Skip to content

Conversation

@rik
Copy link
Contributor

@rik rik commented Jun 26, 2020

From the CSP specification:

The child-src model has been substantially altered:

  1. The frame-src directive, which was deprecated in CSP Level 2, has been undeprecated, but continues to defer to child-src if not present (which defers to default-src in turn).
  2. A worker-src directive has been added, deferring to child-src if not present (which likewise defers to script-src and eventually default-src).
  3. Dedicated workers now always inherit their creator’s policy.

History of this feature


This is basically a revert of #81

@rik rik force-pushed the remove-child-src-warning branch from e812729 to e6761ef Compare June 26, 2020 17:56
From [the CSP specification](https://w3c.github.io/webappsec-csp/#changes-from-level-2):
> The child-src model has been substantially altered:
>
> 1. The frame-src directive, which was deprecated in CSP Level 2, has been undeprecated, but continues to defer to child-src if not present (which defers to default-src in turn).
> 2. A worker-src directive has been added, deferring to child-src if not present (which likewise defers to script-src and eventually default-src).
> 3. Dedicated workers now always inherit their creator’s policy.

[History of this feature](https://stackoverflow.com/questions/46039068/csp-child-src-and-frame-src-deprecated/46042614#46042614)
@rik rik force-pushed the remove-child-src-warning branch from e6761ef to 1f20329 Compare June 26, 2020 18:04
@g-k g-k merged commit f78e70a into mozilla:master Jul 26, 2021
@g-k
Copy link
Contributor

g-k commented Jul 26, 2021

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants