canmove, Confirmed users
1,537
edits
Talk:Security/CSP/Spec: Difference between revisions
→What does 'self' represent? (OPEN): self === (scheme host port)
(→What does 'self' represent? (OPEN): self === (scheme host port)) |
|||
| Line 73: | Line 73: | ||
PublicSuffix+1 is a bad compromise. If we assume the author means exactly and only the host they specify then the policy is clear (no hidden meanings) and can be restrictive if necessary. If the author wants your behavior they can add a wildcard, which also has an explicitly clear meaning. -dveditz | PublicSuffix+1 is a bad compromise. If we assume the author means exactly and only the host they specify then the policy is clear (no hidden meanings) and can be restrictive if necessary. If the author wants your behavior they can add a wildcard, which also has an explicitly clear meaning. -dveditz | ||
== What does 'self' represent? (<span style="color: | == What does 'self' represent? (<span style="color:red;">CLOSED</span>)== | ||
"self" is defined as the scheme/host/port (origin) in the prose, but the flowchart defines it as document.domain. Which is it? -EricLaw | "self" is defined as the scheme/host/port (origin) in the prose, but the flowchart defines it as document.domain. Which is it? -EricLaw | ||
| Line 86: | Line 86: | ||
Would it be difficult to implement an intelligent "self" that was the same as the current URL for all unspecified bits? So it just Did The Right Thing? -- [[User:Gerv|Gerv]] | Would it be difficult to implement an intelligent "self" that was the same as the current URL for all unspecified bits? So it just Did The Right Thing? -- [[User:Gerv|Gerv]] | ||
Not difficult, but ambiguous, and it's not much more difficult to actually type the host name (it ''is'' available in the HTTP request).<br/> | |||
Resolved: self will always represent (scheme, host, port) of the protected document. | |||
--[[User:Sidstamm|Sid]] | |||
== Scheme wildcards (<span style="color:red;">CLOSED</span>)== | == Scheme wildcards (<span style="color:red;">CLOSED</span>)== | ||