Intent to Ship: Add `disposition` to SecurityPolicyViolationEvent

55 views
Skip to first unread message

Sergey Shekyan

unread,
Sep 30, 2016, 1:41:11 AM9/30/16
to blin...@chromium.org

Contact emails

she...@gmail.com, mk...@google.com


Spec

https://w3c.github.io/webappsec-csp/#violation-disposition


Summary

This change adds `disposition` property to SecurityPolicyViolationEvent.


Content Security Policy specification introduces disposition of violation [1], that indicates the disposition of the violated policy.

Property value is a read-only string that corresponds to the policy disposition [2], and can be either "enforce" or "report".


[1] https://w3c.github.io/webappsec-csp/#violation-disposition

[2] https://w3c.github.io/webappsec-csp/#policy-disposition


Link to “Intent to Implement” blink-dev discussion

N/A


Is this feature supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

Yes.


Debuggability

This change also introduces new property in Content Security Policy violation report, now sure if affects debuggability.


Interoperability and Compatibility Risk

No other browsers have implemented this yet.




Jochen Eisinger

unread,
Sep 30, 2016, 1:46:05 AM9/30/16
to Sergey Shekyan, blin...@chromium.org

lgtm1

Mike West

unread,
Sep 30, 2016, 3:42:18 AM9/30/16
to Jochen Eisinger, Sergey Shekyan, blink-dev
Non-owner's LGTM. This is a small change to the data we send back in a report, but it will help endpoints like `report-uri.io` and others to distinguish between header types cleanly. I expect other vendors to pick it up pretty quickly to reflect the spec.

-mike

Philip Jägenstedt

unread,
Sep 30, 2016, 3:45:56 AM9/30/16
to Mike West, Jochen Eisinger, Sergey Shekyan, blink-dev
LGTM2

Chris Harrelson

unread,
Sep 30, 2016, 11:06:16 AM9/30/16
to Philip Jägenstedt, Mike West, Jochen Eisinger, Sergey Shekyan, blink-dev
LGTM3

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.

Joe Medley

unread,
Sep 30, 2016, 3:07:26 PM9/30/16
to Chris Harrelson, Philip Jägenstedt, Mike West, Jochen Eisinger, Sergey Shekyan, blink-dev
Is there a Chrome status entry and a tracking bug?

Joe Medley | Technical Writer, Chrome DevRel | jme...@google.com | 816-678-7195
If an API's not documented it doesn't exist.

Sergey Shekyan

unread,
Sep 30, 2016, 3:18:05 PM9/30/16
to Joe Medley, Chris Harrelson, Philip Jägenstedt, Mike West, Jochen Eisinger, blink-dev
There is no Chrome status entry for this change. 
Tracking bug is https://crbug.com/646021 

Cheers,
Sergey
Reply all
Reply to author
Forward
0 new messages