Skip to content

Commit b09ab6b

Browse files
mikewestmikewest
committed
CSP2: Drop the 'CSP' request header.
1 parent 037b426 commit b09ab6b

File tree

3 files changed

+10
-304
lines changed

3 files changed

+10
-304
lines changed

‎specs/CSP2/index.html

Lines changed: 5 additions & 119 deletions
Original file line numberDiff line numberDiff line change
@@ -229,9 +229,8 @@ <h2 class="no-num no-toc no-ref heading settled" id="contents"><span class="cont
229229
<li><a href="#delivery-html-meta-element"><span class="secno">3.3</span> <span class="content">
230230
HTML <code><span>meta</span></code> Element
231231
</span></a>
232-
<li><a href="#csp-request-header"><span class="secno">3.4</span> <span class="content">The <code>CSP</code> HTTP Request Header</span></a>
233-
<li><a href="#enforcing-multiple-policies"><span class="secno">3.5</span> <span class="content">Enforcing multiple policies.</span></a>
234-
<li><a href="#which-policy-applies"><span class="secno">3.6</span> <span class="content">Policy applicability</span></a>
232+
<li><a href="#enforcing-multiple-policies"><span class="secno">3.4</span> <span class="content">Enforcing multiple policies.</span></a>
233+
<li><a href="#which-policy-applies"><span class="secno">3.5</span> <span class="content">Policy applicability</span></a>
235234
</ul>
236235
<li><a href="#syntax-and-algorithms"><span class="secno">4</span> <span class="content">Syntax and Algorithms</span></a>
237236
<ul class="toc">
@@ -357,7 +356,6 @@ <h2 class="no-num no-toc no-ref heading settled" id="contents"><span class="cont
357356
<ul class="toc">
358357
<li><a href="#iana-content-security-policy"><span class="secno">11.1</span> <span class="content">Content-Security-Policy</span></a>
359358
<li><a href="#iana-content-security-policy-report-only"><span class="secno">11.2</span> <span class="content">Content-Security-Policy-Report-Only</span></a>
360-
<li><a href="#iana-csp"><span class="secno">11.3</span> <span class="content">CSP</span></a>
361359
</ul>
362360
<li><a href="#acknowledgements"><span class="secno">12</span> <span class="content">Acknowledgements</span></a>
363361
<li><a href="#conformance"><span class="secno"></span> <span class="content">Conformance</span></a>
@@ -533,12 +531,6 @@ <h3 class="heading settled" data-level="1.1" id="changes-from-level-1"><span cla
533531

534532

535533

536-
<li>
537-
A <code>CSP</code> request header is now sent with relevant requests, as
538-
described in <a href="#csp-request-header">§3.4 The CSP HTTP Request Header</a>.
539-
540-
541-
542534
<li>
543535
A <code class="idl"><a data-link-type="idl" href="#securitypolicyviolationevent">SecurityPolicyViolationEvent</a></code> is fired upon violations, as described
544536
in <a href="#firing-securitypolicyviolationevent-events">§6.3 Firing Violation Events</a>.
@@ -814,10 +806,6 @@ <h2 class="heading settled" data-level="3" id="policy-delivery"><span class="sec
814806
<a href="#content-security-policy-report-only-header-field">§3.2 Content-Security-Policy-Report-Only Header Field</a>) or an HTML
815807
<code><a data-link-type="element" href="http://www.w3.org/TR/html5/document-metadata.html#the-meta-element">meta</a></code> element (defined in <a href="#delivery-html-meta-element">§3.3 HTML meta Element</a>).</p>
816808

817-
818-
<p>Servers are informed that requests are coming from a <a data-link-type="dfn" href="#protected-resource">protected resource</a>
819-
via an HTTP request header (defined in <a href="#csp-request-header">§3.4 The CSP HTTP Request Header</a>).</p>
820-
821809

822810
<section>
823811

@@ -1035,7 +1023,7 @@ <h3 class="heading settled" data-level="3.3" id="delivery-html-meta-element"><sp
10351023
<p class="note" role="note">Note: A <a data-link-type="dfn" href="#security-policy">policy</a> specified via a <code><a data-link-type="element" href="http://www.w3.org/TR/html5/document-metadata.html#the-meta-element">meta</a></code> element will be enforced
10361024
along with any other policies active for the protected resource, regardless
10371025
of where they’re specified. The general impact of enforcing multiple
1038-
policies is described in <a href="#enforcing-multiple-policies">§3.5 Enforcing multiple policies.</a>.</p>
1026+
policies is described in <a href="#enforcing-multiple-policies">§3.4 Enforcing multiple policies.</a>.</p>
10391027

10401028

10411029

@@ -1053,53 +1041,7 @@ <h3 class="heading settled" data-level="3.3" id="delivery-html-meta-element"><sp
10531041

10541042
<section>
10551043

1056-
<h3 class="heading settled" data-level="3.4" id="csp-request-header"><span class="secno">3.4. </span><span class="content">The <code>CSP</code> HTTP Request Header</span><a class="self-link" href="#csp-request-header"></a></h3>
1057-
1058-
1059-
1060-
<p>The <code><dfn data-dfn-type="dfn" data-noexport="" id="csp">CSP<a class="self-link" href="#csp"></a></dfn></code> header field indicates that a particular
1061-
request is subject to a <a data-link-type="dfn" href="#security-policy">policy</a>, and its value is defined by the
1062-
following ABNF grammar:</p>
1063-
1064-
1065-
1066-
<pre>"CSP:" <a data-link-type="dfn" href="#csp_header_value">csp-header-value</a>
1067-
1068-
<dfn data-dfn-type="dfn" data-noexport="" id="csp_header_value">csp-header-value<a class="self-link" href="#csp_header_value"></a></dfn> = *WSP "active" *WSP
1069-
</pre>
1070-
1071-
1072-
1073-
<p>If the user agent is <a data-link-type="dfn" href="#monitor">monitoring</a> or <a data-link-type="dfn" href="#enforce">enforcing</a> a <a data-link-type="dfn" href="#security-policy">policy</a>
1074-
that includes directives whose value is a <a data-link-type="dfn" href="#source-list">source list</a>, then the user
1075-
agent MUST send a header field named <code>CSP</code> along with requests
1076-
for resources whose <a data-link-type="dfn" href="#origin">origin</a> <em>does not</em> match the <a data-link-type="dfn" href="#protected-resource">protected
1077-
resource</a>’s origin. The value of this header MUST be <code>active</code>.</p>
1078-
1079-
1080-
1081-
<p>The user agent MAY choose to send this header only if the request is for a
1082-
resource type which the active policy would effect. That is, given a policy
1083-
of <code>img-src example.com</code>, the user agent would send <code>CSP:
1084-
active</code> along with requests for images, but might choose not to send
1085-
the header with requests for script.</p>
1086-
1087-
1088-
1089-
<p class="note" role="note">Note: The central reason for including this header is that it hints to a
1090-
server that information about redirects might be leaked as a side-effect
1091-
of a page’s active policy. If this header is present, a server might decline
1092-
to redirect a logged-out user from <code>example.com</code> to
1093-
<code>accounts.example.com</code>, for example, as a malicious embedder
1094-
might otherwise be able to determine the user’s logged-in status.</p>
1095-
1096-
1097-
</section>
1098-
1099-
1100-
<section>
1101-
1102-
<h3 class="heading settled" data-level="3.5" id="enforcing-multiple-policies"><span class="secno">3.5. </span><span class="content">Enforcing multiple policies.</span><a class="self-link" href="#enforcing-multiple-policies"></a></h3>
1044+
<h3 class="heading settled" data-level="3.4" id="enforcing-multiple-policies"><span class="secno">3.4. </span><span class="content">Enforcing multiple policies.</span><a class="self-link" href="#enforcing-multiple-policies"></a></h3>
11031045

11041046

11051047

@@ -1149,7 +1091,7 @@ <h3 class="heading settled" data-level="3.5" id="enforcing-multiple-policies"><s
11491091

11501092
<section>
11511093

1152-
<h3 class="heading settled" data-level="3.6" id="which-policy-applies"><span class="secno">3.6. </span><span class="content">Policy applicability</span><a class="self-link" href="#which-policy-applies"></a></h3>
1094+
<h3 class="heading settled" data-level="3.5" id="which-policy-applies"><span class="secno">3.5. </span><span class="content">Policy applicability</span><a class="self-link" href="#which-policy-applies"></a></h3>
11531095

11541096

11551097

@@ -2641,12 +2583,6 @@ <h2 class="heading settled" data-level="5" id="processing-model"><span class="se
26412583
an unrecognized directive, the user agent SHOULD report a warning message
26422584
in the developer console indicating the name of the unrecognized directive.</p>
26432585

2644-
2645-
<p>If the user agent <a data-link-type="dfn" href="#monitor">monitors</a> or <a data-link-type="dfn" href="#enforce">enforces</a> a policy that contains
2646-
a directive that contains a <a data-link-type="dfn" href="#source-list">source list</a>, then the user agent MUST set
2647-
a <code><a data-link-type="dfn" href="#csp">CSP</a></code> Request Header when requesting cross-origin
2648-
resources, as described in <a href="#csp-request-header">§3.4 The CSP HTTP Request Header</a>.</p>
2649-
26502586

26512587
<section>
26522588

@@ -5309,54 +5245,6 @@ <h3 class="heading settled" data-level="11.2" id="iana-content-security-policy-r
53095245
</dl>
53105246

53115247

5312-
</section>
5313-
5314-
5315-
<section>
5316-
5317-
<h3 class="heading settled" data-level="11.3" id="iana-csp"><span class="secno">11.3. </span><span class="content">CSP</span><a class="self-link" href="#iana-csp"></a></h3>
5318-
5319-
5320-
5321-
<dl>
5322-
5323-
<dt>Header field name
5324-
5325-
5326-
<dd>CSP
5327-
5328-
5329-
5330-
<dt>Applicable protocol
5331-
5332-
5333-
<dd>http
5334-
5335-
5336-
5337-
<dt>Status
5338-
5339-
5340-
<dd>standard
5341-
5342-
5343-
5344-
<dt>Author/Change controller
5345-
5346-
5347-
<dd>W3C
5348-
5349-
5350-
5351-
<dt>Specification document
5352-
5353-
5354-
<dd>This specification (See <a href="#csp-request-header">§3.4 The CSP HTTP Request Header</a>)
5355-
5356-
5357-
</dl>
5358-
5359-
53605248
</section>
53615249
</section>
53625250

@@ -5492,8 +5380,6 @@ <h3 class="no-num heading settled" id="index-defined-here"><span class="content"
54925380
<li><a href="#content_security_policy_report_only">Content-Security-Policy-Report-Only</a><span>, in §3.2</span>
54935381
<li><a href="#content-security-policy-task-source">Content Security Policy task
54945382
source</a><span>, in §4.4</span>
5495-
<li><a href="#csp">CSP</a><span>, in §3.4</span>
5496-
<li><a href="#csp_header_value">csp-header-value</a><span>, in §3.4</span>
54975383
<li><a href="#default-sources">default sources</a><span>, in §7.4</span>
54985384
<li><a href="#default_src">default-src</a><span>, in §7.4</span>
54995385
<li><a href="#digest-of-elements-content">digest of element’s content</a><span>, in §4.2.5</span>

‎specs/CSP2/index.src.html

Lines changed: 0 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -323,10 +323,6 @@ <h3 id="changes-from-level-1">Changes from Level 1</h3>
323323
(as described in [[#source-list-valid-nonces]]) and hashes (as described
324324
in [[#source-list-valid-hashes]]).
325325
</li>
326-
<li>
327-
A <code>CSP</code> request header is now sent with relevant requests, as
328-
described in [[#csp-request-header]].
329-
</li>
330326
<li>
331327
A {{SecurityPolicyViolationEvent}} is fired upon violations, as described
332328
in [[#firing-securitypolicyviolationevent-events]].
@@ -531,9 +527,6 @@ <h2 id="policy-delivery">Policy Delivery</h2>
531527
header (defined in [[#content-security-policy-header-field]] and
532528
[[#content-security-policy-report-only-header-field]]) or an HTML
533529
<{meta}> element (defined in [[#delivery-html-meta-element]]).
534-
535-
Servers are informed that requests are coming from a <a>protected resource</a>
536-
via an HTTP request header (defined in [[#csp-request-header]]).
537530

538531
<section>
539532
<h3 id="content-security-policy-header-field">
@@ -686,39 +679,6 @@ <h3 id="delivery-html-meta-element">
686679
header is <em>not</em> supported inside a <{meta}> element.
687680
</section>
688681

689-
<section>
690-
<h3 id="csp-request-header">The <code>CSP</code> HTTP Request Header</h3>
691-
692-
The <code><dfn>CSP</dfn></code> header field indicates that a particular
693-
request is subject to a <a>policy</a>, and its value is defined by the
694-
following ABNF grammar:
695-
696-
<pre>
697-
"CSP:" <a>csp-header-value</a>
698-
699-
<dfn>csp-header-value</dfn> = *WSP "active" *WSP
700-
</pre>
701-
702-
If the user agent is <a>monitoring</a> or <a>enforcing</a> a <a>policy</a>
703-
that includes directives whose value is a <a>source list</a>, then the user
704-
agent MUST send a header field named <code>CSP</code> along with requests
705-
for resources whose <a>origin</a> <em>does not</em> match the <a>protected
706-
resource</a>'s origin. The value of this header MUST be <code>active</code>.
707-
708-
The user agent MAY choose to send this header only if the request is for a
709-
resource type which the active policy would effect. That is, given a policy
710-
of <code>img-src example.com</code>, the user agent would send <code>CSP:
711-
active</code> along with requests for images, but might choose not to send
712-
the header with requests for script.
713-
714-
Note: The central reason for including this header is that it hints to a
715-
server that information about redirects might be leaked as a side-effect
716-
of a page's active policy. If this header is present, a server might decline
717-
to redirect a logged-out user from <code>example.com</code> to
718-
<code>accounts.example.com</code>, for example, as a malicious embedder
719-
might otherwise be able to determine the user's logged-in status.
720-
</section>
721-
722682
<section>
723683
<h3 id="enforcing-multiple-policies">Enforcing multiple policies.</h3>
724684

@@ -1749,11 +1709,6 @@ <h2 id="processing-model">Processing Model</h2>
17491709
an unrecognized directive, the user agent SHOULD report a warning message
17501710
in the developer console indicating the name of the unrecognized directive.
17511711

1752-
If the user agent <a>monitors</a> or <a>enforces</a> a policy that contains
1753-
a directive that contains a <a>source list</a>, then the user agent MUST set
1754-
a <code><a>CSP</a></code> Request Header when requesting cross-origin
1755-
resources, as described in [[#csp-request-header]].
1756-
17571712
<section>
17581713
<h3 id="processing-model-workers">Workers</h3>
17591714

@@ -3654,27 +3609,6 @@ <h3 id="iana-content-security-policy-report-only">Content-Security-Policy-Report
36543609
<code><a>Content-Security-Policy-Report-Only</a></code> Header Field)</dd>
36553610
</dl>
36563611
</section>
3657-
3658-
<section>
3659-
<h3 id="iana-csp">CSP</h3>
3660-
3661-
<dl>
3662-
<dt>Header field name</dt>
3663-
<dd>CSP</dd>
3664-
3665-
<dt>Applicable protocol</dt>
3666-
<dd>http</dd>
3667-
3668-
<dt>Status</dt>
3669-
<dd>standard</dd>
3670-
3671-
<dt>Author/Change controller</dt>
3672-
<dd>W3C</dd>
3673-
3674-
<dt>Specification document</dt>
3675-
<dd>This specification (See [[#csp-request-header]])</dd>
3676-
</dl>
3677-
</section>
36783612
</section>
36793613

36803614
<section>

0 commit comments

Comments
 (0)