Web Application Security Working Group - Activity
No matches.
TR publications
-
1 document published.
-
Trusted Types published as a Working Draft. History of Trusted Types
-
GitHub
w3c/trusted-types
-
2 issues opened.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618, by @hybrist.
-
[meta] What's left to do before everything is upstreamed? w3c/trusted-types#617, by @lukewarlow.
-
-
3 issues closed.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618.
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615.
-
-
3 issues received 4 new comments.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618 (2 comments by @hybrist, @lukewarlow)
-
[meta] What's left to do before everything is upstreamed? w3c/trusted-types#617 (1 comment by @lukewarlow)
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605 (1 comment by @lukewarlow)
-
-
2 pull requests merged.
-
Add new update script trustedness algorithm for the HTML spec to call w3c/trusted-types#607.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606.
-
-
1 pull request received 4 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (4 comments by @annevk, @noamr, @zcorpan)
-
w3c/webappsec
-
1 issue received 15 new comments.
-
Planning TPAC 2026 w3c/webappsec#709 (15 comments by @annevk, @antosart, @arturjanc, @azaika, @camillelamy, @decleezy, @marcoscaceres, @MayyaSunil, @miketaylr, @noamr, @torgo, @vickiez, @yoavweiss)
-
w3c/webappsec-csp
-
1 issue opened.
-
1 issue received 1 new comment.
-
`'strict-dynamic'` might be bypassed with `<link rel=modulepreload>` w3c/webappsec-csp#823 (1 comment by @camillelamy)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Example 3. is misleading (applies only to direct children and not all descendant navigables) w3c/webappsec-permissions-policy#599, by @antosart.
-
-
2 issues received 2 new comments.
-
Example 3. is misleading (applies only to direct children and not all descendant navigables) w3c/webappsec-permissions-policy#599 (1 comment by @antosart)
-
-
6 pull requests opened.
-
Remove the script introspection API w3c/webappsec-permissions-policy#600, by @marcoscaceres.
-
Replace the allow attribute grammar with prose author requirements w3c/webappsec-permissions-policy#598, by @marcoscaceres.
-
Ignore blob URLs and URLs with credentials in the iframe allow attribute w3c/webappsec-permissions-policy#597, by @marcoscaceres.
-
Match feature names case-sensitively w3c/webappsec-permissions-policy#596, by @marcoscaceres.
-
Ignore wildcard hosts in the iframe allow attribute w3c/webappsec-permissions-policy#595, by @marcoscaceres.
-
Keep the first entry when the allow attribute names a feature twice w3c/webappsec-permissions-policy#594, by @marcoscaceres.
-
-
1 pull request received 4 new comments.
-
Rename PermissionsPolicy interface back to FeaturePolicy w3c/webappsec-permissions-policy#582 (4 comments by @annevk, @marcoscaceres)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Registration request still requires an Authorization header that has been removed w3c/webappsec-dbsc#269, by @Sam-Hobson.
-
w3c/permissions
-
1 issue opened.
-
"Set a permission" matches targets against |key| instead of |target key| w3c/permissions#481, by @marcoscaceres.
-
-
1 pull request opened.
-
Add permission overrides and a selection field to permissions.setPermission w3c/permissions#482, by @marcoscaceres.
-
-
1 pull request received 1 new comment.
-
Add permission overrides and a selection field to permissions.setPermission w3c/permissions#482 (1 comment by @antosart)
-
w3c/webappsec-credential-management
-
1 pull request opened.
-
Add CredentialUiMode/passive in support of Conditional UI without Autofill w3c/webappsec-credential-management#307, by @kenrb.
-
-
1 pull request received 1 new comment.
-
Add CredentialUiMode/passive in support of Conditional UI without Autofill w3c/webappsec-credential-management#307 (1 comment by @nsatragno)
-
w3c/webappsec-cspee
-
1 pull request received 3 new comments.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36 (3 comments by @antosart, @koto)
-
w3c/webcrypto
-
1 issue received 1 new comment.
-
Consider dropping the secure context requirement for `randomUUID()` w3c/webcrypto#408 (1 comment by @gwillen)
-
TR publications
-
5 documents published.
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Participants
-
2 participants joined.
-
Viktoria Zlatinova (Microsoft Corporation) joined.
-
Alfie Fresta (Meta) joined.
-
-
3 participants left.
-
Kaushik Satpathy (Yahoo Holdings Inc.) left.
-
Uday Bhaskar Seelamantula (Autodesk) left.
-
Mert Coskuner (Yahoo Holdings Inc.) left.
-
-
1 organization joined.
-
WebDINO Japan joined.
-
-
2 organizations left.
-
Autodesk left.
-
Yahoo Holdings Inc. left.
-
GitHub
w3c/webappsec
-
2 issues opened.
-
Planning 2026-10-21 w3c/webappsec#710, by @dveditz.
-
Planning TPAC 2026 w3c/webappsec#709, by @dveditz.
-
-
2 issues received 5 new comments.
w3c/trusted-types
-
1 issue opened.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615, by @noamr.
-
-
1 issue received 18 new comments.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615 (18 comments by @annevk, @lukewarlow, @mozfreddyb, @noamr, @zcorpan)
-
-
1 pull request opened.
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616, by @zcorpan.
-
-
1 pull request merged.
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616.
-
-
1 pull request reopened.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606, by @noamr.
-
-
3 pull requests received 35 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (32 comments by @annevk, @evilpie, @noamr, @zcorpan)
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616 (2 comments by @zcorpan)
-
Add new update script trustedness algorithm for the HTML spec to call w3c/trusted-types#607 (1 comment by @lukewarlow)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Add further necessary text to the “Navigation through history” bulleted item in “Directly User-Initiated Requests” w3c/webappsec-fetch-metadata#100, by @sideshowbarker.
-
-
1 pull request opened.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99, by @TimvdLippe.
-
-
1 pull request merged.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99.
-
-
1 pull request received 4 new comments.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99 (4 comments by @annevk, @mikewest, @TimvdLippe, @w3cbot)
-
w3c/webcrypto
-
1 issue opened.
-
ECDSA normalization: repeated name getters and transfer-test expectations w3c/webcrypto#563, by @afflom.
-
-
1 issue received 1 new comment.
-
ECDSA normalization: repeated name getters and transfer-test expectations w3c/webcrypto#563 (1 comment by @twiss)
-
-
1 pull request opened.
-
Add randomUUIDv7() method (RFC 9562) w3c/webcrypto#562, by @gianluca-pettenon.
-
-
1 pull request received 1 new comment.
w3c/webappsec-secure-contexts
-
3 issues opened.
-
Taking wats Mys 💯 w3c/webappsec-secure-contexts#120, by @odiged8-hash.
-
chamchamal w3c/webappsec-secure-contexts#119, by @sherkoaziz8-eng.
-
Secure contexts non-normative introduction w3c/webappsec-secure-contexts#118, by @wbamberg.
-
-
2 issues closed.
-
chamchamal w3c/webappsec-secure-contexts#119.
-
Taking wats Mys 💯 w3c/webappsec-secure-contexts#120.
-
w3c/webappsec-permissions-policy
-
4 issues received 20 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (16 comments by @Dreamsorcerer, @ecki, @Gunni, @jvoisin, @RealAlphabet)
-
Proposal: allow grouping permissions by year w3c/webappsec-permissions-policy#481 (2 comments by @IchordeDionysos)
-
How to format report-to directives? w3c/webappsec-permissions-policy#577 (1 comment by @IchordeDionysos)
-
-
2 pull requests opened.
-
Update Owners w3c/webappsec-permissions-policy#593, by @arichiv.
-
Link Structured Fields token and parse report-to parameter as token w3c/webappsec-permissions-policy#592, by @apasel422.
-
-
2 pull requests merged.
-
Update Owners w3c/webappsec-permissions-policy#593.
-
Link Structured Fields token and parse report-to parameter as token w3c/webappsec-permissions-policy#592.
-
-
1 pull request received 1 new comment.
w3c/permissions
-
1 issue opened.
w3c/webappsec-csp
-
1 issue opened.
-
`'strict-dynamic'` might be bypassed with `<link rel=modulepreload>` w3c/webappsec-csp#823, by @lebr0nli.
-
-
1 issue closed.
-
CSP script-src self and blobs w3c/webappsec-csp#487.
-
-
2 pull requests merged.
-
Update nonceable attribute checks for link elements w3c/webappsec-csp#810.
-
Handle blob scheme when matching 'self' w3c/webappsec-csp#821.
-
-
2 pull requests received 5 new comments.
-
Update nonceable attribute checks for link elements w3c/webappsec-csp#810 (3 comments by @annevk, @evilpie, @mikewest)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172, by @kyle-elliott-tob.
-
-
1 issue closed.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172.
-
-
1 issue received 1 new comment.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172 (1 comment by @kyle-elliott-tob)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Implementation report: dbsc-server (TypeScript server library for Node, Bun, Deno) w3c/webappsec-dbsc#267, by @enda-kelly.
-
-
1 pull request opened.
-
Derive .well-known URLs strictly from canonical origins w3c/webappsec-dbsc#268, by @alhijazi.
-
-
1 pull request merged.
-
Derive .well-known URLs strictly from canonical origins w3c/webappsec-dbsc#268.
-
w3c/webappsec-cspee
-
1 pull request received 1 new comment.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36 (1 comment by @vickiez)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Permissions Policy rejection in "Request a `Credential`" leaves the credential type active w3c/webappsec-credential-management#305, by @marcoscaceres.
-
-
1 pull request opened.
-
Validate every requested credential type before marking any of them active w3c/webappsec-credential-management#306, by @marcoscaceres.
-
-
1 pull request merged.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304.
-
-
1 pull request received 4 new comments.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304 (4 comments by @marcoscaceres, @mohamedamir)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 30 October 2026.
-
TR publications
-
1 document published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
GitHub
w3c/trusted-types
-
3 issues opened.
-
Define a non-writeable non-configurable own `.toString()` on the `Trusted*` objects w3c/trusted-types#613, by @nicolo-ribaudo.
-
`createHTML` in conjunction with XML documents is a bit broken w3c/trusted-types#612, by @noamr.
-
1 issue closed.
-
3 issues received 6 new comments.
-
mXSS: should `createHTML` get information about the context? w3c/trusted-types#569 (3 comments by @annevk, @noamr)
-
Define a non-writeable non-configurable own `.toString()` on the `Trusted*` objects w3c/trusted-types#613 (2 comments by @annevk, @lukewarlow)
-
What is the value of all this, if the web is unsafe by default and safety is opt-in? Why not invert this logic? w3c/trusted-types#614 (1 comment by @lukewarlow)
-
-
1 pull request received 23 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (23 comments by @annevk, @noamr, @zcorpan)
-
w3c/webappsec-permissions-policy
-
3 issues opened.
-
API naming w3c/webappsec-permissions-policy#591, by @simon-friedberger.
-
Kita2 w3c/webappsec-permissions-policy#589, by @matrawybarte-lgtm.
-
Kita w3c/webappsec-permissions-policy#588, by @matrawybarte-lgtm.
-
-
3 issues closed.
-
API naming w3c/webappsec-permissions-policy#591.
-
Kita2 w3c/webappsec-permissions-policy#589.
-
Kita w3c/webappsec-permissions-policy#588.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Add 'haptics' feature link to features.md w3c/webappsec-permissions-policy#590, by @kyerebo.
-
w3c/webappsec-csp
-
2 issues opened.
-
Enhancing import map handling under CSP without `script-src 'unsafe-inline'` in effect w3c/webappsec-csp#822, by @jnsttl.
-
-
1 issue received 1 new comment.
-
2 pull requests opened.
-
Handle blob scheme when matching 'self' w3c/webappsec-csp#821, by @TimvdLippe.
-
Remove redundant TrustedScript data checks from CSP algorithm w3c/webappsec-csp#818, by @Lochipi.
-
-
1 pull request merged.
-
Remove redundant TrustedScript data checks from CSP algorithm w3c/webappsec-csp#818.
-
-
1 pull request closed.
-
Integrate with speculation rules w3c/webappsec-csp#776.
-
-
3 pull requests received 23 new comments.
-
Remove redundant TrustedScript data checks from CSP algorithm w3c/webappsec-csp#818 (14 comments by @antosart, @Lochipi, @lukewarlow, @nicolo-ribaudo)
-
Integrate with speculation rules w3c/webappsec-csp#808 (8 comments by @antosart, @hiroshige-g, @tunetheweb, @vickiez)
-
w3c/webcrypto
-
2 issues opened.
-
Proposal: `randomUUIDv7()` w3c/webcrypto#561, by @htunnicliff.
-
-
1 issue closed.
-
Consider not truncating lengths and instead [EnforceRange]? w3c/webcrypto#429.
-
-
2 issues received 11 new comments.
-
ECDH deriveBits: step 5's OperationError precedes the curve-mismatch check, but no browser does that w3c/webcrypto#560 (3 comments by @annevk, @panva)
-
3 pull requests opened.
-
Remove required and [EnforceRange] attributes from readonly dictionaries w3c/webcrypto#559, by @twiss.
-
Improve algorithm steps for Modern Algorithms' supports() method w3c/webcrypto#558, by @panva.
-
Normalize usage list in generateKey operations w3c/webcrypto#557, by @kkoyung.
-
-
3 pull requests merged.
-
Improve algorithm steps for Modern Algorithms' supports() method w3c/webcrypto#558.
-
Add [EnforceRange] instead of truncating lengths w3c/webcrypto#555.
-
Normalize usage list in generateKey operations w3c/webcrypto#557.
-
-
5 pull requests received 28 new comments.
-
Improve algorithm steps for Modern Algorithms' supports() method w3c/webcrypto#558 (20 comments by @panva, @twiss)
-
Remove required and [EnforceRange] attributes from readonly dictionaries w3c/webcrypto#559 (1 comment by @twiss)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
DBSC registration latency w3c/webappsec-dbsc#265, by @akhilsingh111.
-
-
1 pull request opened.
-
Specify SHA-256 as the JWK Thumbprint hashing algorithm. w3c/webappsec-dbsc#266, by @sbovet-g.
-
-
1 pull request merged.
-
Specify SHA-256 as the JWK Thumbprint hashing algorithm. w3c/webappsec-dbsc#266.
-
-
1 pull request received 1 new comment.
-
Specify SHA-256 as the JWK Thumbprint hashing algorithm. w3c/webappsec-dbsc#266 (1 comment by @drubery)
-
w3c/webappsec-cspee
-
1 pull request opened.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36, by @vickiez.
-
-
1 pull request received 3 new comments.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36 (3 comments by @antosart, @vickiez)
-
w3c/webappsec-credential-management
-
1 pull request received 1 new comment.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304 (1 comment by @marcoscaceres)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
qqq w3c/webappsec-secure-contexts#117, by @vitalijhladun.
-
-
1 issue closed.
-
qqq w3c/webappsec-secure-contexts#117.
-