Web Application Security Working Group - Activity in 2026
No matches.
TR publications
-
1 document published.
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Participants
-
1 participant joined.
-
Artiom Casapu (Google LLC) joined.
-
GitHub
w3c/webappsec
-
1 issue opened.
-
DM Network business information w3c/webappsec#711, by @dinsovannpanha80-png.
-
-
1 issue closed.
-
DM Network business information w3c/webappsec#711.
-
-
1 issue received 21 new comments.
-
Planning TPAC 2026 w3c/webappsec#709 (21 comments by @annevk, @antosart, @arnar, @arturjanc, @azaika, @camillelamy, @DCtheTall, @decleezy, @hubertchao, @johannhof, @marcoscaceres, @MayyaSunil, @miketaylr, @mikewest, @mozfreddyb, @noamr, @torgo, @vickiez, @yoavweiss)
-
w3c/webappsec-cspee
-
1 pull request received 4 new comments.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36 (4 comments by @antosart, @koto, @vickiez)
-
w3c/webappsec-csp
-
1 issue opened.
-
1 issue received 3 new comments.
-
`'strict-dynamic'` might be bypassed with `<link rel=modulepreload>` w3c/webappsec-csp#823 (3 comments by @annevk, @camillelamy, @roberto-apple)
-
w3c/trusted-types
-
2 issues opened.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618, by @hybrist.
-
[meta] What's left to do before everything is upstreamed? w3c/trusted-types#617, by @lukewarlow.
-
-
3 issues closed.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618.
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615.
-
-
3 issues received 4 new comments.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618 (2 comments by @hybrist, @lukewarlow)
-
[meta] What's left to do before everything is upstreamed? w3c/trusted-types#617 (1 comment by @lukewarlow)
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605 (1 comment by @lukewarlow)
-
-
2 pull requests merged.
-
Add new update script trustedness algorithm for the HTML spec to call w3c/trusted-types#607.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606.
-
-
1 pull request received 4 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (4 comments by @annevk, @noamr, @zcorpan)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Example 3. is misleading (applies only to direct children and not all descendant navigables) w3c/webappsec-permissions-policy#599, by @antosart.
-
-
2 issues received 2 new comments.
-
Example 3. is misleading (applies only to direct children and not all descendant navigables) w3c/webappsec-permissions-policy#599 (1 comment by @antosart)
-
-
6 pull requests opened.
-
Remove the script introspection API w3c/webappsec-permissions-policy#600, by @marcoscaceres.
-
Replace the allow attribute grammar with prose author requirements w3c/webappsec-permissions-policy#598, by @marcoscaceres.
-
Ignore blob URLs and URLs with credentials in the iframe allow attribute w3c/webappsec-permissions-policy#597, by @marcoscaceres.
-
Match feature names case-sensitively w3c/webappsec-permissions-policy#596, by @marcoscaceres.
-
Ignore wildcard hosts in the iframe allow attribute w3c/webappsec-permissions-policy#595, by @marcoscaceres.
-
Keep the first entry when the allow attribute names a feature twice w3c/webappsec-permissions-policy#594, by @marcoscaceres.
-
-
1 pull request received 4 new comments.
-
Rename PermissionsPolicy interface back to FeaturePolicy w3c/webappsec-permissions-policy#582 (4 comments by @annevk, @marcoscaceres)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Registration request still requires an Authorization header that has been removed w3c/webappsec-dbsc#269, by @Sam-Hobson.
-
w3c/permissions
-
1 issue opened.
-
"Set a permission" matches targets against |key| instead of |target key| w3c/permissions#481, by @marcoscaceres.
-
-
1 pull request opened.
-
Add permission overrides and a selection field to permissions.setPermission w3c/permissions#482, by @marcoscaceres.
-
-
1 pull request received 1 new comment.
-
Add permission overrides and a selection field to permissions.setPermission w3c/permissions#482 (1 comment by @antosart)
-
w3c/webappsec-credential-management
-
1 pull request opened.
-
Add CredentialUiMode/passive in support of Conditional UI without Autofill w3c/webappsec-credential-management#307, by @kenrb.
-
-
1 pull request received 1 new comment.
-
Add CredentialUiMode/passive in support of Conditional UI without Autofill w3c/webappsec-credential-management#307 (1 comment by @nsatragno)
-
w3c/webcrypto
-
1 issue received 1 new comment.
-
Consider dropping the secure context requirement for `randomUUID()` w3c/webcrypto#408 (1 comment by @gwillen)
-
TR publications
-
5 documents published.
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Participants
-
2 participants joined.
-
Viktoria Zlatinova (Microsoft Corporation) joined.
-
Alfie Fresta (Meta) joined.
-
-
3 participants left.
-
Kaushik Satpathy (Yahoo Holdings Inc.) left.
-
Uday Bhaskar Seelamantula (Autodesk) left.
-
Mert Coskuner (Yahoo Holdings Inc.) left.
-
-
1 organization joined.
-
WebDINO Japan joined.
-
-
2 organizations left.
-
Autodesk left.
-
Yahoo Holdings Inc. left.
-
GitHub
w3c/webappsec
-
2 issues opened.
-
Planning 2026-10-21 w3c/webappsec#710, by @dveditz.
-
Planning TPAC 2026 w3c/webappsec#709, by @dveditz.
-
-
2 issues received 5 new comments.
w3c/trusted-types
-
1 issue opened.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615, by @noamr.
-
-
1 issue received 18 new comments.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615 (18 comments by @annevk, @lukewarlow, @mozfreddyb, @noamr, @zcorpan)
-
-
1 pull request opened.
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616, by @zcorpan.
-
-
1 pull request merged.
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616.
-
-
1 pull request reopened.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606, by @noamr.
-
-
3 pull requests received 35 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (32 comments by @annevk, @evilpie, @noamr, @zcorpan)
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616 (2 comments by @zcorpan)
-
Add new update script trustedness algorithm for the HTML spec to call w3c/trusted-types#607 (1 comment by @lukewarlow)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Add further necessary text to the “Navigation through history” bulleted item in “Directly User-Initiated Requests” w3c/webappsec-fetch-metadata#100, by @sideshowbarker.
-
-
1 pull request opened.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99, by @TimvdLippe.
-
-
1 pull request merged.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99.
-
-
1 pull request received 4 new comments.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99 (4 comments by @annevk, @mikewest, @TimvdLippe, @w3cbot)
-
w3c/webcrypto
-
1 issue opened.
-
ECDSA normalization: repeated name getters and transfer-test expectations w3c/webcrypto#563, by @afflom.
-
-
1 issue received 1 new comment.
-
ECDSA normalization: repeated name getters and transfer-test expectations w3c/webcrypto#563 (1 comment by @twiss)
-
-
1 pull request opened.
-
Add randomUUIDv7() method (RFC 9562) w3c/webcrypto#562, by @gianluca-pettenon.
-
-
1 pull request received 1 new comment.
w3c/webappsec-secure-contexts
-
3 issues opened.
-
Taking wats Mys 💯 w3c/webappsec-secure-contexts#120, by @odiged8-hash.
-
chamchamal w3c/webappsec-secure-contexts#119, by @sherkoaziz8-eng.
-
Secure contexts non-normative introduction w3c/webappsec-secure-contexts#118, by @wbamberg.
-
-
2 issues closed.
-
chamchamal w3c/webappsec-secure-contexts#119.
-
Taking wats Mys 💯 w3c/webappsec-secure-contexts#120.
-
w3c/webappsec-permissions-policy
-
4 issues received 20 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (16 comments by @Dreamsorcerer, @ecki, @Gunni, @jvoisin, @RealAlphabet)
-
Proposal: allow grouping permissions by year w3c/webappsec-permissions-policy#481 (2 comments by @IchordeDionysos)
-
How to format report-to directives? w3c/webappsec-permissions-policy#577 (1 comment by @IchordeDionysos)
-
-
2 pull requests opened.
-
Update Owners w3c/webappsec-permissions-policy#593, by @arichiv.
-
Link Structured Fields token and parse report-to parameter as token w3c/webappsec-permissions-policy#592, by @apasel422.
-
-
2 pull requests merged.
-
Update Owners w3c/webappsec-permissions-policy#593.
-
Link Structured Fields token and parse report-to parameter as token w3c/webappsec-permissions-policy#592.
-
-
1 pull request received 1 new comment.
w3c/permissions
-
1 issue opened.
w3c/webappsec-csp
-
1 issue opened.
-
`'strict-dynamic'` might be bypassed with `<link rel=modulepreload>` w3c/webappsec-csp#823, by @lebr0nli.
-
-
1 issue closed.
-
CSP script-src self and blobs w3c/webappsec-csp#487.
-
-
2 pull requests merged.
-
Update nonceable attribute checks for link elements w3c/webappsec-csp#810.
-
Handle blob scheme when matching 'self' w3c/webappsec-csp#821.
-
-
2 pull requests received 5 new comments.
-
Update nonceable attribute checks for link elements w3c/webappsec-csp#810 (3 comments by @annevk, @evilpie, @mikewest)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172, by @kyle-elliott-tob.
-
-
1 issue closed.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172.
-
-
1 issue received 1 new comment.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172 (1 comment by @kyle-elliott-tob)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Implementation report: dbsc-server (TypeScript server library for Node, Bun, Deno) w3c/webappsec-dbsc#267, by @enda-kelly.
-
-
1 pull request opened.
-
Derive .well-known URLs strictly from canonical origins w3c/webappsec-dbsc#268, by @alhijazi.
-
-
1 pull request merged.
-
Derive .well-known URLs strictly from canonical origins w3c/webappsec-dbsc#268.
-
w3c/webappsec-cspee
-
1 pull request received 1 new comment.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36 (1 comment by @vickiez)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Permissions Policy rejection in "Request a `Credential`" leaves the credential type active w3c/webappsec-credential-management#305, by @marcoscaceres.
-
-
1 pull request opened.
-
Validate every requested credential type before marking any of them active w3c/webappsec-credential-management#306, by @marcoscaceres.
-
-
1 pull request merged.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304.
-
-
1 pull request received 4 new comments.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304 (4 comments by @marcoscaceres, @mohamedamir)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 30 October 2026.
-
TR publications
-
1 document published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
GitHub
w3c/trusted-types
-
3 issues opened.
-
Define a non-writeable non-configurable own `.toString()` on the `Trusted*` objects w3c/trusted-types#613, by @nicolo-ribaudo.
-
`createHTML` in conjunction with XML documents is a bit broken w3c/trusted-types#612, by @noamr.
-
1 issue closed.
-
3 issues received 6 new comments.
-
mXSS: should `createHTML` get information about the context? w3c/trusted-types#569 (3 comments by @annevk, @noamr)
-
Define a non-writeable non-configurable own `.toString()` on the `Trusted*` objects w3c/trusted-types#613 (2 comments by @annevk, @lukewarlow)
-
What is the value of all this, if the web is unsafe by default and safety is opt-in? Why not invert this logic? w3c/trusted-types#614 (1 comment by @lukewarlow)
-
-
1 pull request received 23 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (23 comments by @annevk, @noamr, @zcorpan)
-
w3c/webappsec-permissions-policy
-
3 issues opened.
-
API naming w3c/webappsec-permissions-policy#591, by @simon-friedberger.
-
Kita2 w3c/webappsec-permissions-policy#589, by @matrawybarte-lgtm.
-
Kita w3c/webappsec-permissions-policy#588, by @matrawybarte-lgtm.
-
-
3 issues closed.
-
API naming w3c/webappsec-permissions-policy#591.
-
Kita2 w3c/webappsec-permissions-policy#589.
-
Kita w3c/webappsec-permissions-policy#588.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Add 'haptics' feature link to features.md w3c/webappsec-permissions-policy#590, by @kyerebo.
-
w3c/webappsec-csp
-
2 issues opened.
-
Enhancing import map handling under CSP without `script-src 'unsafe-inline'` in effect w3c/webappsec-csp#822, by @jnsttl.
-
-
1 issue received 1 new comment.
-
2 pull requests opened.
-
Handle blob scheme when matching 'self' w3c/webappsec-csp#821, by @TimvdLippe.
-
Remove redundant TrustedScript data checks from CSP algorithm w3c/webappsec-csp#818, by @Lochipi.
-
-
1 pull request merged.
-
Remove redundant TrustedScript data checks from CSP algorithm w3c/webappsec-csp#818.
-
-
1 pull request closed.
-
Integrate with speculation rules w3c/webappsec-csp#776.
-
-
3 pull requests received 23 new comments.
-
Remove redundant TrustedScript data checks from CSP algorithm w3c/webappsec-csp#818 (14 comments by @antosart, @Lochipi, @lukewarlow, @nicolo-ribaudo)
-
Integrate with speculation rules w3c/webappsec-csp#808 (8 comments by @antosart, @hiroshige-g, @tunetheweb, @vickiez)
-
w3c/webcrypto
-
2 issues opened.
-
Proposal: `randomUUIDv7()` w3c/webcrypto#561, by @htunnicliff.
-
-
1 issue closed.
-
Consider not truncating lengths and instead [EnforceRange]? w3c/webcrypto#429.
-
-
2 issues received 11 new comments.
-
ECDH deriveBits: step 5's OperationError precedes the curve-mismatch check, but no browser does that w3c/webcrypto#560 (3 comments by @annevk, @panva)
-
3 pull requests opened.
-
Remove required and [EnforceRange] attributes from readonly dictionaries w3c/webcrypto#559, by @twiss.
-
Improve algorithm steps for Modern Algorithms' supports() method w3c/webcrypto#558, by @panva.
-
Normalize usage list in generateKey operations w3c/webcrypto#557, by @kkoyung.
-
-
3 pull requests merged.
-
Improve algorithm steps for Modern Algorithms' supports() method w3c/webcrypto#558.
-
Add [EnforceRange] instead of truncating lengths w3c/webcrypto#555.
-
Normalize usage list in generateKey operations w3c/webcrypto#557.
-
-
5 pull requests received 28 new comments.
-
Improve algorithm steps for Modern Algorithms' supports() method w3c/webcrypto#558 (20 comments by @panva, @twiss)
-
Remove required and [EnforceRange] attributes from readonly dictionaries w3c/webcrypto#559 (1 comment by @twiss)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
DBSC registration latency w3c/webappsec-dbsc#265, by @akhilsingh111.
-
-
1 pull request opened.
-
Specify SHA-256 as the JWK Thumbprint hashing algorithm. w3c/webappsec-dbsc#266, by @sbovet-g.
-
-
1 pull request merged.
-
Specify SHA-256 as the JWK Thumbprint hashing algorithm. w3c/webappsec-dbsc#266.
-
-
1 pull request received 1 new comment.
-
Specify SHA-256 as the JWK Thumbprint hashing algorithm. w3c/webappsec-dbsc#266 (1 comment by @drubery)
-
w3c/webappsec-cspee
-
1 pull request opened.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36, by @vickiez.
-
-
1 pull request received 3 new comments.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36 (3 comments by @antosart, @vickiez)
-
w3c/webappsec-credential-management
-
1 pull request received 1 new comment.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304 (1 comment by @marcoscaceres)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
qqq w3c/webappsec-secure-contexts#117, by @vitalijhladun.
-
-
1 issue closed.
-
qqq w3c/webappsec-secure-contexts#117.
-
TR publications
-
2 documents published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Eli Grey (W3C Invited Experts) joined.
-
-
1 participant left.
-
Francois Marier (Brave Software Inc.) left.
-
-
1 organization left.
-
MITRE Corporation left.
-
GitHub
w3c/webappsec-csp
-
1 pull request opened.
-
Editorial: Improve clarity of EnsureCSPDoesNotBlockStringCompilation w3c/webappsec-csp#817, by @lukewarlow.
-
-
1 pull request merged.
-
Editorial: Improve clarity of EnsureCSPDoesNotBlockStringCompilation w3c/webappsec-csp#817.
-
-
1 pull request received 1 new comment.
w3c/webappsec-credential-management
-
3 pull requests opened.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304, by @marcoscaceres.
-
Update requestor contact for digital-credential w3c/webappsec-credential-management#303, by @mohamedamir.
-
Add digital-credentials-create permission policy w3c/webappsec-credential-management#302, by @mohamedamir.
-
-
2 pull requests merged.
-
Update requestor contact for digital-credential w3c/webappsec-credential-management#303.
-
Add digital-credentials-create permission policy w3c/webappsec-credential-management#302.
-
-
1 pull request closed.
-
Make order of checking abort signal in "create algorithm" match "request algorithm" w3c/webappsec-credential-management#264.
-
w3c/webappsec
-
2 issues opened.
-
Mạng di động w3c/webappsec#708, by @xatrungtuyen2001-cloud.
-
Fetch Metadata should clarify what to set for externally supplied URLs w3c/webappsec#706, by @simon-friedberger.
-
-
2 issues closed.
-
Mạng di động w3c/webappsec#708.
-
CfC to proceed with WebAppSec charter refinement < 2026-07-03 w3c/webappsec#705.
-
-
2 issues received 3 new comments.
-
CfC to proceed with WebAppSec charter refinement < 2026-07-03 w3c/webappsec#705 (2 comments by @simoneonofri)
-
w3c/webappsec-dbsc
-
3 issues opened.
-
Ignore DBSC headers on connections with active TLS certificate errors w3c/webappsec-dbsc#264, by @alexilin92.
-
SSO cross-site navigation blocked: allowed_refresh_initiators scaling limitations and privacy concerns w3c/webappsec-dbsc#263, by @joostdebruijn.
-
§8.8: a 3xx refresh response leaves deferred requests deferred forever w3c/webappsec-dbsc#262, by @ScottHelme.
-
-
2 issues closed.
-
§8.8: a 3xx refresh response leaves deferred requests deferred forever w3c/webappsec-dbsc#262.
-
2 issues received 7 new comments.
-
§8.8: a 3xx refresh response leaves deferred requests deferred forever w3c/webappsec-dbsc#262 (4 comments by @drubery, @ScottHelme)
-
SSO cross-site navigation blocked: allowed_refresh_initiators scaling limitations and privacy concerns w3c/webappsec-dbsc#263 (3 comments by @drubery, @joostdebruijn)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Rename Document w3c/webappsec-permissions-policy#587, by @riannella.
-
-
3 issues received 11 new comments.
-
Feature-Policy and Workers w3c/webappsec-permissions-policy#207 (6 comments by @annevk, @antosart, @domfarolino)
-
-
1 pull request received 1 new comment.
w3c/trusted-types
-
1 issue opened.
-
https://developer.chrome.com/blog/new-in-devtools-89/#trusted-types w3c/trusted-types#611, by @vasanthselvamg-cell.
-
-
1 issue closed.
-
https://developer.chrome.com/blog/new-in-devtools-89/#trusted-types w3c/trusted-types#611.
-
-
1 pull request received 15 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (15 comments by @lukewarlow, @noamr)
-
w3c/permissions
-
1 issue opened.
-
Rename document w3c/permissions#478, by @riannella.
-
-
1 issue received 10 new comments.
-
Rename document w3c/permissions#478 (10 comments by @annevk, @marcoscaceres, @miketaylr, @riannella)
-
w3c/webappsec-referrer-policy
-
1 pull request closed.
-
Omit referrers on cross-origin requests from an .onion address w3c/webappsec-referrer-policy#156.
-
w3c/permissions-registry
-
1 issue opened.
-
Rename Registry w3c/permissions-registry#27, by @riannella.
-
-
1 issue received 2 new comments.
w3c/webcrypto
-
1 pull request received 11 new comments.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
smooth deployment w3c/webappsec-subresource-integrity#171, by @NexusEnt86.
-
-
1 issue closed.
-
smooth deployment w3c/webappsec-subresource-integrity#171.
-
-
1 issue received 1 new comment.
TR publications
-
2 documents published.
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Past meetings
-
1 meeting.
Participants
-
4 participants left.
-
Maitane Zotes Resines (Client side development Inc) left.
-
Cody Miller (Client side development Inc) left.
-
Martijn Cuppens (Client side development Inc) left.
-
Simon Wijckmans (Client side development Inc) left.
-
-
1 organization left.
-
Client side development Inc left.
-
GitHub
w3c/webappsec
-
2 issues opened.
-
CfC to proceed with WebAppSec charter refinement < 2026-07-03 w3c/webappsec#705, by @simoneonofri.
-
Booking the room for TPAC 2026 < 2026-06-16 w3c/webappsec#704, by @simoneonofri.
-
-
1 issue closed.
-
Booking the room for TPAC 2026 < 2026-06-16 w3c/webappsec#704.
-
-
3 issues received 4 new comments.
-
CfC to proceed with WebAppSec charter refinement < 2026-07-03 w3c/webappsec#705 (1 comment by @twiss)
-
1 pull request opened.
-
Update 2026-06-10 Agenda: TPAC 2026 Room for WebAppSec w3c/webappsec#703, by @simoneonofri.
-
-
1 pull request merged.
-
Update 2026-06-10 Agenda: TPAC 2026 Room for WebAppSec w3c/webappsec#703.
-
-
1 pull request closed.
-
Update 2025-06-18-agenda.md w3c/webappsec#676.
-
-
1 pull request received 3 new comments.
w3c/webappsec-permissions-policy
-
1 pull request opened.
-
Register publickey-credentials-remote-client-data-json feature w3c/webappsec-permissions-policy#586, by @bobomb.
-
-
1 pull request merged.
-
Add WebMCP link to features.md w3c/webappsec-permissions-policy#585.
-
-
1 pull request received 1 new comment.
w3c/trusted-types
-
1 issue received 2 new comments.
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605 (2 comments by @Elchi3, @lukewarlow)
-
-
1 pull request opened.
-
Fix build errors. w3c/trusted-types#610, by @otherdaniel.
-
-
1 pull request merged.
-
Fix build errors. w3c/trusted-types#610.
-
-
1 pull request reopened.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606, by @noamr.
-
-
2 pull requests received 26 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (25 comments by @annevk, @evilpie, @lukewarlow, @noamr)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Support for Linux with KDE Wallet (KWallet) w3c/webappsec-dbsc#261, by @saudiqbal.
-
-
1 issue received 1 new comment.
-
What should happen to RPs DBSC sessions when the SP session is terminated? w3c/webappsec-dbsc#259 (1 comment by @drubery)
-
w3c/webappsec-cspee
-
3 issues opened.
-
Can a `csp` attribute be looser than its containing document's "required CSP"? w3c/webappsec-cspee#35, by @domfarolino.
-
Update srcdoc navigation params more idiomatically w3c/webappsec-cspee#34, by @domfarolino.
-
Maybe we don't need a new navigation params member? w3c/webappsec-cspee#33, by @domfarolino.
-
w3c/permissions
-
1 pull request opened.
-
Add a note about masked returned permission states w3c/permissions#477, by @antosart.
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Allow navigator.credentials.get() to return a sequence of credentials w3c/webappsec-credential-management#300, by @mohamedamir.
-
-
1 pull request opened.
-
Support returning multiple credentials from navigator.credentials.get() w3c/webappsec-credential-management#301, by @mohamedamir.
-
w3c/webappsec-csp
-
1 pull request received 3 new comments.
-
Add WebDriver BiDi CSP bypass checks w3c/webappsec-csp#799 (3 comments by @antosart, @juliandescottes)
-
TR publications
-
2 documents published.
-
Content Security Policy: Embedded Enforcement published as a Working Draft. History of Content Security Policy: Embedded Enforcement
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
GitHub
w3c/webappsec-csp
-
3 issues opened.
-
Ambiguity regarding frame-src enforcement for <object> and <embed> child navigables w3c/webappsec-csp#816, by @nikosfanou.
-
Clarification RFC 7234 caches for present nonce-sources w3c/webappsec-csp#815, by @codingjoe.
-
Clarify object-src behavior when plugin content has no associated URL w3c/webappsec-csp#814, by @roberto-apple.
-
-
1 issue closed.
-
"Same" in origin comparison not linked w3c/webappsec-csp#813.
-
-
4 issues received 10 new comments.
-
Clarify object-src behavior when plugin content has no associated URL w3c/webappsec-csp#814 (5 comments by @annevk, @antosart, @roberto-apple)
-
Make user's the driver of the user-agent again: bookmarklets, userscripts w3c/webappsec-csp#444 (1 comment by @myfonj)
-
Clarification RFC 7234 caches for present nonce-sources w3c/webappsec-csp#815 (1 comment by @codingjoe)
-
-
2 pull requests received 5 new comments.
-
Integrate with speculation rules w3c/webappsec-csp#808 (4 comments by @annevk, @hiroshige-g, @tunetheweb)
-
w3c/webappsec-fetch-metadata
-
1 issue received 1 new comment.
-
Sec-Fetch-Site for navigations from outside the browser w3c/webappsec-fetch-metadata#77 (1 comment by @KonradDalla)
-
w3c/webappsec
-
1 issue received 10 new comments.
w3c/webappsec-cspee
-
1 issue opened.
-
Broken links in Content Security Policy: Embedded Enforcement w3c/webappsec-cspee#32, by @dontcallmedom-bot.
-
-
1 issue closed.
-
Broken links in Content Security Policy: Embedded Enforcement w3c/webappsec-cspee#31.
-
-
1 issue received 1 new comment.
-
Broken links in Content Security Policy: Embedded Enforcement w3c/webappsec-cspee#31 (1 comment by @mikewest)
-
w3c/webappsec-permissions-policy
-
1 issue received 1 new comment.
-
Process for including/removing features in Features.md w3c/webappsec-permissions-policy#581 (1 comment by @AlbertoFDR)
-
-
1 pull request opened.
-
Add WebMCP link to features.md w3c/webappsec-permissions-policy#585, by @domfarolino.
-
w3c/webappsec-dbsc
-
5 issues opened.
-
Implementation Report: dbsc-toolkit (Node.js implementation of DBSC) w3c/webappsec-dbsc#260, by @SulimanAbdulrazzaq.
-
What should happen to RPs DBSC sessions when the SP session is terminated? w3c/webappsec-dbsc#259, by @adeinega.
-
a session on the RP with the same key w3c/webappsec-dbsc#258, by @adeinega.
-
Wording in section "3.3. Federated sessions" can be improved w3c/webappsec-dbsc#257, by @adeinega.
-
Estimated Rollout for Android and iOS w3c/webappsec-dbsc#256, by @invisibleroads.
-
-
1 issue closed.
-
Wording in section "3.3. Federated sessions" can be improved w3c/webappsec-dbsc#257.
-
-
3 issues received 10 new comments.
-
Estimated Rollout for Android and iOS w3c/webappsec-dbsc#256 (4 comments by @drubery, @invisibleroads, @kashyaprpuranik, @olibos)
-
Wording in section "3.3. Federated sessions" can be improved w3c/webappsec-dbsc#257 (2 comments by @adeinega, @drubery)
-
w3c/webappsec-subresource-integrity
-
1 pull request opened.
-
Create SECURITY.md w3c/webappsec-subresource-integrity#170, by @azariahporras-blip.
-
-
1 pull request closed.
-
Create SECURITY.md w3c/webappsec-subresource-integrity#170.
-
-
1 pull request received 1 new comment.
w3c/webappsec-credential-management
-
3 issues opened.
-
Better error-handling guidance for `[[Create]]` internal algorithm w3c/webappsec-credential-management#299, by @domfarolino.
-
Add [[implicitMediation]] internal slot to Credential w3c/webappsec-credential-management#297, by @marcoscaceres.
-
Move [[origin]] internal slot for Credential into dfn list w3c/webappsec-credential-management#295, by @marcoscaceres.
-
-
2 pull requests opened.
-
Add [[implicitMediation]] internal slot to Credential w3c/webappsec-credential-management#298, by @marcoscaceres.
-
Move [[origin]] into Credential's dfn list w3c/webappsec-credential-management#296, by @marcoscaceres.
-
-
1 pull request received 2 new comments.
-
Add [[implicitMediation]] internal slot to Credential w3c/webappsec-credential-management#298 (2 comments by @nsatragno)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 30 July 2026.
-
TR publications
-
6 documents published.
-
Content Security Policy: Embedded Enforcement published twice as a Working Draft. History of Content Security Policy: Embedded Enforcement
-
Content Security Policy Level 3 published 3 times as a Working Draft. History of Content Security Policy Level 3
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Participants
-
4 participants left.
-
Mingzhe Li (Akamai Technologies) left.
-
Kester Quist-Aphetsi (CRITAC) left.
-
Duy-Tung LUU (CANTON CONSULTING) left.
-
Julien Rossi (CANTON CONSULTING) left.
-
-
2 organizations left.
-
CRITAC left.
-
CANTON CONSULTING left.
-
GitHub
w3c/webappsec-csp
-
2 issues opened.
-
"Same" in origin comparison not linked w3c/webappsec-csp#813, by @annevk.
-
Embedded enforcement links are broken w3c/webappsec-csp#811, by @domfarolino.
-
-
1 issue received 2 new comments.
-
Implementation differences with "Strip URL for use in reports" w3c/webappsec-csp#735 (2 comments by @annevk, @antosart)
-
-
2 pull requests opened.
-
[Editorial] 'policy' is a local term, not global. w3c/webappsec-csp#812, by @mikewest.
-
Update nonceable attribute checks for link elements w3c/webappsec-csp#810, by @mikewest.
-
-
2 pull requests merged.
-
[Editorial] 'policy' is a local term, not global. w3c/webappsec-csp#812.
-
Add "text" destination type, for JavaScript text imports w3c/webappsec-csp#794.
-
-
3 pull requests received 7 new comments.
-
[Editorial] 'policy' is a local term, not global. w3c/webappsec-csp#812 (4 comments by @antosart, @mikewest, @tabatkins)
-
Update nonceable attribute checks for link elements w3c/webappsec-csp#810 (2 comments by @annevk, @mikewest)
-
w3c/webcrypto
-
1 issue opened.
-
Consider explicitly allowing `digest` for non-secure origins w3c/webcrypto#556, by @Wren6991.
-
-
3 issues received 7 new comments.
-
Please require a secure origin (Bug 25972) w3c/webcrypto#28 (5 comments by @7heMech, @twiss, @Wren6991)
-
Consider explicitly allowing `digest` for non-secure origins w3c/webcrypto#556 (1 comment by @twiss)
-
-
1 pull request opened.
-
Add [EnforceRange] instead of truncating lengths w3c/webcrypto#555, by @panva.
-
-
2 pull requests merged.
-
Update acknowledgements w3c/webcrypto#552.
-
Editorial fixes and consistency pass w3c/webcrypto#554.
-
-
1 pull request received 2 new comments.
w3c/webappsec-credential-management
-
1 issue opened.
-
Fix TypeError exception type in "Request a Credential" algorithm w3c/webappsec-credential-management#293, by @marcoscaceres.
-
-
1 issue closed.
-
Fix TypeError exception type in "Request a Credential" algorithm w3c/webappsec-credential-management#293.
-
-
1 issue received 1 new comment.
-
Allow mediation to work for non-collected credentials w3c/webappsec-credential-management#217 (1 comment by @baraagentl-glitch)
-
-
2 pull requests opened.
-
Fix TypeError exception type in Request a Credential w3c/webappsec-credential-management#294, by @marcoscaceres.
-
create(): reject with NotSupportedError when no credential type is specified w3c/webappsec-credential-management#292, by @marcoscaceres.
-
-
1 pull request merged.
-
Fix TypeError exception type in Request a Credential w3c/webappsec-credential-management#294.
-
w3c/webappsec-cspee
-
1 issue opened.
-
Broken links in Content Security Policy: Embedded Enforcement w3c/webappsec-cspee#31, by @dontcallmedom-bot.
-
-
5 issues closed.
-
Should file and filesystem schemes allow blanket enforcement? w3c/webappsec-cspee#10.
-
Editor's draft not getting autoupdated w3c/webappsec-cspee#24.
-
Limit length of 'csp' attribute w3c/webappsec-cspee#22.
-
Broken references in Content Security Policy: Embedded Enforcement w3c/webappsec-cspee#27.
-
Redirect https://w3c.github.io/webappsec-csp/embedded/ w3c/webappsec-cspee#30.
-
-
5 issues received 6 new comments.
-
Redirect https://w3c.github.io/webappsec-csp/embedded/ w3c/webappsec-cspee#30 (2 comments by @mikewest)
-
Should file and filesystem schemes allow blanket enforcement? w3c/webappsec-cspee#10 (1 comment by @mikewest)
-
Broken references in Content Security Policy: Embedded Enforcement w3c/webappsec-cspee#27 (1 comment by @mikewest)
-
-
4 pull requests closed.
-
Limit length of CSP attribute w3c/webappsec-cspee#21.
-
Fix example of non-similar CSP sources with different ports w3c/webappsec-cspee#15.
-
Fix examples involving wildcard host matching. w3c/webappsec-cspee#13.
-
Fix subsume-source-expressions algorithm w3c/webappsec-cspee#9.
-
-
4 pull requests received 4 new comments.
-
Fix example of non-similar CSP sources with different ports w3c/webappsec-cspee#15 (1 comment by @mikewest)
w3c/webappsec-referrer-policy
-
1 pull request received 3 new comments.
-
Make strict-origin-when-cross-origin the default referrer policy w3c/webappsec-referrer-policy#142 (3 comments by @DuschSchmidt27)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Hacked phone w3c/webappsec-fetch-metadata#98, by @danielsusan128128.
-
-
1 issue closed.
-
Hacked phone w3c/webappsec-fetch-metadata#98.
-
w3c/webappsec-dbsc
-
8 issues opened.
-
Prevent risk of deadlock during session refresh w3c/webappsec-dbsc#255, by @alexilin92.
-
Federated sessions (§ 3.3) orthogonal to your stated goals? w3c/webappsec-dbsc#254, by @maceip.
-
TPM implementation details are not mentioned w3c/webappsec-dbsc#253, by @Foxboron.
-
Frozen Chrome tab w3c/webappsec-dbsc#252, by @reda-alaoui.
-
Is there a max duration for a DBSC session? w3c/webappsec-dbsc#251, by @reda-alaoui.
-
Browser is sending some http requests without the short term cookie w3c/webappsec-dbsc#250, by @reda-alaoui.
-
Session termination during refresh session request w3c/webappsec-dbsc#249, by @pawel-slack.
-
Clarifications about registration and asynchronous aspects w3c/webappsec-dbsc#248, by @reda-alaoui.
-
-
8 issues closed.
-
Frozen Chrome tab w3c/webappsec-dbsc#252.
-
TPM implementation details are not mentioned w3c/webappsec-dbsc#253.
-
Sessions can register from a subdomain without `.well-known` config? w3c/webappsec-dbsc#239.
-
Is there a max duration for a DBSC session? w3c/webappsec-dbsc#251.
-
Browser is sending some http requests without the short term cookie w3c/webappsec-dbsc#250.
-
Clarifications about registration and asynchronous aspects w3c/webappsec-dbsc#248.
-
Session termination during refresh session request w3c/webappsec-dbsc#249.
-
Support for `include_site` on a subdomain instead of just root domain (eTLD+1) w3c/webappsec-dbsc#241.
-
-
8 issues received 28 new comments.
-
Browser is sending some http requests without the short term cookie w3c/webappsec-dbsc#250 (5 comments by @drubery, @reda-alaoui)
-
Session termination during refresh session request w3c/webappsec-dbsc#249 (5 comments by @drubery, @pawel-slack)
-
TPM implementation details are not mentioned w3c/webappsec-dbsc#253 (4 comments by @drubery, @Foxboron)
-
Is there a max duration for a DBSC session? w3c/webappsec-dbsc#251 (2 comments by @drubery, @reda-alaoui)
-
Clarifications about registration and asynchronous aspects w3c/webappsec-dbsc#248 (2 comments by @drubery, @reda-alaoui)
-
Federated sessions (§ 3.3) orthogonal to your stated goals? w3c/webappsec-dbsc#254 (1 comment by @gehinger)
-
Support for `include_site` on a subdomain instead of just root domain (eTLD+1) w3c/webappsec-dbsc#241 (1 comment by @PawelMaj)
w3c/trusted-types
-
1 issue received 3 new comments.
-
1 pull request opened.
-
Update script source URLs in README.md w3c/trusted-types#609, by @kostasx.
-
-
1 pull request merged.
-
Update script source URLs in README.md w3c/trusted-types#609.
-
w3c/webappsec
-
1 issue opened.
-
Planning 2026-06-17. w3c/webappsec#702, by @mikewest.
-
-
1 issue closed.
-
Planning 2026-04-15 w3c/webappsec#700.
-
-
1 issue received 1 new comment.
-
Request for feedback: /.well-known/recover-account proposal w3c/webappsec#701 (1 comment by @miketaylr)
-
w3c/permissions
-
2 issues opened.
-
Permission state constraints don't always seem to be ensured w3c/permissions#476, by @antosart.
-
Add more permissions into the registry w3c/permissions#475, by @saschanaz.
-
-
1 issue received 1 new comment.
w3c/webappsec-change-password-url
-
1 issue opened.
-
Suggestion: return JSON containing the URL (breaking change) w3c/webappsec-change-password-url#51, by @irew.
-
-
1 issue closed.
-
Suggestion: return JSON containing the URL (breaking change) w3c/webappsec-change-password-url#51.
-
-
1 issue received 1 new comment.
-
Suggestion: return JSON containing the URL (breaking change) w3c/webappsec-change-password-url#51 (1 comment by @irew)
-
w3c/webappsec-passkey-endpoints
-
1 pull request received 1 new comment.
w3c/webappsec-permissions-policy
-
1 pull request opened.
-
[focus-without-user-activation] Update explainer w3c/webappsec-permissions-policy#584, by @ffiori.
-
-
2 pull requests received 7 new comments.
-
[focus-without-user-activation] Update explainer w3c/webappsec-permissions-policy#584 (6 comments by @dandclark, @ffiori)
-
Add security/privacy questionnaire for focus-without-user-activation w3c/webappsec-permissions-policy#583 (1 comment by @ffiori)
-
TR publications
-
5 documents published.
-
Subresource Integrity published twice as a Working Draft. History of Subresource Integrity
-
Content Security Policy Level 3 published 3 times as a Working Draft. History of Content Security Policy Level 3
-
Participants
-
7 participants joined.
-
Emma Zuehlcke (Mozilla Foundation) joined.
-
Gianluca Altomani (W3C Invited Experts) joined.
-
Timo Tijhof (Wikimedia Foundation) joined.
-
Larissa Gaulia (Wikimedia Foundation) joined.
-
Timo Tijhof (Wikimedia Foundation) joined.
-
Tatiana Mikhailova (ByteDance) joined.
-
Mikhail Khramenkov (ByteDance) joined.
-
-
3 participants left.
-
Emma Zuehlcke (Mozilla Foundation) left.
-
Larissa Gaulia (Wikimedia Foundation) left.
-
Timo Tijhof (Wikimedia Foundation) left.
-
-
1 organization joined.
-
Wikimedia Foundation joined.
-
GitHub
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Process for including/removing features in Features.md w3c/webappsec-permissions-policy#581, by @marcoscaceres.
-
-
1 issue closed.
-
Update web-platform-tests w3c/webappsec-permissions-policy#490.
-
-
2 issues received 2 new comments.
-
What is the process for making changes? w3c/webappsec-permissions-policy#561 (1 comment by @marcoscaceres)
-
-
2 pull requests opened.
-
Add security/privacy questionnaire for focus-without-user-activation w3c/webappsec-permissions-policy#583, by @ffiori.
-
Rename PermissionsPolicy interface back to FeaturePolicy w3c/webappsec-permissions-policy#582, by @marcoscaceres.
-
-
3 pull requests received 8 new comments.
-
Add security/privacy questionnaire for focus-without-user-activation w3c/webappsec-permissions-policy#583 (3 comments by @dandclark, @ffiori)
-
Allow for User Agent discretion when checking permission policy w3c/webappsec-permissions-policy#572 (3 comments by @ghost, @jkarlin)
-
Rename PermissionsPolicy interface back to FeaturePolicy w3c/webappsec-permissions-policy#582 (2 comments by @annevk, @marcoscaceres)
-
w3c/webappsec
-
2 issues opened.
-
Request for feedback: /.well-known/recover-account proposal w3c/webappsec#701, by @felipecpaiva.
-
Planning 2026-04-15 w3c/webappsec#700, by @mikewest.
-
-
1 issue closed.
-
Planning 2026-02-18 w3c/webappsec#699.
-
-
1 issue received 2 new comments.
-
Request for feedback: /.well-known/recover-account proposal w3c/webappsec#701 (2 comments by @felipecpaiva, @miketaylr)
-
w3c/webappsec-mixed-content
-
1 issue received 2 new comments.
-
Spec is not clear about blobs created in sandboxed iframes w3c/webappsec-mixed-content#41 (2 comments by @jdm)
-
w3c/webappsec-csp
-
2 issues opened.
-
`frame-src` WPT test expects path to be stripped when loading cross-origin URL w3c/webappsec-csp#809, by @TimvdLippe.
-
Policies parsed from a <meta> tag don't get a self-origin w3c/webappsec-csp#802, by @antosart.
-
-
1 issue closed.
-
Policies parsed from a <meta> tag don't get a self-origin w3c/webappsec-csp#802.
-
-
5 issues received 23 new comments.
-
Implementation differences with "Strip URL for use in reports" w3c/webappsec-csp#735 (8 comments by @annevk, @TimvdLippe)
-
Policies parsed from a <meta> tag don't get a self-origin w3c/webappsec-csp#802 (6 comments by @annevk, @antosart, @evilpie, @mikewest)
-
CSP script-src self and blobs w3c/webappsec-csp#487 (4 comments by @annevk, @antosart, @roberto-apple)
-
Add way to define all country code top-level domain. w3c/webappsec-csp#256 (4 comments by @AndrewStoyan, @erikarenhill, @rgpublic)
-
`frame-src` WPT test expects path to be stripped when loading cross-origin URL w3c/webappsec-csp#809 (1 comment by @antosart)
-
-
6 pull requests opened.
-
Integrate with speculation rules w3c/webappsec-csp#808, by @vickiez.
-
Fix Bikeshed API endpoint in Makefile w3c/webappsec-csp#807, by @yoavweiss.
-
Fix algorithms called with missing parameters w3c/webappsec-csp#806, by @antosart.
-
Attach self-origin to CSP list w3c/webappsec-csp#805, by @antosart.
-
[Editorial] Avoid nested parenthetical for clarity w3c/webappsec-csp#804, by @Krinkle.
-
[import-bytes] add `bytes` destination w3c/webappsec-csp#803, by @styfle.
-
-
3 pull requests merged.
-
Attach self-origin to CSP list w3c/webappsec-csp#805.
-
Fix algorithms called with missing parameters w3c/webappsec-csp#806.
-
[Editorial] Avoid nested parenthetical for clarity w3c/webappsec-csp#804.
-
-
6 pull requests received 31 new comments.
-
Add WebDriver BiDi CSP bypass checks w3c/webappsec-csp#799 (11 comments by @dveditz, @juliandescottes)
-
Fix algorithms called with missing parameters w3c/webappsec-csp#806 (7 comments by @antosart, @mikewest)
-
w3c/webcrypto
-
2 issues opened.
-
Was pre-hashed input considered for ECDSA? w3c/webcrypto#431, by @Frosne.
-
Allow creating hedged ECDSA signatures? w3c/webcrypto#430, by @twiss.
-
-
1 issue closed.
-
Require deterministic ECDSA rather than random ECDSA w3c/webcrypto#163.
-
-
7 issues received 20 new comments.
-
Was pre-hashed input considered for ECDSA? w3c/webcrypto#431 (11 comments by @Frosne, @lsd-cat, @panva, @twiss)
-
Consider not truncating lengths and instead [EnforceRange]? w3c/webcrypto#429 (1 comment by @ChALkeR)
-
-
4 pull requests opened.
-
Editorial fixes and consistency pass w3c/webcrypto#554, by @panva.
-
Require HMAC comparison to be constant time w3c/webcrypto#553, by @panva.
-
Update acknowledgements w3c/webcrypto#552, by @panva.
-
add signDigest and verifyDigest operations w3c/webcrypto#551, by @panva.
-
-
1 pull request merged.
-
Require HMAC comparison to be constant time w3c/webcrypto#553.
-
-
2 pull requests received 16 new comments.
-
add signDigest and verifyDigest operations w3c/webcrypto#551 (12 comments by @Frosne, @panva, @twiss)
-
w3c/webappsec-credential-management
-
2 issues closed.
-
Disallow multiple types via navigator.credentials's methods w3c/webappsec-credential-management#244.
-
What's this site used for w3c/webappsec-credential-management#291.
-
-
1 pull request merged.
-
Define with types are allowed in the same get() request w3c/webappsec-credential-management#261.
-
-
2 pull requests received 5 new comments.
-
Define with types are allowed in the same get() request w3c/webappsec-credential-management#261 (4 comments by @marcoscaceres, @mohamedamir)
-
Remove willRequestConditionalCreation method from Credential w3c/webappsec-credential-management#282 (1 comment by @marcoscaceres)
-
w3c/webappsec-dbsc
-
1 issue closed.
-
is it available for the chrome 145 desktop stable w3c/webappsec-dbsc#247.
-
-
1 issue received 9 new comments.
-
is it available for the chrome 145 desktop stable w3c/webappsec-dbsc#247 (9 comments by @drubery, @vibepace1)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Add support for clearing compression dictionary storage w3c/webappsec-clear-site-data#93, by @pmeenan.
-
-
1 pull request opened.
-
Added references to clearing the compression dictionary caches. w3c/webappsec-clear-site-data#94, by @pmeenan.
-
-
1 pull request received 2 new comments.
-
Added references to clearing the compression dictionary caches. w3c/webappsec-clear-site-data#94 (2 comments by @mikewest, @pmeenan)
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Update from api.csswg.org/bikeshed to spec-generator w3c/webappsec-referrer-policy#178, by @kfranqueiro.
-
-
1 pull request merged.
-
Update from api.csswg.org/bikeshed to spec-generator w3c/webappsec-referrer-policy#178.
-
-
1 pull request received 2 new comments.
-
Update from api.csswg.org/bikeshed to spec-generator w3c/webappsec-referrer-policy#178 (2 comments by @mikewest, @w3cbot)
-
w3c/webappsec-subresource-integrity
-
2 pull requests opened.
-
Makefile: Replace CSSWG-API-specific force=1 with die-on=nothing w3c/webappsec-subresource-integrity#169, by @kfranqueiro.
-
Fix Bikeshed API endpoint in Makefile w3c/webappsec-subresource-integrity#168, by @yoavweiss.
-
-
2 pull requests merged.
-
Makefile: Replace CSSWG-API-specific force=1 with die-on=nothing w3c/webappsec-subresource-integrity#169.
-
Fix Bikeshed API endpoint in Makefile w3c/webappsec-subresource-integrity#168.
-
-
2 pull requests received 4 new comments.
-
Fix Bikeshed API endpoint in Makefile w3c/webappsec-subresource-integrity#168 (3 comments by @mikewest, @mozfreddyb, @yoavweiss)
-
Makefile: Replace CSSWG-API-specific force=1 with die-on=nothing w3c/webappsec-subresource-integrity#169 (1 comment by @w3cbot)
-
w3c/webappsec-suborigins
-
1 pull request opened.
-
Update from api.csswg.org/bikeshed to spec-generator w3c/webappsec-suborigins#82, by @kfranqueiro.
-
-
1 pull request received 1 new comment.
-
Update from api.csswg.org/bikeshed to spec-generator w3c/webappsec-suborigins#82 (1 comment by @w3cbot)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Integration with Speculation Rules prefetch/prerender w3c/webappsec-fetch-metadata#97, by @zcorpan.
-
-
1 issue received 2 new comments.
-
Integration with Speculation Rules prefetch/prerender w3c/webappsec-fetch-metadata#97 (2 comments by @mikewest)
-
w3c/webappsec-upgrade-insecure-requests
-
1 pull request received 2 new comments.
-
Migrate to 'relevant settings object' Fixes: #17 w3c/webappsec-upgrade-insecure-requests#38 (2 comments by @annevk)
-
TR publications
-
4 documents published.
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Jonathan Kingston (Duck Duck Go, Inc.) joined.
-
-
1 organization joined.
-
Duck Duck Go, Inc. joined.
-
GitHub
w3c/webappsec-dbsc
-
2 issues opened.
-
is it available for the chrome 145 desktop stable w3c/webappsec-dbsc#247, by @vibepace1.
-
Chrome DBSC: Session marked as session_ended despite valid challenge response w3c/webappsec-dbsc#243, by @jimmylo16.
-
-
1 issue received 35 new comments.
-
Chrome DBSC: Session marked as session_ended despite valid challenge response w3c/webappsec-dbsc#243 (35 comments by @jimmylo16, @thefrog-gh)
-
-
3 pull requests opened.
-
Update `jwk` field requirements for none keys w3c/webappsec-dbsc#246, by @drubery.
-
Add initial DBSC for Single Sign On explainer. w3c/webappsec-dbsc#245, by @lucasrsant.
-
Use "domain pattern" to refer to patterns in scope specifications w3c/webappsec-dbsc#244, by @drubery.
-
-
2 pull requests merged.
-
Update `jwk` field requirements for none keys w3c/webappsec-dbsc#246.
-
Use "domain pattern" to refer to patterns in scope specifications w3c/webappsec-dbsc#244.
-
-
1 pull request closed.
-
Add initial DBSC for Single Sign On explainer. w3c/webappsec-dbsc#245.
-
-
1 pull request reopened.
-
Add initial DBSC for Single Sign On explainer. w3c/webappsec-dbsc#245, by @lucasrsant.
-
-
1 pull request received 2 new comments.
-
Use "domain pattern" to refer to patterns in scope specifications w3c/webappsec-dbsc#244 (2 comments by @drubery, @thefrog-gh)
-
w3c/webappsec-permissions-policy
-
1 pull request received 2 new comments.
-
Allow for User Agent discretion when checking permission policy w3c/webappsec-permissions-policy#572 (2 comments by @clelland, @scheib)
-
w3c/webcrypto
-
1 issue opened.
-
Consider not truncating lengths and instead [EnforceRange]? w3c/webcrypto#429, by @ChALkeR.
-
-
1 issue closed.
-
Consider reordering reading arguments to avoid copies w3c/webcrypto#422.
-
-
2 issues received 7 new comments.
-
Consider not truncating lengths and instead [EnforceRange]? w3c/webcrypto#429 (4 comments by @annevk, @davidben, @twiss)
-
-
1 pull request opened.
-
Add length check for JWK key import w3c/webcrypto#428, by @devgianlu.
-
-
1 pull request merged.
-
Reorder reading algorithm and data arguments w3c/webcrypto#426.
-
-
2 pull requests received 4 new comments.
w3c/permissions
-
2 pull requests opened.
-
Editorial: Export "set a permission algorithm". w3c/permissions#474, by @lutien.
-
Update auto-publish.yml w3c/permissions#473, by @boyackandrew45-ctrl.
-
-
2 pull requests closed.
-
Editorial: Export "set a permission algorithm". w3c/permissions#474.
-
Update auto-publish.yml w3c/permissions#473.
-
-
1 pull request received 2 new comments.
w3c/trusted-types
-
1 issue opened.
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605, by @hybrist.
-
-
2 issues received 4 new comments.
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605 (3 comments by @hybrist, @lukewarlow)
-
-
3 pull requests opened.
-
Remove link to DOM PR now that it's merged w3c/trusted-types#608, by @lukewarlow.
-
Add new update script trustedness algorithm for the HTML spec to call w3c/trusted-types#607, by @lukewarlow.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606, by @noamr.
-
-
1 pull request merged.
-
Remove link to DOM PR now that it's merged w3c/trusted-types#608.
-
-
1 pull request received 5 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (5 comments by @lukewarlow, @noamr)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
What's this site used for w3c/webappsec-credential-management#291, by @lpxlolovanrr-collab.
-
-
1 issue closed.
-
Do we still want willRequestConditionalCreation? w3c/webappsec-credential-management#279.
-
-
2 pull requests merged.
-
Add immediate mediation w3c/webappsec-credential-management#272.
-
Remove willRequestConditionalCreation method from Credential w3c/webappsec-credential-management#282.
-
-
2 pull requests received 12 new comments.
-
Add immediate mediation w3c/webappsec-credential-management#272 (11 comments by @iinuwa, @kenrb, @marcoscaceres, @MasterKale, @nsatragno)
-
Remove willRequestConditionalCreation method from Credential w3c/webappsec-credential-management#282 (1 comment by @nsatragno)
-
w3c/webappsec-csp
-
2 issues opened.
-
Proposal: CSP control over interactive HTTP authentication for subresources w3c/webappsec-csp#801, by @nirmalk401.
-
Integration point for WebDriver BiDi CSP bypass w3c/webappsec-csp#798, by @juliandescottes.
-
-
1 issue closed.
-
Introduce new CSP keyword 'unsafe-webtransport-hashes' w3c/webappsec-csp#683.
-
-
2 issues received 3 new comments.
-
Introduce new CSP keyword 'unsafe-webtransport-hashes' w3c/webappsec-csp#683 (2 comments by @antosart, @quantumpacket)
-
-
2 pull requests opened.
-
Add missing closing tag for section w3c/webappsec-csp#800, by @juliandescottes.
-
Add WebDriver BiDi CSP bypass checks w3c/webappsec-csp#799, by @juliandescottes.
-
-
2 pull requests merged.
-
Add 'unsafe-webtransport-hashes' keyword to connect-src w3c/webappsec-csp#791.
-
Add missing closing tag for section w3c/webappsec-csp#800.
-
-
2 pull requests received 7 new comments.
-
Add 'unsafe-webtransport-hashes' keyword to connect-src w3c/webappsec-csp#791 (5 comments by @antosart, @jan-ivar, @martinthomson)
-
w3c/webappsec-change-password-url
-
1 issue received 1 new comment.
-
Broken reference for "Appropriate Use of Well-Known URIs" w3c/webappsec-change-password-url#26 (1 comment by @ferdnyc)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue closed.
-
"If a Document's incumbent settings object’s insecure requests policy is set to Upgrade," doesn't make sense w3c/webappsec-upgrade-insecure-requests#37.
-
-
1 pull request received 3 new comments.
-
Migrate to 'relevant settings object' Fixes: #17 w3c/webappsec-upgrade-insecure-requests#38 (3 comments by @carlosjoan91, @jonathanKingston, @simoneonofri)
-
w3c/webappsec
-
1 issue received 1 new comment.
TR publications
-
1 document published.
-
A Well-Known URL for Relying Party Passkey Endpoints published as a Working Draft. History of A Well-Known URL for Relying Party Passkey Endpoints
-
Participants
-
2 participants joined.
-
Nikos Karapanos (Futurae Technologies AG) joined.
-
Jessica Chen (Microsoft Corporation) joined.
-
-
1 organization joined.
-
Futurae Technologies AG joined.
-
GitHub
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
"If a Document's incumbent settings object’s insecure requests policy is set to Upgrade," doesn't make sense w3c/webappsec-upgrade-insecure-requests#37, by @smaug----.
-
-
1 issue closed.
-
Query regarding #upgrade-request w3c/webappsec-upgrade-insecure-requests#35.
-
-
3 issues received 4 new comments.
-
"If a Document's incumbent settings object’s insecure requests policy is set to Upgrade," doesn't make sense w3c/webappsec-upgrade-insecure-requests#37 (2 comments by @jonathanKingston, @smaug----)
-
Use of "incumbent settings object" in "Policy inheritance" section does not make sense w3c/webappsec-upgrade-insecure-requests#17 (1 comment by @jonathanKingston)
-
Query regarding #upgrade-request w3c/webappsec-upgrade-insecure-requests#35 (1 comment by @shubhamg13)
-
-
1 pull request opened.
-
Migrate to 'relevant settings object' Fixes: #17 w3c/webappsec-upgrade-insecure-requests#38, by @jonathanKingston.
-
-
1 pull request received 2 new comments.
-
Migrate to 'relevant settings object' Fixes: #17 w3c/webappsec-upgrade-insecure-requests#38 (2 comments by @jonathanKingston)
-
w3c/webappsec-csp
-
3 issues opened.
-
Providing a directive for XSLT w3c/webappsec-csp#797, by @Tachi107.
-
Klar MasterCard activar w3c/webappsec-csp#796, by @alejandrohdzcastillo2612-ux.
-
Link H3it7z. me1peernet w3c/webappsec-csp#795, by @ieasternyamessisuns1king-dotcom.
-
-
2 issues closed.
-
Klar MasterCard activar w3c/webappsec-csp#796.
-
Link H3it7z. me1peernet w3c/webappsec-csp#795.
-
-
1 pull request received 5 new comments.
-
Add 'unsafe-webtransport-hashes' keyword to connect-src w3c/webappsec-csp#791 (5 comments by @antosart, @jan-ivar)
-
w3c/webcrypto
-
6 issues opened.
-
Add missing parameters/attributes to JsonWebKey definition w3c/webcrypto#427, by @pranjaldaffodil.
-
Allow creating hedged EdDSA signatures? w3c/webcrypto#424, by @twiss.
-
Make small-order checks in EdDSA optional? w3c/webcrypto#423, by @twiss.
-
Consider reordering reading arguments to avoid copies w3c/webcrypto#422, by @twiss.
-
support SharedArrayBuffers with crypto.getRandomValues w3c/webcrypto#421, by @vapier.
-
Usage of short tags in AES-GCM w3c/webcrypto#420, by @kkoyung.
-
-
3 issues closed.
-
Add missing parameters/attributes to JsonWebKey definition w3c/webcrypto#427.
-
Accept shared ArrayBufferView also? w3c/webcrypto#213.
-
Usage of short tags in AES-GCM w3c/webcrypto#420.
-
-
1 issue reopened.
-
Synchronous API ? w3c/webcrypto#167, by @twiss.
-
-
6 issues received 25 new comments.
-
Synchronous API ? w3c/webcrypto#167 (10 comments by @annevk, @davidben, @Frosne, @threema-lenny, @twiss)
-
Accept shared ArrayBufferView also? w3c/webcrypto#213 (6 comments by @annevk, @ChALkeR, @sideshowbarker, @twiss, @vapier)
-
Consider reordering reading arguments to avoid copies w3c/webcrypto#422 (4 comments by @annevk, @davidben, @twiss)
-
support SharedArrayBuffers with crypto.getRandomValues w3c/webcrypto#421 (2 comments by @Frosne, @vapier)
-
-
2 pull requests opened.
-
Reorder reading algorithm and data arguments w3c/webcrypto#426, by @twiss.
-
Add Curve448 w3c/webcrypto#425, by @twiss.
-
-
1 pull request received 6 new comments.
-
Reorder reading algorithm and data arguments w3c/webcrypto#426 (6 comments by @annevk, @davidben, @twiss)
-
w3c/webappsec-dbsc
-
2 issues received 4 new comments.
-
Sessions can register from a subdomain without `.well-known` config? w3c/webappsec-dbsc#239 (3 comments by @drubery, @snandy-ts)
-
-
1 pull request opened.
-
Update that scope rules are processed in reverse w3c/webappsec-dbsc#242, by @drubery.
-
-
1 pull request merged.
-
Update that scope rules are processed in reverse w3c/webappsec-dbsc#242.
-
w3c/trusted-types
-
1 issue opened.
-
Spec text should define how to match against tt-keyword. w3c/trusted-types#604, by @otherdaniel.
-
-
2 issues received 6 new comments.
-
Spec text should define how to match against tt-keyword. w3c/trusted-types#604 (1 comment by @annevk)
w3c/permissions
-
1 issue opened.
-
1 issue closed.
-
1 issue received 1 new comment.
-
Businesses provide emails and say to email with any inquiries, when emailed they say don't email or respond to email. w3c/permissions#472 (1 comment by @fluentaztaskmanager)
-
w3c/webappsec
-
1 issue opened.
-
Planning 2026-02-18 w3c/webappsec#699, by @mikewest.
-
-
2 issues closed.
-
Planning 2026-01-21 w3c/webappsec#698.
-
Planning 2025-10-15. w3c/webappsec#686.
-
-
2 issues received 2 new comments.
w3c/webappsec-passkey-endpoints
-
1 issue opened.
-
Should hostnames be restricted? w3c/webappsec-passkey-endpoints#18, by @iinuwa.
-
-
1 issue closed.
-
Add "Recommended Use by Clients" section w3c/webappsec-passkey-endpoints#12.
-
-
1 issue received 3 new comments.
-
Can we permit server-relative URLs w3c/webappsec-passkey-endpoints#15 (3 comments by @annevk, @iinuwa, @lgarron)
-
-
1 pull request merged.
-
Add Recommended Usage by Clients section w3c/webappsec-passkey-endpoints#16.
-
-
1 pull request received 1 new comment.
w3c/webappsec-mixed-content
-
1 issue opened.
-
"Should fetching request be blocked as mixed content?" doesn't look at the request's current URL w3c/webappsec-mixed-content#77, by @jdm.
-
-
1 issue closed.
-
"Should fetching request be blocked as mixed content?" doesn't look at the request's current URL w3c/webappsec-mixed-content#77.
-
-
1 issue received 2 new comments.
-
"Should fetching request be blocked as mixed content?" doesn't look at the request's current URL w3c/webappsec-mixed-content#77 (2 comments by @jdm, @mikewest)
-
-
1 pull request opened.
-
Use request's current URL for blocking requests. w3c/webappsec-mixed-content#78, by @jdm.
-
-
1 pull request merged.
-
Use request's current URL for blocking requests. w3c/webappsec-mixed-content#78.
-