{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec/issues/474","labels_url":"https://api.github.com/repos/w3c/webappsec/issues/474/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec/issues/474/comments","events_url":"https://api.github.com/repos/w3c/webappsec/issues/474/events","html_url":"https://github.com/w3c/webappsec/issues/474","id":106947082,"number":474,"title":"CSP: Consider an opt-in cascade model.","user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/w3c/webappsec/labels/CSP","name":"CSP","color":"207de5"}],"state":"open","locked":false,"assignee":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/w3c/webappsec/milestones/1","html_url":"https://github.com/w3c/webappsec/milestones/CSP%203","labels_url":"https://api.github.com/repos/w3c/webappsec/milestones/1/labels","id":687744,"number":1,"title":"CSP 3","description":"","creator":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"open_issues":35,"closed_issues":2,"state":"open","created_at":"2014-06-11T07:23:42Z","updated_at":"2015-09-29T11:54:49Z","due_on":null,"closed_at":null},"comments":11,"created_at":"2015-09-17T09:39:29Z","updated_at":"2015-09-30T10:39:23Z","closed_at":null,"body":"It would be nice if, like `<iframe sandbox>`, we had the ability to constrain the things that a subframe can do. We can't do that by default, as CSP is way too granular to safely apply on behalf of a potentially malicious embedder. It might be workable if the embedee opts-in, however (via CORS or some new mechanism). This could, for instance, be a contractually-enforced portion of an advertiser's deal.\r\n\r\nSomething to consider for CSP3."},"comment":{"url":"https://api.github.com/repos/w3c/webappsec/issues/comments/144350882","html_url":"https://github.com/w3c/webappsec/issues/474#issuecomment-144350882","issue_url":"https://api.github.com/repos/w3c/webappsec/issues/474","id":144350882,"user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"created_at":"2015-09-30T10:39:23Z","updated_at":"2015-09-30T10:39:23Z","body":"Starting on a strawman proposal for this: https://mikewest.github.io/csp-embedded-enforcement/\r\n\r\nIt's all trivial except the subsumption work, which is hugely complicated (as @briansmith suggested). :)"}}