Open
Description
What is the issue with the HTML Standard?
The policy's self origin is not set, which prevents the use of 'self' for policies created via meta elements. However, it is permissible to use 'self' here, for example with this WPT test: https://wpt.live/content-security-policy/connect-src/connect-src-beacon-blocked.sub.html
I believe there should be a step that states something along the lines of:
- Set policy's self-origin to the origin of the meta element's node document.
Metadata
Metadata
Assignees
Labels
No labels