whatwg / xhr

XMLHttpRequest Standard
https://xhr.spec.whatwg.org/
Other
314 stars 131 forks source link

Replace Feature Policy integration with Document Policy #296

Open clelland opened 3 years ago

clelland commented 3 years ago

Following the discussion in https://github.com/w3c/webappsec-permissions-policy/issues/410, it seems that there is interest in replacing the existing integration with Feature Policy with a similar Document Policy integration.

The largest difference between the two is that a document policy in one frame does not necessarily affect its embedded content; the parent can switch off synchronous XHR for itself, while allowing its children to make the same decision on their own. Document Policy does define a mode by which child frames can be required to disable sync-xhr, but this requires an explicit opt in by the embedded document, and is not simply imposed by the embedder, as it is with Feature Policy.