Wrap up CSP 3, Move to CSP 4

[shhnjk]

CSP 3 had some important changes.
https://www.w3.org/TR/CSP3/#changes-from-level-2

But CSP 3 is keep growing, and it is difficult for both browser vendors and developers to keep track of changes in CSP 3. We should wrap up CSP 3 so that it will be promoted to CR.

Can I use mentions till CSP 2 since it's CR, and this means that more site will implement child-src, which is deprecated in CSP 3.

There are more benefit, like having stable worker-src in CSP 3 helps Edge and Safari to implement worker-src correctly. This is important since both of them are planning to ship Service Worker soon.

[mikewest]

Yes. @andypaicu is working on tying up the loose ends of whatever we'll end up calling CSP3.

That said, ideally implementers would be working off the editor's draft, and not whatever's in https://www.w3.org/TR (which is perpetually out of date by design). :)

[shhnjk]

Yes. @andypaicu is working on tying up the loose ends of whatever we'll end up calling CSP3.

Great thanks!

That said, ideally implementers would be working off the editor's draft, and not whatever's in
https://www.w3.org/TR (which is perpetually out of date by design). :)

Well, fast implementer after Chrome is Firefox. And they can't keep up with latest spec because it's just too fast (see https://bugzilla.mozilla.org/show_bug.cgi?id=1413492#c2).

And for some late implementers, they need some spec which is decided, and promoted to CR to avoid implementing spec which might have some bugs due to less amount of time given for the review.

[andypaicu]

The CSP3 CR milestone tracks what is needed to wrap up CSP3. Closing this issue

[andypaicu]

If there is something that people feel that should be part of CSP3 and is not in the milestone, let's discuss it here.