search

paragonie / csp-builder

Build Content-Security-Policy headers from a JSON file (or build them programmatically)
https://paragonie.com/projects
MIT License
544 stars 39 forks source link

Support for Feature-Policy header? #36

Closed ghost closed 1 year ago

ghost commented 6 years ago

Feature-Policy is a new header that, in format, seems to look exactly like CSP. It uses a separate Feature-Policy HTTP header and instead of script-src, img-src, and so on as directives, it uses directives such as geolocation and vibrate.

It would be neat if csp-builder supported these. I realize that it is not strictly the same as CSP. An alternative would be to create a new project, though it would likely duplicate most efforts as the structure - and likely code - would mostly be the same.

[1] https://wicg.github.io/feature-policy/ [2] https://developers.google.com/web/updates/2018/06/feature-policy [3] https://caniuse.com/#search=feature-policy

bnomei commented 5 years ago

any progress on this one?

paragonie-security commented 1 year ago

This is a separate header. CSP-Builder is only concerned with the Content-Security-Policy header, not all security headers.