Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change semicolons separating directives in examples to commas. #314

Closed
wants to merge 1 commit into from

Conversation

eeeps
Copy link
Contributor

@eeeps eeeps commented May 16, 2019

Two examples in the spec show multiple directives in the same policy header, separated by semicolons. But https://w3c.github.io/webappsec-feature-policy/#algo-parse-header splits headers on commas.

@briansmith
Copy link

I think there should be an issue about how to deal with multiple "Feature-Policy:" headers first.

In particular, note that this:

Feature-Policy: x
Feature-Policy: y

means the same thing as:

Feature-Policy: x, y

You are implicitly implying here that multiple Feature-Policy header fields should be UNIONed together, but in Content Security Policy multiple header fields are INTERSECTed together. It's not clear that UNION is the right thing.

This is why CSP uses semicolons to separate directives within a single policy.

@eeeps
Copy link
Contributor Author

eeeps commented May 17, 2019

Found #148, which clarifies why both are allowed, the differences, and what happens if there are multiples of each.

Hm. Will have to give this a think in the morning.

@clelland
Copy link
Collaborator

This is fairly out-of-date now; since the header was renamed to Permissions-Policy and switched to a structured format, the comma-vs-semicolon issue has been resolved (commas won). In other contexts, like the allow attribute, only semicolons were ever allowed.

@clelland clelland closed this Aug 31, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants