w3c / webappsec-csp

WebAppSec Content Security Policy
https://w3c.github.io/webappsec-csp/
Other
207 stars 78 forks source link

Algorithms should be <dfn> in prose instead of linked to headers #618

Open johnathan79717 opened 1 year ago

johnathan79717 commented 1 year ago

The header "Does url match source list in origin with redirect count?" should be clickable and link to its references.

antosart commented 1 year ago

The same applies to several other links. It looks like adding dfn to the <h5> html element fixes it. I am not sure if that's "the right thing to do" or if there is a more appropriate way for algorithms.

annevk commented 1 year ago

That's a correct thing to do. (My personal preference is for headings to not be definitions, but they certainly can be.)

antosart commented 1 year ago

I think that makes sense. The spec currently mixes the two approaches, and there are a few algorithms defined in headings. It makes sense to fix it and actually define them in text. Since some of them are exported, we should fix the references in the call sites (mostly html I think). I'll try to fix this.

mikewest commented 1 year ago

Linking to headers made sense to me at the time, but isn't what I'd do today given the tooling Bikeshed makes available. If I was writing it again, I'd use the "<dfn> in prose" approach, as y'all have suggested.

johnathan79717 commented 1 year ago

Sounds good to me as long as there is somewhere I can click and see where a certain algorithm is referenced. And consistency helps too.

antosart commented 1 year ago

I went through the whole spec, since there are quite a few algorithms in headers (in particular, all the directive checks), I think the easiest thing to do is to just add dfn everywhere.