The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 |
Newsgroups: mozilla.dev.security
From: Gervase Markham <g...@mozilla.org>
Date: Tue, 07 Apr 2009 12:01:42 +0100
Local: Tues, Apr 7 2009 7:01 am
Subject: Re: Content Security Policy - final call for comments
On 06/04/09 18:12, Sid Stamm wrote:
> Personally, I don't like the idea of honoring redirects for logging... Surely not? If Site Angelic redirects to Site Be-Evil, We don't send > if a meta tag can be injected into a page (with a CSP header or not) and > the site hosts an open redirect, suddenly cookies can be stolen from all > visitors to a site. Angelic's cookies to Be-Evil, do we? Or have I missed something? You may need to describe the attack scenario in more detail for my small brain. > While it's true that this would be easy to implement, I think we need to But are there not easier ways of doing this - injecting <img> tags for > set a limit. We don't want to spawn off 100 requests every time a policy > is violated. If that happens, attackers could leverage the reporting > mechanism in CSP to flood a network with traffic. 100 images on the target server, for example? Given that the reports are so small, I can't see how anyone would want to use it as a DOS mechanism. We should set a limit. I'm just wondering whether "2" is the most > I'm not convinced that True. It's not a big deal. > widespread use will demand more than two report URIs, and it's not > difficult to set up that report URI recipient service to fork copies to > multiple other destinations. > I think the intention for requiring the allow directive was to force the Fair enough. As long as the JS console/error report says something > policy-writer into writing out the default case to minimize possibility > for false assumptions. I'm not sure though. sensible if it's missing. Gerv You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
| |||||||||||||