SRI test cases for integrity checks and cross-origin hosts. w3c/webappsec-csp#728, by @TimvdLippe.
-
Inconsistency between script pre- and post-request checks for `strict-dynamic` ASCII case-sensitivity w3c/webappsec-csp#727, by @TimvdLippe.
-
Inconsistent report type naming w3c/webappsec-csp#726, by @Synchro.
-
report-to directive to support multiple endpoints w3c/webappsec-csp#785, by @armenzg.
-
-
1 issue closed.
-
Inconsistent report type naming w3c/webappsec-csp#726.
-
-
6 issues received 17 new comments.
-
Introduce new CSP keyword 'unsafe-webtransport-hashes' w3c/webappsec-csp#683 (8 comments by @dveditz, @jan-ivar, @martinthomson, @mozfreddyb)
-
Inconsistency between script pre- and post-request checks for `strict-dynamic` ASCII case-sensitivity w3c/webappsec-csp#727 (3 comments by @annevk, @TimvdLippe)
-
Conflicting SRI test cases for integrity checks and cross-origin hosts. w3c/webappsec-csp#728 (3 comments by @TimvdLippe)
-
-
4 pull requests opened.
-
Further clarify post-request check w3c/webappsec-csp#730, by @TimvdLippe.
-
[Editorial] Fix csp-hash report type in example w3c/webappsec-csp#729, by @antosart.
-
Export strip-url-for-use-in-reports w3c/webappsec-csp#725, by @yoavweiss.
-
Switch from request's window to traversable for user prompts w3c/webappsec-csp#724, by @domenic.
-
-
2 pull requests merged.
-
[Editorial] Fix csp-hash report type in example w3c/webappsec-csp#729.
-
Switch from request's window to traversable for user prompts w3c/webappsec-csp#724.
-
-
1 pull request closed.
-
Export strip-url-for-use-in-reports w3c/webappsec-csp#725.
-
-
1 pull request received 3 new comments.
w3c/trusted-types
-
1 issue opened.
-
Do non JS scripts really need TT enforcement? w3c/trusted-types#586, by @lukewarlow.
-
-
1 issue closed.
-
Ensure spec PR's diffs are generated correctly w3c/trusted-types#455.
-
-
1 pull request received 1 new comment.
w3c/webcrypto
-
3 issues received 4 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @pthrasher, @twiss)
-
Normalize an algorithm calls recursively itself with an argument of the wrong type w3c/webcrypto#365 (1 comment by @Frosne)
-
-
1 pull request received 1 new comment.
w3c/webappsec-subresource-integrity
-
2 pull requests opened.
-
Integrity-Policy - Fix up the discrepancy with Fetch integrity metadata w3c/webappsec-subresource-integrity#135, by @yoavweiss.
-
Integrity policy - export the dfns required for integration and fix a bug w3c/webappsec-subresource-integrity#134, by @yoavweiss.
-
-
3 pull requests merged.
-
Integrity-Policy - Fix up the discrepancy with Fetch integrity metadata w3c/webappsec-subresource-integrity#135.
-
Integrity policy - export the dfns required for integration and fix a bug w3c/webappsec-subresource-integrity#134.
-
Add Integrity-Policy for scripts w3c/webappsec-subresource-integrity#133.
-
-
2 pull requests received 39 new comments.
-
Add Integrity-Policy for scripts w3c/webappsec-subresource-integrity#133 (38 comments by @annevk, @martinthomson, @mozfreddyb, @yoavweiss)
-
Integrity-Policy - Fix up the discrepancy with Fetch integrity metadata w3c/webappsec-subresource-integrity#135 (1 comment by @mozfreddyb)
-
w3c/webappsec-clear-site-data
-
2 issues opened.
-
Add prefetchCache and prerenderCache values w3c/webappsec-clear-site-data#89, by @domenic.
-
Clear-Site-Data and Service Workers w3c/webappsec-clear-site-data#88, by @aamuley.
-
w3c/webappsec
-
1 issue opened.
-
Planning 2025-06-18. w3c/webappsec#674, by @mikewest.
-
-
2 issues received 5 new comments.
w3c/permissions
-
2 issues received 7 new comments.
-
Aspects and integration with Permissions Policy w3c/permissions#459 (5 comments by @annevk, @antosart)
-
WebDriver: Should Set Permission apply to future browsing contexts? w3c/permissions#437 (2 comments by @lutien, @OrKoN)
-
-
1 pull request received 1 new comment.
-
Allow for the query algorithm to return `prompt` or `denied` when document is not `allowed to use` w3c/permissions#458 (1 comment by @aselya)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Update features.md w3c/webappsec-permissions-policy#568, by @AlbertoFDR.
-
Attributed w3c/webappsec-permissions-policy#567, by @zaid007320.
-
-
1 issue closed.
-
Attributed w3c/webappsec-permissions-policy#567.
-
-
1 issue received 1 new comment.
-
4 pull requests opened.
-
Update features.md w3c/webappsec-permissions-policy#566, by @y9688.
-
Do not use request's window concept w3c/webappsec-permissions-policy#565, by @domenic.
-
focus-without-user-activation: Add missing HTML closing quote in example w3c/webappsec-permissions-policy#564, by @silverwind.
-
[focus-without-user-activation] Add alternative solutions w3c/webappsec-permissions-policy#563, by @ffiori.
-
-
1 pull request merged.
-
focus-without-user-activation: Add missing HTML closing quote in example w3c/webappsec-permissions-policy#564.
-
-
1 pull request closed.
-
Update features.md w3c/webappsec-permissions-policy#566.
-
-
4 pull requests received 4 new comments.
-
focus-without-user-activation: Add missing HTML closing quote in example w3c/webappsec-permissions-policy#564 (1 comment by @clelland)
-
[focus-without-user-activation] Add alternative solutions w3c/webappsec-permissions-policy#563 (1 comment by @dandclark)
w3c/webappsec-secure-contexts
-
1 issue closed.
-
TAG Requesting Status w3c/webappsec-secure-contexts#62.
-
-
2 issues received 2 new comments.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (1 comment by @xcporter)
w3c/webappsec-change-password-url
-
1 issue opened.
-
Reference to section that does not exist w3c/webappsec-change-password-url#50, by @My1.
-
-
1 issue closed.
-
Reference to section that does not exist w3c/webappsec-change-password-url#50.
-
w3c/webappsec-credential-management
-
1 issue opened.
-
node tests/promptTestingSuite.js w3c/webappsec-credential-management#273, by @heeeeksaa.
-
-
1 pull request opened.
-
Add immediate mediation w3c/webappsec-credential-management#272, by @kenrb.
-
-
1 pull request received 7 new comments.
TR publications
-
5 documents published.
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
Subresource Integrity published as a First Public Working Draft. History of Subresource Integrity
-
Web Cryptography Level 2 published as a First Public Working Draft. History of Web Cryptography Level 2
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Aparajita Guha (Microsoft Corporation) joined.
-
-
1 participant left.
-
Margery Clacy (Centre for Inclusive Design) left.
-
-
2 organizations left.
-
Centre for Inclusive Design left.
-
Cloudflare left.
-
GitHub
w3c/webappsec-dbsc
-
9 issues opened.
-
What is the purpose of storing the initial public key in Device Bound Session Credentials w3c/webappsec-dbsc#157, by @maronnjapan.
-
Consider Renaming "Device Bound Session Credentials" for Clarity w3c/webappsec-dbsc#152, by @kkoiwai.
-
Failure to create DBSC session with __Host prefix cookie w3c/webappsec-dbsc#148, by @ahallsc.
-
Example website with DBSC w3c/webappsec-dbsc#146, by @ivan-georgiev.
-
Infinite spinner and network service crash w3c/webappsec-dbsc#145, by @frankeld.
-
How is token theft prevented? w3c/webappsec-dbsc#136, by @DGuhr.
-
Refresh URL optional? w3c/webappsec-dbsc#135, by @frankeld.
-
Attestation? w3c/webappsec-dbsc#128, by @reitowo.
-
-
18 issues closed.
-
Example website with DBSC w3c/webappsec-dbsc#146.
-
JWT clarifications needed w3c/webappsec-dbsc#28.
-
Kernel modifications compromising DBSC w3c/webappsec-dbsc#118.
-
CORS integration w3c/webappsec-dbsc#81.
-
How often is user consent going to be required? w3c/webappsec-dbsc#124.
-
How is token theft prevented? w3c/webappsec-dbsc#136.
-
HTTP 401 MUST return a WWW-Authenticate header w3c/webappsec-dbsc#65.
-
Refresh URL optional? w3c/webappsec-dbsc#135.
-
Insufficient rationale w3c/webappsec-dbsc#13.
-
A simpler flow proposal w3c/webappsec-dbsc#46.
-
Intent to Migrate: Device Bound Session Credentials w3c/webappsec-dbsc#83.
-
cookies are not fundamental w3c/webappsec-dbsc#105.
-
Support for Software Defined Authenticators and Credential Managers w3c/webappsec-dbsc#80.
-
Where does the challenge value go in the Registration JWT? w3c/webappsec-dbsc#56.
-
Details on Session Identifier are not clear in the Explainer w3c/webappsec-dbsc#55.
-
Attestation? w3c/webappsec-dbsc#128.
-
Reduce latency by including refresh challenge w3c/webappsec-dbsc#29.
-
-
22 issues received 47 new comments.
-
How is token theft prevented? w3c/webappsec-dbsc#136 (7 comments by @arnar, @DGuhr, @drubery, @simon-friedberger, @wparad)
-
Infinite spinner and network service crash w3c/webappsec-dbsc#145 (5 comments by @drubery, @frankeld)
-
How often is user consent going to be required? w3c/webappsec-dbsc#124 (5 comments by @arnar, @drubery, @wwilk)
-
StartSession requests only include cookies with `SameSite=None` w3c/webappsec-dbsc#106 (3 comments by @drubery, @frankeld)
-
How would the server know if cookies are stolen from an active session and replayed from a different browser that ignores DBSC validation? w3c/webappsec-dbsc#134 (2 comments by @arnar, @krkhan)
-
What is the purpose of storing the initial public key in Device Bound Session Credentials w3c/webappsec-dbsc#157 (1 comment by @drubery)
-
Failure to create DBSC session with __Host prefix cookie w3c/webappsec-dbsc#148 (1 comment by @drubery)
-
Support for Software Defined Authenticators and Credential Managers w3c/webappsec-dbsc#80 (1 comment by @drubery)
-
Where does the challenge value go in the Registration JWT? w3c/webappsec-dbsc#56 (1 comment by @drubery)
-
-
24 pull requests opened.
-
Remove Sec- prefixes w3c/webappsec-dbsc#160, by @drubery.
-
Specify that session store is owned by the user agent w3c/webappsec-dbsc#159, by @drubery.
-
Specify timing side-channel solution w3c/webappsec-dbsc#158, by @drubery.
-
Specify session scope matching more precisely w3c/webappsec-dbsc#156, by @drubery.
-
DBSC refreshes are copies of original requests w3c/webappsec-dbsc#155, by @drubery.
-
Wording clarifications w3c/webappsec-dbsc#154, by @drubery.
-
Typo fixes w3c/webappsec-dbsc#153, by @drubery.
-
Update session selection mechanism w3c/webappsec-dbsc#151, by @drubery.
-
Add thefrog@ as an editor w3c/webappsec-dbsc#150, by @drubery.
-
Specify the credentials field of session instructions w3c/webappsec-dbsc#149, by @drubery.
-
Adding w3cid for editors w3c/webappsec-dbsc#147, by @simoneonofri.
-
Update to indicate that `HttpOnly` is required for CookieCraving w3c/webappsec-dbsc#144, by @frankeld.
-
Do not defer requests without credentials w3c/webappsec-dbsc#143, by @drubery.
-
Update spec.bs to origin with scheme w3c/webappsec-dbsc#142, by @frankeld.
-
Use 403 instead of 401 for retries w3c/webappsec-dbsc#141, by @drubery.
-
Restart requests after refresh w3c/webappsec-dbsc#140, by @drubery.
-
Clarify input on algo-create-session w3c/webappsec-dbsc#139, by @drubery.
-
Specify debug header behavior w3c/webappsec-dbsc#138, by @drubery.
-
Fix key locations in example w3c/webappsec-dbsc#137, by @drubery.
-
Specify .well-known URL for subdomain registration w3c/webappsec-dbsc#133, by @drubery.
-
Specify session refresh error handling w3c/webappsec-dbsc#132, by @drubery.
-
Include some server-side recommendations in the spec w3c/webappsec-dbsc#131, by @drubery.
-
Explicitly state that TPMs are not required by the protocol w3c/webappsec-dbsc#130, by @drubery.
-
Clarify JWT format w3c/webappsec-dbsc#129, by @drubery.
-
-
22 pull requests merged.
-
Use 403 instead of 401 for retries w3c/webappsec-dbsc#141.
-
Typo fixes w3c/webappsec-dbsc#153.
-
Specify debug header behavior w3c/webappsec-dbsc#138.
-
Update session selection mechanism w3c/webappsec-dbsc#151.
-
Add thefrog@ as an editor w3c/webappsec-dbsc#150.
-
Do not defer requests without credentials w3c/webappsec-dbsc#143.
-
Specify the credentials field of session instructions w3c/webappsec-dbsc#149.
-
Adding w3cid for editors w3c/webappsec-dbsc#147.
-
Restart requests after refresh w3c/webappsec-dbsc#140.
-
Fix key locations in example w3c/webappsec-dbsc#137.
-
Update to indicate that `HttpOnly` is required for CookieCraving w3c/webappsec-dbsc#144.
-
Update spec.bs to origin with scheme w3c/webappsec-dbsc#142.
-
Clarify input on algo-create-session w3c/webappsec-dbsc#139.
-
Specify .well-known URL for subdomain registration w3c/webappsec-dbsc#133.
-
Specify session refresh error handling w3c/webappsec-dbsc#132.
-
Include some server-side recommendations in the spec w3c/webappsec-dbsc#131.
-
Explicitly state that TPMs are not required by the protocol w3c/webappsec-dbsc#130.
-
Clarify JWT format w3c/webappsec-dbsc#129.
-
Update JWT type in explainer w3c/webappsec-dbsc#127.
-
Give more details on BfCache integration w3c/webappsec-dbsc#126.
-
Minor edits to spec w3c/webappsec-dbsc#123.
-
Typo fix w3c/webappsec-dbsc#122.
-
-
2 pull requests closed.
-
Don't say that the cookie list is allowed to be empty w3c/webappsec-dbsc#111.
-
Explicitly state behavior without a TPM w3c/webappsec-dbsc#125.
-
-
20 pull requests received 180 new comments.
-
Specify .well-known URL for subdomain registration w3c/webappsec-dbsc#133 (23 comments by @drubery, @frankeld, @thefrog-gh)
-
Specify session scope matching more precisely w3c/webappsec-dbsc#156 (12 comments by @drubery, @thefrog-gh)
-
DBSC refreshes are copies of original requests w3c/webappsec-dbsc#155 (4 comments by @drubery, @thefrog-gh)
-
Do not defer requests without credentials w3c/webappsec-dbsc#143 (4 comments by @drubery, @thefrog-gh)
-
Update to indicate that `HttpOnly` is required for CookieCraving w3c/webappsec-dbsc#144 (4 comments by @drubery, @simoneonofri, @w3cbot)
-
Include some server-side recommendations in the spec w3c/webappsec-dbsc#131 (4 comments by @thefrog-gh)
-
Specify the credentials field of session instructions w3c/webappsec-dbsc#149 (2 comments by @thefrog-gh)
-
Explicitly state behavior without a TPM w3c/webappsec-dbsc#125 (2 comments by @drubery, @thefrog-gh)
-
Don't say that the cookie list is allowed to be empty w3c/webappsec-dbsc#111 (1 comment by @drubery)
w3c/webappsec-subresource-integrity
-
1 pull request opened.
-
Add Integrity-Policy for scripts w3c/webappsec-subresource-integrity#133, by @yoavweiss.
-
-
1 pull request closed.
-
Revive require-sri-for for scripts w3c/webappsec-subresource-integrity#129.
-
-
2 pull requests received 68 new comments.
-
Add Integrity-Policy for scripts w3c/webappsec-subresource-integrity#133 (66 comments by @annevk, @camillelamy, @mozfreddyb, @tomrittervg, @yoavweiss)
-
Revive require-sri-for for scripts w3c/webappsec-subresource-integrity#129 (2 comments by @mozfreddyb, @yoavweiss)
-
w3c/webcrypto
-
2 issues closed.
-
No WPT tests for EC `raw` import w3c/webcrypto#298.
-
crypto.subtle.importKey should be readonly w3c/webcrypto#337.
-
-
5 issues received 8 new comments.
-
Support for PQC algorithms: ML-KEM, ML-DSA and SLH-DSA ? w3c/webcrypto#367 (2 comments by @Frosne, @paulmillr)
-
-
1 pull request opened.
-
Edits for FPWD publication w3c/webcrypto#403, by @simoneonofri.
-
-
1 pull request received 6 new comments.
w3c/webappsec-csp
-
1 issue opened.
-
2 issues closed.
-
4 issues received 8 new comments.
-
Introduce new CSP keyword 'unsafe-webtransport-hashes' w3c/webappsec-csp#683 (4 comments by @annevk, @jan-ivar, @vasilvv)
-
Inline checks in Should navigation request of type be blocked by Content Security Policy? set `blockedURI` to `inline` w3c/webappsec-csp#719 (1 comment by @antosart)
-
-
4 pull requests opened.
-
Hash reporting comments from mt w3c/webappsec-csp#723, by @yoavweiss.
-
Fix effective directive for javascript navigation checks w3c/webappsec-csp#722, by @antosart.
-
[Editorial] Disambiguate bikeshed reference for meta w3c/webappsec-csp#721, by @antosart.
-
Fix violation's blockedURI for javascript navigations w3c/webappsec-csp#720, by @antosart.
-
-
4 pull requests merged.
-
Hash reporting comments from mt w3c/webappsec-csp#723.
-
Fix violation's blockedURI for javascript navigations w3c/webappsec-csp#720.
-
Fix effective directive for javascript navigation checks w3c/webappsec-csp#722.
-
[Editorial] Disambiguate bikeshed reference for meta w3c/webappsec-csp#721.
-
-
1 pull request received 2 new comments.
w3c/webappsec-secure-contexts
-
1 issue received 1 new comment.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (1 comment by @Psychpsyo)
-
w3c/webappsec
-
1 issue opened.
-
TOTP-Based Session Cookies to defend against session hijacking w3c/webappsec#673, by @abose.
-
-
1 issue closed.
-
Planning 2025-04-16. w3c/webappsec#670.
-
-
3 issues received 5 new comments.
-
TOTP-Based Session Cookies to defend against session hijacking w3c/webappsec#673 (1 comment by @abose)
w3c/permissions
-
2 issues opened.
-
Support `*` pattern as a value for `origin` argument in `permissions.setPermission` command w3c/permissions#463, by @lutien.
-
-
1 issue received 1 new comment.
-
WebDriver: Should Set Permission apply to future browsing contexts? w3c/permissions#437 (1 comment by @whimboo)
-
-
1 pull request received 1 new comment.
w3c/webappsec-cowl
-
1 issue received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Bugs/lacking clarity in 9.5, 9.6: Algorithm lacking realms w3c/webappsec-permissions-policy#562, by @theIDinside.
-
-
1 issue received 3 new comments.
-
Bugs/lacking clarity in 9.5, 9.6: Algorithm lacking realms w3c/webappsec-permissions-policy#562 (3 comments by @clelland, @theIDinside)
-
w3c/trusted-types
-
1 issue opened.
-
navigation requests blocked by require-trusted-types-for don't set a violation sample w3c/trusted-types#584, by @fred-wang.
-
-
3 issues closed.
-
Should "Get Trusted Type compliant string" check `isHTML`/`isScript`/`isScriptURL`? w3c/trusted-types#534.
-
Are all injection sinks covered by the spec? w3c/trusted-types#385.
-
Integration with DOM Parts API w3c/trusted-types#441.
-
-
8 issues received 18 new comments.
-
Should "Get Trusted Type compliant string" check `isHTML`/`isScript`/`isScriptURL`? w3c/trusted-types#534 (3 comments by @annevk, @fred-wang)
-
Rely on WedIDL's "implements" definition for isHTML/isScript/isScriptURL? w3c/trusted-types#566 (3 comments by @annevk, @fred-wang)
-
navigation requests blocked by require-trusted-types-for don't set a violation sample w3c/trusted-types#584 (3 comments by @annevk, @fred-wang, @lukewarlow)
-
Are all injection sinks covered by the spec? w3c/trusted-types#385 (3 comments by @fred-wang, @ghost, @lukewarlow)
-
`createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names w3c/trusted-types#504 (2 comments by @annevk, @fred-wang)
-
Creating a policy with policyName="" is possible, but can't be referred to by the "trusted-types" CSP directive w3c/trusted-types#466 (2 comments by @annevk, @lukewarlow)
-
-
1 pull request opened.
-
Add missing parameter name for algorithm w3c/trusted-types#585, by @TimvdLippe.
-
-
1 pull request received 1 new comment.
w3c/webappsec-credential-management
-
3 issues opened.
-
Not all paths resolve/reject the promise in the `Request a Credential` algorithm w3c/webappsec-credential-management#271, by @devgianlu.
-
`PasswordCredential`'s partial `CredentialRequestOptions` has bogus default value w3c/webappsec-credential-management#270, by @devgianlu.
-
Task source to use when getting credentials w3c/webappsec-credential-management#269, by @marcoscaceres.
-
w3c/webappsec-fetch-metadata
-
1 pull request merged.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-fetch-metadata#92.
-
TR publications
-
2 documents published.
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
Participants
-
6 participants joined.
-
GavinLam164 GavinLam164 (ByteDance) joined.
-
huanyu chi (ByteDance) joined.
-
Kester Quist-Aphetsi (CRITAC) joined.
-
Shane Weeden (IBM Corporation) joined.
-
Chris de Almeida (IBM Corporation) joined.
-
Nicholas Steele (1Password) joined.
-
-
3 participants left.
-
Benjamin Kelly (Google LLC) left.
-
Bob Natale (MITRE Corporation) left.
-
Sanket Joshi (Microsoft Corporation) left.
-
-
3 organizations joined.
-
CRITAC joined.
-
IBM Corporation joined.
-
1Password joined.
-
GitHub
w3c/webappsec-dbsc
-
6 issues opened.
-
How often is user consent going to be required? w3c/webappsec-dbsc#124, by @wwilk.
-
Kernel modifications compromising DBSC w3c/webappsec-dbsc#118, by @drubery.
-
Synchronous operation and capability discovery w3c/webappsec-dbsc#117, by @sbweeden.
-
HTTP Message Signatures w3c/webappsec-dbsc#112, by @jricher.
-
DBSC Community Group & ongoing development? w3c/webappsec-dbsc#108, by @nicksteele.
-
Is the DBSC prototype functional with Chrome on macOS? w3c/webappsec-dbsc#107, by @zmb3.
-
-
10 issues closed.
-
An attack vector for DBSC: w3c/webappsec-dbsc#35.
-
explain `excluded scope` w3c/webappsec-dbsc#30.
-
Explicitly type the JWT w3c/webappsec-dbsc#27.
-
How do servers manage the public keys and the sessions? w3c/webappsec-dbsc#26.
-
IP binding with Cookies cant be enough ? w3c/webappsec-dbsc#25.
-
Clarification of BFCache handling w3c/webappsec-dbsc#14.
-
Origin trial updates w3c/webappsec-dbsc#17.
-
Goal/Non-Goal definition has multiple interpretations. w3c/webappsec-dbsc#2.
-
DBSC Community Group & ongoing development? w3c/webappsec-dbsc#108.
-
Is the DBSC prototype functional with Chrome on macOS? w3c/webappsec-dbsc#107.
-
-
17 issues received 36 new comments.
-
IP binding with Cookies cant be enough ? w3c/webappsec-dbsc#25 (5 comments by @drubery, @libalpm64, @Sora2455)
-
Is the DBSC prototype functional with Chrome on macOS? w3c/webappsec-dbsc#107 (5 comments by @drubery, @zmb3)
-
How often is user consent going to be required? w3c/webappsec-dbsc#124 (4 comments by @sbweeden, @wwilk)
-
Synchronous operation and capability discovery w3c/webappsec-dbsc#117 (4 comments by @drubery, @sbweeden)
-
StartSession requests only include cookies with `SameSite=None` w3c/webappsec-dbsc#106 (3 comments by @drubery, @frankeld)
-
DBSC Community Group & ongoing development? w3c/webappsec-dbsc#108 (2 comments by @drubery, @simoneonofri)
-
How do servers manage the public keys and the sessions? w3c/webappsec-dbsc#26 (1 comment by @drubery)
-
-
15 pull requests opened.
-
Update JWT type in explainer w3c/webappsec-dbsc#127, by @drubery.
-
Give more details on BfCache integration w3c/webappsec-dbsc#126, by @drubery.
-
Explicitly state behavior without a TPM w3c/webappsec-dbsc#125, by @drubery.
-
Minor edits to spec w3c/webappsec-dbsc#123, by @drubery.
-
Typo fix w3c/webappsec-dbsc#122, by @tylerjmorg.
-
Remove currently unused defer_requests field from explainer w3c/webappsec-dbsc#121, by @thefrog-gh.
-
Include Clear-Site-Data: "cookies" in explainer w3c/webappsec-dbsc#120, by @thefrog-gh.
-
Clarify that the TPM certificate chain is not sent w3c/webappsec-dbsc#119, by @drubery.
-
Fix origin field of glitch server w3c/webappsec-dbsc#116, by @drubery.
-
Update contribution file with WebAppSec w3c/webappsec-dbsc#115, by @drubery.
-
Flesh out spec w3c/webappsec-dbsc#114, by @drubery.
-
Don't say the HttpOnly attribute is ignored in session config credentials w3c/webappsec-dbsc#113, by @thefrog-gh.
-
Don't say that the cookie list is allowed to be empty w3c/webappsec-dbsc#111, by @thefrog-gh.
-
Clarify scope origin is an origin (not a host) w3c/webappsec-dbsc#110, by @thefrog-gh.
-
Update explainer with privacy commitments w3c/webappsec-dbsc#109, by @drubery.
-
-
9 pull requests merged.
-
Remove currently unused defer_requests field from explainer w3c/webappsec-dbsc#121.
-
Include Clear-Site-Data: "cookies" in explainer w3c/webappsec-dbsc#120.
-
Clarify that the TPM certificate chain is not sent w3c/webappsec-dbsc#119.
-
Update contribution file with WebAppSec w3c/webappsec-dbsc#115.
-
Fix origin field of glitch server w3c/webappsec-dbsc#116.
-
Flesh out spec w3c/webappsec-dbsc#114.
-
Don't say the HttpOnly attribute is ignored in session config credentials w3c/webappsec-dbsc#113.
-
Clarify scope origin is an origin (not a host) w3c/webappsec-dbsc#110.
-
Update explainer with privacy commitments w3c/webappsec-dbsc#109.
-
-
4 pull requests received 23 new comments.
-
Update contribution file with WebAppSec w3c/webappsec-dbsc#115 (4 comments by @drubery, @nicksteele, @simoneonofri)
-
Remove currently unused defer_requests field from explainer w3c/webappsec-dbsc#121 (2 comments by @drubery, @kmonsen)
w3c/webappsec-subresource-integrity
-
1 pull request opened.
-
Prepare for an FPWD of SRI2. w3c/webappsec-subresource-integrity#132, by @mikewest.
-
-
1 pull request merged.
-
Prepare for an FPWD of SRI2. w3c/webappsec-subresource-integrity#132.
-
-
2 pull requests received 33 new comments.
-
Revive require-sri-for for scripts w3c/webappsec-subresource-integrity#129 (29 comments by @annevk, @dveditz, @mikewest, @mozfreddyb, @rvaneijk, @simoneonofri, @tomrittervg, @yoavweiss)
-
Prepare for an FPWD of SRI2. w3c/webappsec-subresource-integrity#132 (4 comments by @mikewest, @mozfreddyb)
-
w3c/trusted-types
-
6 issues closed.
-
Add test for policies with disposition=report in workers w3c/trusted-types#575.
-
Add WPTs for `report-uri` with Workers w3c/trusted-types#526.
-
Add WPTs for CSP `sandbox allow-scripts` combined with Trusted Types w3c/trusted-types#513.
-
Improve/Rewrite tests checking for CSP violations w3c/trusted-types#576.
-
SVGScriptElement needs TT protection too w3c/trusted-types#483.
-
-
10 issues received 29 new comments.
-
Creating a policy with policyName="" is possible, but can't be referred to by the "trusted-types" CSP directive w3c/trusted-types#466 (5 comments by @fred-wang, @lukewarlow)
-
CSP syntax for `require-trusted-types-for` should be forgiving w3c/trusted-types#580 (4 comments by @fred-wang, @lukewarlow)
-
Add test for policies with disposition=report in workers w3c/trusted-types#575 (4 comments by @annevk, @fred-wang)
-
`createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names w3c/trusted-types#504 (3 comments by @fred-wang)
-
Add WPTs for CSP `sandbox allow-scripts` combined with Trusted Types w3c/trusted-types#513 (3 comments by @fred-wang, @ghost)
-
JavaScript event for tracking (and blocking) policy creation w3c/trusted-types#270 (3 comments by @annevk, @fred-wang, @lukewarlow)
-
Clipping of violation’s sample to the 40 first characters w3c/trusted-types#577 (2 comments by @fred-wang, @lukewarlow)
-
Add tests for "Should Trusted Type policy creation be blocked by Content Security Policy" in workers w3c/trusted-types#574 (2 comments by @fred-wang)
-
-
1 pull request opened.
-
Create datadog-synthetics.yml w3c/trusted-types#583, by @ramireSr1026.
-
-
2 pull requests merged.
-
Ensure element's namespace is HTML, SVG or MathML before covering eve… w3c/trusted-types#578.
-
Add SVGScriptElement handling to the spec w3c/trusted-types#581.
-
-
1 pull request closed.
-
Create datadog-synthetics.yml w3c/trusted-types#583.
-
-
1 pull request reopened.
-
Create datadog-synthetics.yml w3c/trusted-types#583, by @ramireSr1026.
-
-
1 pull request received 1 new comment.
w3c/webcrypto
-
1 issue closed.
-
AES-CBC decrypt: Unspecified error type for ciphertext of odd length w3c/webcrypto#381.
-
-
1 issue received 1 new comment.
-
3 pull requests opened.
-
Create sections for individual operations w3c/webcrypto#402, by @panva.
-
Reintroduce `alg` JWK field for Ed25519 keys w3c/webcrypto#401, by @panva.
-
Clarify that the `saltLength` parameter of RSA-PSS is in bytes, not bits w3c/webcrypto#400, by @panva.
-
-
4 pull requests merged.
-
Throw in AES-CBC decrypt operation for odd ciphertext lengths w3c/webcrypto#382.
-
Create sections for individual operations w3c/webcrypto#402.
-
Reintroduce `alg` JWK field for Ed25519 keys w3c/webcrypto#401.
-
Clarify that the `saltLength` parameter of RSA-PSS is in bytes, not bits w3c/webcrypto#400.
-
-
4 pull requests received 13 new comments.
-
Reintroduce `alg` JWK field for Ed25519 keys w3c/webcrypto#401 (6 comments by @javifernandez, @panva)
-
Throw in AES-CBC decrypt operation for odd ciphertext lengths w3c/webcrypto#382 (1 comment by @twiss)
-
Clarify that the `saltLength` parameter of RSA-PSS is in bytes, not bits w3c/webcrypto#400 (1 comment by @w3cbot)
-
w3c/webappsec-csp
-
1 issue opened.
-
[editorial] Typo in manifest-src example w3c/webappsec-csp#711, by @js-choi.
-
-
5 issues closed.
-
CSP headers are incorrect with multiple rules w3c/webappsec-csp#682.
-
[editorial] Typo in manifest-src example w3c/webappsec-csp#711.
-
Resource hint blocking / "least restrictive" as specified does nothing? w3c/webappsec-csp#633.
-
What I am doing wrong on this script-src w3c/webappsec-csp#252.
-
-
1 issue reopened.
-
connect-src test suite allows multiple non-interopable implementations. w3c/webappsec-csp#706, by @annevk.
-
-
8 issues received 16 new comments.
-
connect-src test suite allows multiple non-interopable implementations. w3c/webappsec-csp#706 (5 comments by @annevk, @lukewarlow)
-
Clipping of violation’s sample to the 40 first characters w3c/webappsec-csp#704 (4 comments by @annevk, @fred-wang)
-
Allow RFC3986 scheme relative URIs in host-source w3c/webappsec-csp#694 (2 comments by @dveditz, @Mahoney)
-
Should "Should navigation request of type be blocked by Content Security Policy?" set the violation object's element? w3c/webappsec-csp#687 (1 comment by @ghost)
-
-
2 pull requests opened.
-
[Editorial] Fix grammatical typo w3c/webappsec-csp#712, by @antosart.
-
Add dveditz, ciaramcmullin and qabandi as editors w3c/webappsec-csp#710, by @qabandi.
-
-
2 pull requests merged.
-
[Editorial] Fix grammatical typo w3c/webappsec-csp#712.
-
Resource hint: check directives explicitly w3c/webappsec-csp#637.
-
-
3 pull requests received 5 new comments.
w3c/webappsec-clear-site-data
-
2 issues received 2 new comments.
-
Normative spec doesn't necessarily terminate service workers w3c/webappsec-clear-site-data#54 (1 comment by @LiangTheDev)
w3c/webappsec
-
3 issues opened.
-
CfC to publish WebCryptoAPI2 as a FPWD. w3c/webappsec#672, by @mikewest.
-
CfC to publish SRI2 as a FPWD. w3c/webappsec#671, by @mikewest.
-
Planning 2025-04-16. w3c/webappsec#670, by @mikewest.
-
-
3 issues closed.
-
CfC to publish SRI2 as a FPWD. w3c/webappsec#671.
-
CfC to publish WebCryptoAPI2 as a FPWD. w3c/webappsec#672.
-
Planning 2025-03-19 w3c/webappsec#668.
-
-
5 issues received 7 new comments.
-
1 pull request opened.
-
Add PQC in Web Crypto to the agenda w3c/webappsec#669, by @twiss.
-
-
1 pull request merged.
-
Add PQC in Web Crypto to the agenda w3c/webappsec#669.
-
-
1 pull request closed.
-
Update Navigation Bar Styling and Adding Paragraph Break w3c/webappsec#630.
-
w3c/webappsec-credential-management
-
1 issue opened.
-
unauthorized & redirected w3c/webappsec-credential-management#268, by @VanessArdelle.
-
w3c/webappsec-fetch-metadata
-
1 pull request received 8 new comments.
-
Define `Sec-Fetch-Frame-Ancestors`. w3c/webappsec-fetch-metadata#89 (8 comments by @annevk, @johannhof, @sjledoux)
-
w3c/webappsec-permissions-policy
-
1 issue closed.
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273.
-
-
3 issues received 6 new comments.
-
What is the process for making changes? w3c/webappsec-permissions-policy#561 (3 comments by @annevk, @shhnjk)
-
-
1 pull request received 2 new comments.
-
Update "Is feature enabled in document for origin?" behavior w3c/webappsec-permissions-policy#499 (2 comments by @arichiv, @jkarlin)
-
w3c/permissions
-
1 pull request received 1 new comment.
-
Allow for the query algorithm to return `prompt` or `denied` when document is not `allowed to use` w3c/permissions#458 (1 comment by @aselya)
-
TR publications
-
2 documents published.
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
Participants
-
6 participants joined.
-
thefrog t (Google LLC) joined.
-
Daniel Rubery (Google LLC) joined.
-
Hubert Chao (Google LLC) joined.
-
Mustafa Emre Acer (Google LLC) joined.
-
Ezzudin Alkotob (Meta) joined.
-
Richard Hansen (Meta) joined.
-
GitHub
w3c/webappsec-permissions-policy
-
1 issue opened.
-
What is the process for making changes? w3c/webappsec-permissions-policy#561, by @annevk.
-
-
1 issue closed.
-
W3C ODRL w3c/webappsec-permissions-policy#557.
-
-
2 issues received 3 new comments.
-
Default Powerful Feature Permission w3c/webappsec-permissions-policy#555 (2 comments by @ecki, @Gunni)
-
-
1 pull request opened.
-
Replace `shared-autofill` with `autofill` and `manual-text` w3c/webappsec-permissions-policy#560, by @schwering.
-
-
1 pull request merged.
-
Add allow and src attribute to potential permissions policy violation report w3c/webappsec-permissions-policy#559.
-
-
2 pull requests received 10 new comments.
-
Add allow and src attribute to potential permissions policy violation report w3c/webappsec-permissions-policy#559 (8 comments by @clelland, @shhnjk)
-
Update "Is feature enabled in document for origin?" behavior w3c/webappsec-permissions-policy#499 (2 comments by @jkarlin, @xyaoinum)
-
w3c/webappsec-dbsc
-
3 issues opened.
-
StartSession requests only include cookies with `SameSite=None` w3c/webappsec-dbsc#106, by @frankeld.
-
cookies are not fundamental w3c/webappsec-dbsc#105, by @raymcdermott.
-
Required/optional credential cookie attributes need to be defined w3c/webappsec-dbsc#104, by @sbweeden.
-
-
2 issues received 3 new comments.
-
StartSession requests only include cookies with `SameSite=None` w3c/webappsec-dbsc#106 (2 comments by @drubery, @frankeld)
-
-
6 pull requests opened.
-
Add a note about running "refresh" in deploy.sh instructions w3c/webappsec-dbsc#103, by @thefrog-gh.
-
Add security and privacy questionnaire for DBSC w3c/webappsec-dbsc#102, by @drubery.
-
Clarify comments in deploy.sh w3c/webappsec-dbsc#101, by @thefrog-gh.
-
Let deploy.sh use multiple remotes w3c/webappsec-dbsc#100, by @drubery.
-
Update spec.bs to reflect ED status w3c/webappsec-dbsc#99, by @simoneonofri.
-
Have cookie expiry changes reflected in UI w3c/webappsec-dbsc#98, by @thefrog-gh.
-
-
6 pull requests merged.
-
Add security and privacy questionnaire for DBSC w3c/webappsec-dbsc#102.
-
Add a note about running "refresh" in deploy.sh instructions w3c/webappsec-dbsc#103.
-
Update spec.bs to reflect ED status w3c/webappsec-dbsc#99.
-
Clarify comments in deploy.sh w3c/webappsec-dbsc#101.
-
Have cookie expiry changes reflected in UI w3c/webappsec-dbsc#98.
-
Let deploy.sh use multiple remotes w3c/webappsec-dbsc#100.
-
-
1 pull request closed.
-
Empty commit to test IPR check w3c/webappsec-dbsc#95.
-
-
4 pull requests received 13 new comments.
-
Add security and privacy questionnaire for DBSC w3c/webappsec-dbsc#102 (8 comments by @drubery, @thefrog-gh)
-
Add a note about running "refresh" in deploy.sh instructions w3c/webappsec-dbsc#103 (2 comments by @drubery, @simoneonofri)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Scoping seems all over the place: host vs. origin vs. site vs. domain w3c/webappsec-clear-site-data#87, by @domenic.
-
-
1 issue received 1 new comment.
-
Scoping seems all over the place: host vs. origin vs. site vs. domain w3c/webappsec-clear-site-data#87 (1 comment by @johannhof)
-
w3c/webappsec-csp
-
2 issues opened.
-
"source file" lacks a real defintion w3c/webappsec-csp#707, by @evilpie.
-
2 issues closed.
-
Address Bikeshed warnings w3c/webappsec-csp#446.
-
Assigning `location.href` to a `javascript:...` is a form of eval w3c/webappsec-csp#688.
-
-
7 issues received 14 new comments.
-
Should "Should navigation request of type be blocked by Content Security Policy?" set the violation object's element? w3c/webappsec-csp#687 (4 comments by @annevk, @dveditz, @ghost)
-
connect-src test suite allows multiple non-interopable implementations. w3c/webappsec-csp#706 (2 comments by @annevk, @dveditz)
-
How to specify 2 endpoints for Reporting-Endpoints? w3c/webappsec-csp#701 (2 comments by @ciaramcmullin, @SwiftExtender)
-
Initializing a document's CSP list requires synchronous cross-process access w3c/webappsec-csp#389 (2 comments by @antosart, @bzbarsky)
-
Assigning `location.href` to a `javascript:...` is a form of eval w3c/webappsec-csp#688 (1 comment by @qabandi)
-
-
1 pull request opened.
-
Add Daniel, Ciara and myself as editors w3c/webappsec-csp#709, by @qabandi.
-
-
1 pull request merged.
-
2 pull requests closed.
-
Add Daniel, Ciara and myself as editors w3c/webappsec-csp#709.
-
Use given CSP list in navigation request checking w3c/webappsec-csp#705.
-
-
4 pull requests received 6 new comments.
-
Resource hint: check directives explicitly w3c/webappsec-csp#637 (2 comments by @annevk, @ciaramcmullin)
-
Use "navigation request's policy container's CSP list" instead of "navigation request's client's global object's CSP list" w3c/webappsec-csp#692 (2 comments by @antosart, @domenic)
-
w3c/permissions
-
3 issues opened.
-
Add `audio` permission state w3c/permissions#461, by @nums.
-
Proposed Testing Plan for Geolocation Permission w3c/permissions#460, by @marcoscaceres.
-
Aspects and integration with Permissions Policy w3c/permissions#459, by @antosart.
-
-
1 issue received 1 new comment.
-
2 pull requests received 7 new comments.
-
Allow for the query algorithm to return `prompt` or `denied` when document is not `allowed to use` w3c/permissions#458 (5 comments by @aselya, @johannhof, @marcoscaceres)
-
w3c/trusted-types
-
2 issues opened.
-
[meta] The build currently fails w3c/trusted-types#582, by @lukewarlow.
-
CSP syntax for `require-trusted-types-for` should be forgiving w3c/trusted-types#580, by @lukewarlow.
-
-
2 issues received 3 new comments.
-
Finalise spec mechanism for event handlers w3c/trusted-types#520 (2 comments by @annevk, @fred-wang)
-
`createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names w3c/trusted-types#504 (1 comment by @fred-wang)
-
-
3 pull requests opened.
-
Add SVGScriptElement handling to the spec w3c/trusted-types#581, by @lukewarlow.
-
Change Script Enforcement Mechanism to use flags w3c/trusted-types#579, by @lukewarlow.
-
Ensure element's namespace is HTML, SVG or MathML before covering eve… w3c/trusted-types#578, by @lukewarlow.
-
-
3 pull requests received 12 new comments.
-
Ensure element's namespace is HTML, SVG or MathML before covering eve… w3c/trusted-types#578 (4 comments by @annevk, @fred-wang)
-
Change Script Enforcement Mechanism to use flags w3c/trusted-types#579 (4 comments by @annevk, @lukewarlow)
-
w3c/webappsec
-
1 issue opened.
-
Planning 2025-03-19 w3c/webappsec#668, by @mikewest.
-
-
1 issue closed.
-
Planning 2025-02-19 w3c/webappsec#666.
-
-
2 issues received 11 new comments.
-
Planning 2025-02-19 w3c/webappsec#666 (8 comments by @beurdouche, @christhompson, @mikewest, @qabandi, @yoavweiss)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Dynamic resource integrity w3c/webappsec-subresource-integrity#128, by @vincentkelleher.
-
-
1 issue closed.
-
Dynamic resource integrity w3c/webappsec-subresource-integrity#128.
-
-
1 issue received 2 new comments.
-
Dynamic resource integrity w3c/webappsec-subresource-integrity#128 (2 comments by @mikewest, @vincentkelleher)
-
-
3 pull requests opened.
-
Describe the integration with `link` headers. w3c/webappsec-subresource-integrity#131, by @mikewest.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-subresource-integrity#130, by @deniak.
-
Revive require-sri-for for scripts w3c/webappsec-subresource-integrity#129, by @yoavweiss.
-
-
2 pull requests merged.
-
Describe the integration with `link` headers. w3c/webappsec-subresource-integrity#131.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-subresource-integrity#130.
-
-
3 pull requests received 21 new comments.
-
Revive require-sri-for for scripts w3c/webappsec-subresource-integrity#129 (18 comments by @annevk, @mikewest, @mozfreddyb, @yoavweiss)
-
Describe the integration with `link` headers. w3c/webappsec-subresource-integrity#131 (2 comments by @annevk, @mikewest)
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-subresource-integrity#130 (1 comment by @mozfreddyb)
-
w3c/webappsec-referrer-policy
-
2 issues received 2 new comments.
-
Add Referrer-Policy no-referrer-when-cross-origin w3c/webappsec-referrer-policy#167 (1 comment by @tats-u)
-
Add additional security and privacy controls for referrer policies w3c/webappsec-referrer-policy#174 (1 comment by @petamoriken)
-
w3c/webcrypto
-
1 issue received 1 new comment.
w3c/webappsec-fetch-metadata
-
1 pull request opened.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-fetch-metadata#92, by @deniak.
-
-
1 pull request received 7 new comments.
-
Define `Sec-Fetch-Frame-Ancestors`. w3c/webappsec-fetch-metadata#89 (7 comments by @annevk, @bvandersloot-mozilla, @ddworken, @sjledoux)
-
w3c/webappsec-upgrade-insecure-requests
-
1 pull request opened.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-upgrade-insecure-requests#36, by @deniak.
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Admiral Fx Street w3c/webappsec-secure-contexts#110, by @Gregtechmails.
-
-
1 issue closed.
-
Admiral Fx Street w3c/webappsec-secure-contexts#110.
-
-
1 pull request opened.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-secure-contexts#111, by @deniak.
-
w3c/webappsec-passkey-endpoints
-
1 pull request opened.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-passkey-endpoints#7, by @deniak.
-
w3c/webappsec-mixed-content
-
1 pull request opened.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-mixed-content#74, by @deniak.
-
w3c/webappsec-change-password-url
-
1 pull request opened.
-
GitHub actions: replace ubuntu-20.04 with ubuntu-latest w3c/webappsec-change-password-url#49, by @deniak.
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Missing interfaces size check when creating a credential w3c/webappsec-credential-management#267, by @devgianlu.
-
TR publications
-
3 documents published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Past meetings
-
1 meeting.
Participants
-
1 participant left.
-
Alexey Proskuryakov (Apple Inc.) left.
-
GitHub
w3c/webappsec-fetch-metadata
-
1 pull request received 8 new comments.
-
Define `Sec-Fetch-Frame-Ancestors`. w3c/webappsec-fetch-metadata#89 (8 comments by @annevk, @bvandersloot-mozilla, @ddworken, @johannhof, @sjledoux)
-
w3c/webappsec-permissions-policy
-
1 issue closed.
-
Replace references to the "sync-xhr" policy-controlled feature w3c/webappsec-permissions-policy#419.
-
-
6 issues received 14 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (9 comments by @0xVavaldi, @abjugard, @ewanm89, @Gunni, @PeteX, @vphantom)
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (1 comment by @jkarlin)
-
Deny all like alias for the Permission-Policy: Header w3c/webappsec-permissions-policy#483 (1 comment by @nekromoff)
-
-
2 pull requests opened.
-
Add allow and src attribute to potential permissions policy violation report w3c/webappsec-permissions-policy#559, by @shhnjk.
-
Add `ch-ua-high-entropy-values` feature w3c/webappsec-permissions-policy#558, by @miketaylr.
-
-
1 pull request merged.
-
Add `ch-ua-high-entropy-values` feature w3c/webappsec-permissions-policy#558.
-
-
1 pull request received 2 new comments.
-
Add `ch-ua-high-entropy-values` feature w3c/webappsec-permissions-policy#558 (2 comments by @clelland, @miketaylr)
-
w3c/webappsec-dbsc
-
2 issues opened.
-
How to trigger Refresh request from browser ? w3c/webappsec-dbsc#88, by @Jxck.
-
Current Status of Origin Trials and Timeline w3c/webappsec-dbsc#87, by @Jxck.
-
-
2 issues closed.
-
How to trigger Refresh request from browser ? w3c/webappsec-dbsc#88.
-
Current Status of Origin Trials and Timeline w3c/webappsec-dbsc#87.
-
-
2 issues received 4 new comments.
-
9 pull requests opened.
-
Update description of Secure Contexts w3c/webappsec-dbsc#97, by @drubery.
-
Add challenges to Glitch server w3c/webappsec-dbsc#96, by @drubery.
-
Empty commit to test IPR check w3c/webappsec-dbsc#95, by @drubery.
-
Glitch server improvement w3c/webappsec-dbsc#94, by @drubery.
-
Fix Glitch table headers w3c/webappsec-dbsc#93, by @drubery.
-
Update self-link in spec w3c/webappsec-dbsc#92, by @drubery.
-
Remove an extra parentheses w3c/webappsec-dbsc#91, by @deanyxu.
-
Add note about secure contexts w3c/webappsec-dbsc#90, by @drubery.
-
Fix a few typos in README.md w3c/webappsec-dbsc#89, by @thefrog-gh.
-
-
7 pull requests merged.
-
Update description of Secure Contexts w3c/webappsec-dbsc#97.
-
Add challenges to Glitch server w3c/webappsec-dbsc#96.
-
Glitch server improvement w3c/webappsec-dbsc#94.
-
Update self-link in spec w3c/webappsec-dbsc#92.
-
Remove an extra parentheses w3c/webappsec-dbsc#91.
-
Add note about secure contexts w3c/webappsec-dbsc#90.
-
Fix a few typos in README.md w3c/webappsec-dbsc#89.
-
-
1 pull request closed.
-
Fix Glitch table headers w3c/webappsec-dbsc#93.
-
-
3 pull requests received 7 new comments.
w3c/webappsec-csp
-
3 issues opened.
-
connect-src test suite allows multiple non-interopable implementations. w3c/webappsec-csp#706, by @lukewarlow.
-
Clipping of violation’s sample to the 40 first characters w3c/webappsec-csp#704, by @fred-wang.
-
How to specify 2 endpoints for Reporting-Endpoints? w3c/webappsec-csp#701, by @SwiftExtender.
-
-
2 issues closed.
-
`javascript:` navigation directive-name is always null w3c/webappsec-csp#427.
-
Hashes bypass source-based allowlisting only on pre-request, not on post-request w3c/webappsec-csp#523.
-
-
5 issues received 11 new comments.
-
Hashes bypass source-based allowlisting only on pre-request, not on post-request w3c/webappsec-csp#523 (3 comments by @antosart, @ciaramcmullin, @dveditz)
-
Clipping of violation’s sample to the 40 first characters w3c/webappsec-csp#704 (2 comments by @fred-wang, @lukewarlow)
-
Prevent CSP reports being sent if I handle the SecurityPolicyViolation event. w3c/webappsec-csp#255 (2 comments by @jeffemandel)
-
3 pull requests opened.
-
Use given CSP list in navigation request checking w3c/webappsec-csp#705, by @domenic.
-
Fix reference to global's document w3c/webappsec-csp#703, by @antosart.
-
Change x-frame-options obsoletes wording w3c/webappsec-csp#702, by @tunetheweb.
-
-
3 pull requests merged.
-
Change x-frame-options obsoletes wording w3c/webappsec-csp#702.
-
Fix reference to global's document w3c/webappsec-csp#703.
-
Add `trusted-types-eval` source expression for `script-src` w3c/webappsec-csp#665.
-
-
2 pull requests closed.
-
Use correct set of source expressions in script directives pre-request check w3c/webappsec-csp#424.
-
Clarify that integrity metadata must be non-empty w3c/webappsec-csp#425.
-
-
8 pull requests received 17 new comments.
-
Use the duplicate attribute flag is nonceable check w3c/webappsec-csp#377 (3 comments by @annevk, @dveditz, @evilpie)
-
Use "navigation request's policy container's CSP list" instead of "navigation request's client's global object's CSP list" w3c/webappsec-csp#692 (2 comments by @ciaramcmullin, @domenic)
-
Change x-frame-options obsoletes wording w3c/webappsec-csp#702 (2 comments by @antosart, @tunetheweb)
-
Add `trusted-types-eval` source expression for `script-src` w3c/webappsec-csp#665 (2 comments by @lukewarlow)
-
Use correct set of source expressions in script directives pre-request check w3c/webappsec-csp#424 (1 comment by @ciaramcmullin)
-
Clarify that integrity metadata must be non-empty w3c/webappsec-csp#425 (1 comment by @ciaramcmullin)
w3c/webappsec
-
3 issues opened.
-
Planning 2025-02-19 w3c/webappsec#666, by @mikewest.
-
Planning 2025-01-15 w3c/webappsec#665, by @mikewest.
-
Provide clear guidelines for what `Timing-Allow-Origin` should expose w3c/webappsec#664, by @noamr.
-
-
1 issue closed.
-
Planning 2025-01-15 w3c/webappsec#665.
-
-
2 issues received 10 new comments.
-
Provide clear guidelines for what `Timing-Allow-Origin` should expose w3c/webappsec#664 (8 comments by @annevk, @arturjanc, @noamr)
-
-
1 pull request opened.
-
Update 2025-01-15-agenda.md w3c/webappsec#667, by @lukewarlow.
-
-
1 pull request merged.
-
Update 2025-01-15-agenda.md w3c/webappsec#667.
-
w3c/permissions
-
1 issue received 1 new comment.
-
1 pull request opened.
-
1 pull request received 1 new comment.
-
Allow for the query algorithm to return `prompt` or `denied` when document is not `allowed to use` w3c/permissions#458 (1 comment by @miketaylr)
-
w3c/webcrypto
-
2 issues opened.
-
Unclear whether key valiation should be performed on import w3c/webcrypto#399, by @devgianlu.
-
Question: Support for OS-Native Keyring Integration in Browsers w3c/webcrypto#398, by @filip26.
-
-
2 issues closed.
-
Question: Support for OS-Native Keyring Integration in Browsers w3c/webcrypto#398.
-
-
4 issues received 8 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (4 comments by @bencmbrook, @davidben, @robmv, @vlovich)
-
Question: Support for OS-Native Keyring Integration in Browsers w3c/webcrypto#398 (2 comments by @filip26, @twiss)
-
Add `raw-private` (and possibly `raw-public` and `raw-secret`) key formats? w3c/webcrypto#393 (1 comment by @steveluscher)
-
-
3 pull requests opened.
-
Refer to byte/bit sequences instead of octet/bit strings w3c/webcrypto#397, by @twiss.
-
Remove superfluous copying w3c/webcrypto#396, by @twiss.
-
Use WebIDL's operations on `ArrayBufferView`s in `getRandomValues` w3c/webcrypto#395, by @twiss.
-
-
3 pull requests merged.
-
Refer to byte/bit sequences instead of octet/bit strings w3c/webcrypto#397.
-
Remove superfluous copying w3c/webcrypto#396.
-
Use WebIDL's operations on `ArrayBufferView`s in `getRandomValues` w3c/webcrypto#395.
-
-
4 pull requests received 14 new comments.
-
Accept (async) iterables in `crypto.subtle.digest` w3c/webcrypto#390 (6 comments by @annevk, @jasnell, @twiss)
-
Allow using Crypto.getRandomValues() in Shadow Realms w3c/webcrypto#361 (4 comments by @ptomato, @twiss)
-
Refer to byte/bit sequences instead of octet/bit strings w3c/webcrypto#397 (3 comments by @annevk, @twiss)
-
Throw in AES-CBC decrypt operation for odd ciphertext lengths w3c/webcrypto#382 (1 comment by @BenWiederhake)
-
w3c/trusted-types
-
6 issues opened.
-
Clipping of violation’s sample to the 40 first characters w3c/trusted-types#577, by @fred-wang.
-
Improve/Rewrite tests checking for CSP violations w3c/trusted-types#576, by @fred-wang.
-
Add test for policies with disposition=report in workers w3c/trusted-types#575, by @fred-wang.
-
Add tests for "Should Trusted Type policy creation be blocked by Content Security Policy" in workers w3c/trusted-types#574, by @fred-wang.
-
Add test for event handler content attribute handling for false positive event handler attributes w3c/trusted-types#573, by @lukewarlow.
-
What shoud script element's textContent's sink string be? w3c/trusted-types#572, by @ghost.
-
-
6 issues closed.
-
Improve test coverage of sink values w3c/trusted-types#494.
-
Examine tests which are commented out in <GlobalEventHandlers-onclick.html> w3c/trusted-types#571.
-
What shoud script element's textContent's sink string be? w3c/trusted-types#572.
-
Add tests for `setAttribute`/`setAttributeNS`'s sink names w3c/trusted-types#570.
-
Add tests for setInterval()/setTimeout() called from WorkerGlobalScope w3c/trusted-types#568.
-
9 issues received 26 new comments.
-
What shoud script element's textContent's sink string be? w3c/trusted-types#572 (7 comments by @evilpie, @fred-wang, @lukewarlow)
-
Finalise spec mechanism for event handlers w3c/trusted-types#520 (3 comments by @annevk, @fred-wang)
-
Examine tests which are commented out in <GlobalEventHandlers-onclick.html> w3c/trusted-types#571 (3 comments by @fred-wang, @lukewarlow)
-
mXSS: should `createHTML` get information about the context? w3c/trusted-types#569 (1 comment by @annevk)
-
Add test for policies with disposition=report in workers w3c/trusted-types#575 (1 comment by @fred-wang)
-
Add tests for worker constructors called from worker global scope w3c/trusted-types#567 (1 comment by @fred-wang)
-
Add tests for setInterval()/setTimeout() called from WorkerGlobalScope w3c/trusted-types#568 (1 comment by @fred-wang)
-
Add tests for `setAttribute`/`setAttributeNS`'s sink names w3c/trusted-types#570 (1 comment by @fred-wang)
-
1 pull request merged.
-
Add an |includeReportOnlyPolicies| boolean argument to Does sink type require trusted types? w3c/trusted-types#518.
-
-
1 pull request received 2 new comments.
-
Add an |includeReportOnlyPolicies| boolean argument to Does sink type require trusted types? w3c/trusted-types#518 (2 comments by @lukewarlow)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
iTunes.com w3c/webappsec-secure-contexts#108, by @Lawd-STAR.
-
-
2 issues closed.
-
iTunes.com w3c/webappsec-secure-contexts#108.
-
Convoluted blob: URL issue w3c/webappsec-secure-contexts#71.
-
-
1 issue received 1 new comment.
w3c/webappsec-cowl
-
1 issue closed.
-
Mark spec as no longer being worked on? And archive this repo? w3c/webappsec-cowl#81.
-
w3c/webappsec-uisecurity
-
1 issue closed.
-
Mark spec as no longer being worked on? And archive this repo? w3c/webappsec-uisecurity#15.
-
w3c/webappsec-cors-for-developers
-
1 issue closed.
-
Mark document as no longer being worked on? And archive this repo? w3c/webappsec-cors-for-developers#11.
-
w3c/webappsec-clear-site-data
-
1 issue closed.
-
Status of Clear-Site-Data spec? Implementor interest? w3c/webappsec-clear-site-data#71.
-
-
1 issue received 1 new comment.
w3c/webappsec-cspee
-
1 issue closed.
-
Status of CSPEE spec? Implementor interest? w3c/webappsec-cspee#19.
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Mixed Content iframes on localhost w3c/webappsec-mixed-content#73, by @mozfreddyb.
-
-
1 issue received 3 new comments.
-
Mixed Content iframes on localhost w3c/webappsec-mixed-content#73 (3 comments by @annevk, @mikewest)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Query regarding #upgrade-request w3c/webappsec-upgrade-insecure-requests#35, by @shubhamg13.
-
-
1 issue received 2 new comments.
-
Query regarding #upgrade-request w3c/webappsec-upgrade-insecure-requests#35 (2 comments by @annevk, @shubhamg13)
-