canmove, Confirmed users
1,537
edits
Security/CSP/Specification: Difference between revisions
m
→Source Expression List
m (→Directives: MUST NOT!) |
|||
| Line 125: | Line 125: | ||
If a port is not specified as the source expression, a User Agent MUST use the default port for the source's scheme (whether it is inherited or explicitly specified in the source expression). | If a port is not specified as the source expression, a User Agent MUST use the default port for the source's scheme (whether it is inherited or explicitly specified in the source expression). | ||
When a scheme alone is the entire source expression (e.g., <tt>javascript:</tt>) a User Agent MUST | When a scheme alone is the entire source expression (e.g., <tt>javascript:</tt>) a User Agent MUST NOT enforce host and port restrictions. This is because for some schemes, host and port are irrelevant (e.g., <tt>data:</tt>). | ||
====Host-less Schemes==== | ====Host-less Schemes==== | ||