[Django] #30746: Add Feature-Policy header support
Django
---------------------------------------+---------------------------
Reporter: Nick Pope | Owner: Nick Pope
Type: New feature | Status: assigned
Component: Utilities | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
---------------------------------------+---------------------------
Similar to planned support for `Referrer-Policy`, we should add `Feature-
Policy` which allows controlling use of browser features.
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
- https://scotthelme.co.uk/a-new-security-header-feature-policy/
- https://www.w3.org/TR/feature-policy/
--
Ticket URL: <https://code.djangoproject.com/ticket/30746>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
Reporter: Nick Pope | Owner: Nick Pope
Type: New feature | Status: assigned
Component: Utilities | Version: master
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by Carlton Gibson):
* stage: Unreviewed => Accepted
--
Ticket URL: <https://code.djangoproject.com/ticket/30746#comment:1>
Django
Reporter: Nick Pope | Owner: Nick Pope
Type: New feature | Status: assigned
Component: Utilities | Version: master
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Comment (by Adam (Chainz) Johnson):
I'm -1 on adding Feature-Policy to Django... right now. It's far too
experimental and evolving much faster than Django's release cycle.
I created django-feature-policy to support it in October last year. Since
then I've done two "breaking changes" releases to update to the supported
set of headers: https://github.com/adamchainz/django-feature-
policy/blob/master/HISTORY.rst
It's still an actively developed w3c spec: https://github.com/w3c
/webappsec-feature-policy/commits/master . Also on the MDN page the
support grid shows that most support, even in Chrome, remains behind
feature flags: https://developer.mozilla.org/en-
US/docs/Web/HTTP/Feature_Policy#Browser_compatibility
I think it'll be settled in a year or so and then it'll be worth adding to
Django core.
--
Ticket URL: <https://code.djangoproject.com/ticket/30746#comment:2>
Django
Reporter: Nick Pope | Owner: Nick Pope
Type: New feature | Status: assigned
Component: Utilities | Version: master
Keywords: | Triage Stage: Someday/Maybe
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by felixxm):
* stage: Accepted => Someday/Maybe
Comment:
I agree with Adam, it's too early. This header is still under development
and it isn't wide-supported.
--
Ticket URL: <https://code.djangoproject.com/ticket/30746#comment:3>
Django
Reporter: Nick Pope | Owner: Nick Pope
Type: New feature | Status: assigned
Component: Utilities | Version: master
Keywords: | Triage Stage: Someday/Maybe
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
Changes (by Nick Pope):
* needs_better_patch: 0 => 1
* has_patch: 0 => 1
* needs_docs: 0 => 1
Comment:
Replying to [comment:2 Adam (Chainz) Johnson]:
> I'm -1 on adding Feature-Policy to Django... right now. It's far too
experimental and evolving much faster than Django's release cycle.
>
> ...
>
> I think it'll be settled in a year or so and then it'll be worth adding
to Django core.
Replying to [comment:3 felixxm]:
> I agree with Adam, it's too early. This header is still under
development and it isn't wide-supported.
I understand and agree. I was hoping to look into supporting `Content-
Security-Policy` too for 3.1 and this is somewhat less complex, but also
similar in syntax, so exploring this will help. Thus I will probably
progress the [https://github.com/django/django/pull/11735 PR] as far as
possible for now and then leave it on ice. We'll have a better idea come
April~May 2020.
--
Ticket URL: <https://code.djangoproject.com/ticket/30746#comment:4>
Django
Reporter: Nick Pope | Owner: Nick Pope
Type: New feature | Status: assigned
Component: Utilities | Version: master
Keywords: | Triage Stage: Someday/Maybe
Has patch: 1 | Needs documentation: 1
Easy pickings: 0 | UI/UX: 0
Comment (by Adam (Chainz) Johnson):
Cool, thanks Nick. I'll be updating django-feature-policy in the mean time
so it'll be useful to see what the changes are (I have a calendar reminder
to check the specs every 3 months).
--
Ticket URL: <https://code.djangoproject.com/ticket/30746#comment:5>
Django
Reporter: Nick Pope | Owner: Nick Pope
Type: New feature | Status: assigned
Component: Utilities | Version: master
Keywords: | Triage Stage: Someday/Maybe
Has patch: 1 | Needs documentation: 1
Easy pickings: 0 | UI/UX: 0
Comment (by Adam (Chainz) Johnson):
P.S. CSP is very ambitious :)
--
Ticket URL: <https://code.djangoproject.com/ticket/30746#comment:6>
Django
-------------------------------------+-------------------------------------
Reporter: Nick Pope | Owner: Nick Pope
Type: New feature | Status: assigned
Component: Utilities | Version: master
Keywords: feature-policy, | Triage Stage:
permissions-policy | Someday/Maybe
Has patch: 1 | Needs documentation: 1
Easy pickings: 0 | UI/UX: 0
Changes (by Nick Pope):
* keywords: => feature-policy, permissions-policy
Old description:
> Similar to planned support for `Referrer-Policy`, we should add `Feature-
> Policy` which allows controlling use of browser features.
>
> - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-
> Policy
> - https://scotthelme.co.uk/a-new-security-header-feature-policy/
> - https://www.w3.org/TR/feature-policy/
New description:
Similar to planned support for `Referrer-Policy`, we should add
`Permissions-Policy` (was `Feature-Policy`) which allows controlling use
of browser features.
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
- https://scotthelme.co.uk/a-new-security-header-feature-policy/
- https://www.w3.org/TR/feature-policy/
--
--
Ticket URL: <https://code.djangoproject.com/ticket/30746#comment:7>