Re: Wellknown suffix proposal: csp.txt

[hiburn 8 <[e-mail]>]

Hi Mark.
Thanks for the quick reply.

I did intend on creating an organisational page and registered csptxt.org
in its place, leave it with me and i'll resubmit with a URI. Will that be
acceptable? I could look into starting an RFC, but i have no experience
with this.

It has not yet been ran by the W3C WebAppSec Working Group (I am not
actually a member). Do you suggest I register and seek a consensus?

thanks again,


On Fri, May 22, 2020 at 3:35 AM Mark Nottingham <[e-mail]> wrote:

> Hello,
>
> Thanks for the request.
>
> The specification needs to be referred to using a URL, not inline.
> Generally, it's best to use an RFC or other publication by a standards
> body, or an organisational page (so that it's more likely to be stable over
> time).
>
> That said, is this being run through the W3C WebAppSec Working Group? If
> not, we'd want to check with them before granting the registration; while
> registering this with a more specific name (e.g., `hiburn8-csp.txt`)
> wouldn't be a problem, consuming `csp.txt` without buy-in from them would
> be problematic.
>
> Cheers,
>
>
> > On 22 May 2020, at 12:25 pm, hiburn 8 <[e-mail]> wrote:
> >
> > URI suffix:  csp.txt
> >
> > Description:
> > The csp.txt suffix should point to a plaintext file. This file describes
> the required Content-Security-Policy
> > (CSP) directives necessary for other origins to embed its content.
> > This would be of use for site administrators to quickly allow content
> from other origins, without
> > being required to first determine the CSP attributes that permit access
> to the content,
> > while maintaining the most restrictive/secure policy. This would also
> allow site owners to quickly resolve
> > content issues; for example, when an allowed javascript file is modified
> to require additional content from
> > another domain which is not permitted by CSP.
> >
> > Specification:
> > There is only one mandatory field for a csp.txt,
> 'Content-Security-Policy'.
> > The value of which is identical to the attributes of a
> Content-Security-Policy (rfc7762) header.
> > Example:
> >
> > ------------------This line is not included----------------------------
> > Content-Security-Policy: font-src example.com; connect-src example.com
> >
> >
> >
> > ------------------This line is not included----------------------------
> >
> >
> >
> >
> > Optionally, the 'Path' field indicates the coverage of the
> 'Content-Security-Policy' field.
> > It describes an absolute or relative path where the CSP attributes apply.
> > This is useful if there are different content services on different
> paths, which can then be added to a CSP
> > selectively. Likewise, the 'Path' field can show the same information
> for subdomains. An omitted 'Path' field
> > is identical to 'Path: /'
> >
> >
> > Example:
> >
> > ------------------This line is not included----------------------------
> > Path: /fonts
> > Content-Security-Policy: font-src example.com;
> > Path: /scripts
> > Content-Security-Policy: script-src example.com; connect-src example.com
> > Path: iframe.example.com
> > Content-Security-Policy: frame-src example
> >
> > ------------------This line is not included----------------------------
> >
> >
> >
> > Additional Info: The main purpose for proposing this suffix is to tackle
> the management overhead of
> > CSPs [Which is a pain in my ass], as well as make CSPs generally more
> secure.
> >
> > - Daniel Reece @hbrn8
> >
> >
> >
> >
> >
> > _______________________________________________
> > wellknown-uri-review mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/wellknown-uri-review
>
> --
> Mark Nottingham   https://www.mnot.net/
>
>