diff --git a/index.bs b/index.bs index 748280acce..9184773b01 100644 --- a/index.bs +++ b/index.bs @@ -3555,6 +3555,62 @@ Content-Type: application/reports+json 5. Return "`Allowed`". +

`immutable`

+ + The immutable directive prevents any subsequently declared policies from being applied. + Once a policy containing immutable is processed, all further policy declarations + (via HTTP headers or `` elements) are ignored. + + 
+    directive-name  = "immutable"
+    directive-value = ""
+
+ + The directive takes no value. + +
+ `immutable` processing model +
+ + A policy is immutable if its directive set contains a directive whose name is immutable. + When parsing policies: + + * Policies are processed in order + * If a policy contains `immutable`, all subsequent policies are discarded + * User agents SHOULD issue console warnings when policies are ignored + +
+ 
+      Content-Security-Policy: default-src 'self' example.com; immutable
+      Content-Security-Policy: script-src 'none'
+
+ + Only the first policy applies. The second is ignored. +
+ +
+ 
+      <meta http-equiv="Content-Security-Policy" content="default-src 'self' example.com;">
+      <meta http-equiv="Content-Security-Policy" content="default-src 'self'; immutable">
+      <meta http-equiv="Content-Security-Policy" content="script-src 'none'">
+
+ + The first and second policies are applied. The result of enforcing multiple + policies is described in [[#multiple-policies]]. +
+ +
+ 
+      Content-Security-Policy: default-src 'self' example.com; immutable
+
+ 
+      <meta http-equiv="Content-Security-Policy" content="script-src 'none'">
+
+ + Only the first policy applies. The second is ignored. This is an example of + disabling policies set in `` tags. +
+

Navigation Directives