search

WICG / ContentPerformancePolicy

A set of policies that a site guarantees to adhere to, browsers enforce, and embedders can count on.
http://wicg.github.io/ContentPerformancePolicy/
Other
73 stars 9 forks source link

Can policies be specified in a meta tag? #3

Open RByers opened 8 years ago

RByers commented 8 years ago

Most CSP policies can be provided via either an HTTP header or an <meta http-equiv> tag. I assume either approach is fine here, right? Should the spec say this explicitly somewhere?

yoavweiss commented 8 years ago

Yeah, either approach is fine. I'm hoping to refer to the appropriate sections in CSP in order to "inherit" that language from it, as the behavior we need from it is similar. We want meta tags to be able to apply a stricter policy, but not relax it (e.g. we don't want a script running in the context of the main page to be able to turn off CPP)

RByers commented 8 years ago

Makes sense, thanks.