[websec] fyi: Unofficial Draft of Content Security Policy (CSP)

=JeffH <Jeff.Hodges@KingsMountain.com> Thu, 24 March 2011 19:48 UTC

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kingsmountain.com; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=m+GFqeUu6mxMyzEEEgrvh4zdUxJg65qkIQzFU2zTs//o79W98AQ8vAWiVk+uCRl77bHN5OJiOaZm8CIeQTB+QM4Nxo946L7Blhe1rcxtHZFwZGlnb0YU0KMSb7JmHIUZ;
Message-ID: <4D8BA070.3040706@KingsMountain.com>
Date: Thu, 24 Mar 2011 12:50:08 -0700
From: =JeffH <Jeff.Hodges@KingsMountain.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.14) Gecko/20110223 Thunderbird/3.1.8
MIME-Version: 1.0
To: IETF WebSec WG <websec@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: [websec] fyi: Unofficial Draft of Content Security Policy (CSP)
Precedence: list

Of possible interest:

CSP is being discussed here..

http://lists.w3.org/Archives/Public/public-web-security/

My recent review..

http://lists.w3.org/Archives/Public/public-web-security/2011Mar/0039.html


Original CSP-as-unofficial-"w3c format"-draft announcements..

------- Forwarded Messages

Date:    Thu, 03 Mar 2011 10:17:47 -0800
From:    Brandon Sterne <bsterne@mozilla.com>
To:      "public-web-security@w3.org" <public-web-security@w3.org>
Subject: Unofficial Draft of Content Security Policy

Hello all,

Apologies for the delays in getting this published.  You can find the
first Unofficial Draft of the Content Security Policy specification here:
https://dvcs.w3.org/hg/content-security-policy/raw-file/bcf1c45f312f/csp-unoffi
cial-draft-20110303.html

I hope you will find the new format well-organized and reflective of our
discussion so far.  While this document will likely remain in Unofficial
Draft status until we get our charter reviewed and accepted, in the
meantime this it should provide a good basis for further discussions.  I
look forward to receiving your feedback.

Best,
Brandon


------- Message 2

Date:    Tue, 15 Mar 2011 17:07:09 -0700
From:    Brandon Sterne <bsterne@mozilla.com>
To:      "public-web-security@w3.org" <public-web-security@w3.org>
Subject: [Content Security Policy] unofficial draft revision

Hello all,

Just wanted to let you know that I pushed a new revision of the CSP
unofficial draft:
https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-unofficial-draf
t-20110315.html

This revision added CSS image loading to the image-src directive and
converted the grammar to ABNF.  Many thanks to Adam for helping me with
some of the trickier aspects of the grammar conversion.

You can see just the changes here if you're interested:
https://dvcs.w3.org/hg/content-security-policy/diff/1a29ed0d9fdc/csp-specificat
ion.dev.html

Cheers,
Brandon


------- End of Forwarded Messages

[websec] fyi: Unofficial Draft of Content Securit… =JeffH