List view

CSP: form-action and redirects

CSP

Status: Open.

#8 In w3c/webappsec-csp;

· mikewest opened on Oct 7, 2015

Prevent CSP reports being sent if I handle the SecurityPolicyViolation event.

addition/proposalNew features or enhancementsNew features or enhancements

Status: Open.

#255 In w3c/webappsec-csp;

· ScottHelme opened on Oct 20, 2017

Allow CSP-Report-Only in meta tags.

Status: Open.

#277 In w3c/webappsec-csp;

· ScottHelme opened on Dec 31, 2017

Allow control over <code>dns-prefetch</code> and <code>preconnect</code>

addition/proposalNew features or enhancementsNew features or enhancements

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#282 In w3c/webappsec-csp;

· annevk opened on Jan 11, 2018

CSP 4 feature request: cookie policy

Status: Open.

#301 In w3c/webappsec-csp;

· AliceWonderMiscreations opened on Apr 7, 2018

CSP Directives Should Be Structured

Status: Open.

#274 In w3c/webappsec-csp;

· David263 opened on Dec 1, 2017

Enable call stack for blocked_uri in Content Security Policy Reporting

Status: Open.

#269 In w3c/webappsec-csp;

· vibhasethi opened on Nov 17, 2017

Add way to define all country code top-level domain.

Status: Open.

#256 In w3c/webappsec-csp;

· AndrewStoyan opened on Oct 20, 2017

Any protection against dynamic module import?

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#243 In w3c/webappsec-csp;

· shhnjk opened on Sep 27, 2017

Should securitypolicyviolation have element set in more cases

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#242 In w3c/webappsec-csp;

· annevk opened on Sep 26, 2017

CSP3: Can be possible adding a <code>max-age</code> or <code>expiration</code> to remember the CSP?

addition/proposalNew features or enhancementsNew features or enhancements

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#233 In w3c/webappsec-csp;

· inkeliz opened on Aug 28, 2017

allow calls to new Function(); - but not to the actual constructed function. under csp unsafe-eval.

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#229 In w3c/webappsec-csp;

· graingert opened on Aug 14, 2017

CSP3: Consider adding a 'clone-src' directive

addition/proposalNew features or enhancementsNew features or enhancements

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#199 In w3c/webappsec-csp;

· jwatt opened on Mar 19, 2017

CSP3: Consider adding a 'resource-src' directive

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#198 In w3c/webappsec-csp;

· jwatt opened on Mar 19, 2017

Include `script-sample' for "eval" violations

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#197 In w3c/webappsec-csp;

· arturjanc opened on Mar 19, 2017

Add keyword to prevent parser-based JS APIs from adding new scripts

addition/proposalNew features or enhancementsNew features or enhancements

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#191 In w3c/webappsec-csp;

· arturjanc opened on Mar 9, 2017

Further granularity of unsafe-inline styles

CORE

Status: Open.

#45 In w3c/webappsec-csp;

· jonathanKingston opened on Dec 3, 2015

do we want a directive to control postMessage explicit channels outbound?

Status: Open.

#117 In w3c/webappsec-csp;

· hillbrad opened on Sep 22, 2016

Allow nonce-source to be used in more directives.

Status: Open.

#116 In w3c/webappsec-csp;

· ScottHelme opened on Sep 11, 2016

Add a new directive governing the use of http-equiv in &lt;meta&gt; tags

Status: Open.

#112 In w3c/webappsec-csp;

· aidantwoods opened on Aug 29, 2016

Add a flag to strip potentially sensitive data from reports

Status: Open.

#111 In w3c/webappsec-csp;

· ScottHelme opened on Aug 26, 2016

Instruct user agents to report invalid policies

Status: Open.

#96 In w3c/webappsec-csp;

· neilstuartcraig opened on Jun 29, 2016

Consider providing a way to tighten source-expressions that contain <code>self</code>

needs concrete proposalMoving the issue forward requires someone to figure out a detailed planMoving the issue forward requires someone to figure out a detailed plan

Status: Open.

#91 In w3c/webappsec-csp;

· shekyan opened on Jun 17, 2016

Allow dynamically enabling/disabling nonce as a source

Status: Open.

#88 In w3c/webappsec-csp;

· devd opened on May 17, 2016

Allow dynamically enabling/disabling unsafe-eval

addition/proposalNew features or enhancementsNew features or enhancements

Status: Open.

#87 In w3c/webappsec-csp;

· devd opened on May 17, 2016