Intent to Ship: CSP rule 'manifest-src'

[Kenneth Rohde Christiansen]

Contact emails

kenneth.r.c...@intel.com

Spec

https://w3c.github.io/webappsec/specs/content-security-policy/#directive-manifest-src

Summary

Allows setting a CSP policy for fetching the Web App Manifest

Link to “Intent to Implement” for Web App Manifest:

https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/qz2pd3MFPKg

Is this feature supported on all five Blink platforms (Windows, Mac, Linux, Chrome OS, WebView, Android)?

Yes

Compatibility Risk

Small. The feature has been deeply discussed with the WebAppSec group and the editors of the Web App Manifest, and it is now being implemented in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1089255

Developers are also having problems with it not being enabled in Chrome currently: https://github.com/h5bp/html5boilerplate.com/issues/133#issuecomment-97743407

Link to entry on the feature dashboard

https://www.chromestatus.com/features/5679927315660800

[Philip Jägenstedt]

LGTM

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

[mar...@marcosc.com]

On Wednesday, May 6, 2015 at 6:41:18 AM UTC-4, Kenneth Rohde Christiansen wrote:

Compatibility Risk

Small. The feature has been deeply discussed with the WebAppSec group and the editors of the Web App Manifest, and it is now being implemented in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=108925

Hope to land on Gecko side in the next two weeks. 

[Joe Medley]

Do you have a guess about which version you want to ship in?

Joe Medley | Technical Writer, DevPlat | jme...@google.com | 816-678-7195

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

[Marcos Caceres]

On May 6, 2015 at 12:23:19 PM, Joe Medley (jme...@google.com) wrote:
> > Do you have a guess about which version you want to ship in?

Gecko version? Hopefully 41. 

[Kenneth Rohde Christiansen]

The feature is implemented already, and I already have a patch enabling it by default, so my answer would be the earliest release possible

Kenneth

[Mike West]

On Wed, May 6, 2015 at 12:41 PM, Kenneth Rohde Christiansen <kenneth.ch...@gmail.com> wrote:

Compatibility Risk

Small. The feature has been deeply discussed with the WebAppSec group and the editors of the Web App Manifest, and it is now being implemented in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1089255

Developers are also having problems with it not being enabled in Chrome currently: https://github.com/h5bp/html5boilerplate.com/issues/133#issuecomment-97743407

Non-OWNER's LGTM. This directive isn't yet part of an official draft of CSP3, but it's been in the editor's draft for months now, and there seems to be clear agreement that it's needed across the browsers that have implemented manifests.

-mike

[Dimitri Glazkov]

LGTM2.

:DG<

[Jochen Eisinger]

lgtm3

On Wed, May 13, 2015 at 9:40 AM Dimitri Glazkov <dgla...@chromium.org> wrote:

LGTM2.

:DG<

[Joe Medley]

M44 or M45?