Web Application Security Working Group - Activity
No matches.
GitHub
w3c/webappsec-csp
-
1 issue opened.
-
CSP reports triggered by resources loaded by cross-origin no-cors opaque responses w3c/webappsec-csp#828, by @antosart.
-
-
4 issues received 11 new comments.
-
CSP reports triggered by resources loaded by cross-origin no-cors opaque responses w3c/webappsec-csp#828 (5 comments by @annevk, @antosart, @noamr)
-
Format of URL values in the expanded hashes proposal w3c/webappsec-csp#826 (4 comments by @annevk, @janvarga, @mozfreddyb)
-
w3c/trusted-types
-
1 issue received 1 new comment.
-
[meta] What's left to do before everything is upstreamed? w3c/trusted-types#617 (1 comment by @annevk)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Let a site restrict saved-password suggestions to its exact origin (opt out of sibling-subdomain logins) w3c/webappsec-credential-management#308, by @a4992214.
-
TR publications
-
4 documents published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Permissions published as a Working Draft. History of Permissions
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Past meetings
Participants
-
5 participants joined.
-
Lucas Santos (Google LLC) joined.
-
Rajan Karmacharya (Global Cybersecurity Community Forum) joined.
-
Monica CHINTALA (Microsoft Corporation) joined.
-
Kumar Pudashine (Global Cybersecurity Community Forum) joined.
-
Artiom Casapu (Google LLC) joined.
-
-
3 participants left.
-
Jeffrey Yasskin (Google LLC) left.
-
Limin Zhu (Microsoft Corporation) left.
-
Matthew Miller (Cisco) left.
-
-
1 organization joined.
-
Global Cybersecurity Community Forum joined.
-
GitHub
w3c/webappsec-csp
-
4 issues opened.
-
Allowing eval-hashes for APIs covered by 'wasm-unsafe-eval' w3c/webappsec-csp#827, by @arturjanc.
-
Format of URL values in the expanded hashes proposal w3c/webappsec-csp#826, by @arturjanc.
-
Queue a task should specify a task source w3c/webappsec-csp#825, by @antosart.
-
-
2 issues received 9 new comments.
-
Format of URL values in the expanded hashes proposal w3c/webappsec-csp#826 (6 comments by @annevk, @camillelamy, @janvarga)
-
`'strict-dynamic'` might be bypassed with `<link rel=modulepreload>` w3c/webappsec-csp#823 (3 comments by @annevk, @camillelamy, @roberto-apple)
-
-
1 pull request received 4 new comments.
-
Integrate with speculation rules w3c/webappsec-csp#808 (4 comments by @annevk, @MayyaSunil, @SulemanAhmadd, @tunetheweb)
-
w3c/permissions
-
4 issues opened.
-
"Set a permission" matches targets against |key| instead of |target key| w3c/permissions#481, by @marcoscaceres.
-
3 pull requests opened.
-
Remove a duplicated word in permission key generation w3c/permissions#484, by @JinDX.
-
Compare permission targets against the resolved target key w3c/permissions#483, by @JinDX.
-
Add permission overrides and a selection field to permissions.setPermission w3c/permissions#482, by @marcoscaceres.
-
-
1 pull request merged.
-
Remove a duplicated word in permission key generation w3c/permissions#484.
-
-
3 pull requests received 4 new comments.
-
Add permission overrides and a selection field to permissions.setPermission w3c/permissions#482 (2 comments by @antosart, @marcoscaceres)
-
w3c/permissions#485 (1 comment by @w3cbot)
-
w3c/webcrypto
-
2 issues received 7 new comments.
-
Proposal: `randomUUIDv7()` w3c/webcrypto#561 (6 comments by @annevk, @davidben, @htunnicliff, @mikewest)
-
Consider dropping the secure context requirement for `randomUUID()` w3c/webcrypto#408 (1 comment by @gwillen)
-
-
2 pull requests opened.
-
Update the reference for HMAC to SP 800-224 w3c/webcrypto#565, by @twiss.
-
Fix `SubjectPublicKeyInfo` ASN.1 mappings for Ed/X25519 w3c/webcrypto#564, by @twiss.
-
-
2 pull requests merged.
-
Update the reference for HMAC to SP 800-224 w3c/webcrypto#565.
-
Fix `SubjectPublicKeyInfo` ASN.1 mappings for Ed/X25519 w3c/webcrypto#564.
-
-
1 pull request received 1 new comment.
w3c/webappsec-credential-management
-
1 pull request opened.
-
Add CredentialUiMode/passive in support of Conditional UI without Autofill w3c/webappsec-credential-management#307, by @kenrb.
-
-
1 pull request received 3 new comments.
-
Add CredentialUiMode/passive in support of Conditional UI without Autofill w3c/webappsec-credential-management#307 (3 comments by @kenrb, @nsatragno, @sbweeden)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Example 3. is misleading (applies only to direct children and not all descendant navigables) w3c/webappsec-permissions-policy#599, by @antosart.
-
-
2 issues closed.
-
Need to define the language used to define the ASCII serialization of policy directives w3c/webappsec-permissions-policy#222.
-
allow attribute prose and algorithm don't quite agree w3c/webappsec-permissions-policy#146.
-
-
2 issues received 2 new comments.
-
Example 3. is misleading (applies only to direct children and not all descendant navigables) w3c/webappsec-permissions-policy#599 (1 comment by @antosart)
-
-
6 pull requests opened.
-
Remove the script introspection API w3c/webappsec-permissions-policy#600, by @marcoscaceres.
-
Replace the allow attribute grammar with prose author requirements w3c/webappsec-permissions-policy#598, by @marcoscaceres.
-
Ignore blob URLs and URLs with credentials in the iframe allow attribute w3c/webappsec-permissions-policy#597, by @marcoscaceres.
-
Match feature names case-sensitively w3c/webappsec-permissions-policy#596, by @marcoscaceres.
-
Ignore wildcard hosts in the iframe allow attribute w3c/webappsec-permissions-policy#595, by @marcoscaceres.
-
Keep the first entry when the allow attribute names a feature twice w3c/webappsec-permissions-policy#594, by @marcoscaceres.
-
-
7 pull requests merged.
-
Add security/privacy questionnaire for focus-without-user-activation w3c/webappsec-permissions-policy#583.
-
[focus-without-user-activation] Update explainer w3c/webappsec-permissions-policy#584.
-
Register publickey-credentials-remote-client-data-json feature w3c/webappsec-permissions-policy#586.
-
Add 'haptics' feature link to features.md w3c/webappsec-permissions-policy#590.
-
Keep the first entry when the allow attribute names a feature twice w3c/webappsec-permissions-policy#594.
-
Ignore blob URLs and URLs with credentials in the iframe allow attribute w3c/webappsec-permissions-policy#597.
-
Replace the allow attribute grammar with prose author requirements w3c/webappsec-permissions-policy#598.
-
-
9 pull requests closed.
-
add none as an allowed default w3c/webappsec-permissions-policy#515.
-
Update "Is feature enabled in document for origin?" behavior w3c/webappsec-permissions-policy#499.
-
Feature registry w3c/webappsec-permissions-policy#366.
-
Fix navigation race w3c/webappsec-permissions-policy#358.
-
HTML <meta>-delivery w3c/webappsec-permissions-policy#313.
-
Add Feature Policy for workers w3c/webappsec-permissions-policy#174.
-
Clarify child inheritance w3c/webappsec-permissions-policy#90.
-
Update section on 'Other and related mechanisms' w3c/webappsec-permissions-policy#82.
-
[focus-without-user-activation] Add pseudo algorithm and examples w3c/webappsec-permissions-policy#574.
-
-
1 pull request reopened.
-
Allow for User Agent discretion when checking permission policy w3c/webappsec-permissions-policy#572, by @arichiv.
-
-
17 pull requests received 22 new comments.
-
Rename PermissionsPolicy interface back to FeaturePolicy w3c/webappsec-permissions-policy#582 (5 comments by @annevk, @arichiv, @marcoscaceres)
-
[focus-without-user-activation] Add pseudo algorithm and examples w3c/webappsec-permissions-policy#574 (2 comments by @arichiv, @ffiori)
-
Allow for User Agent discretion when checking permission policy w3c/webappsec-permissions-policy#572 (1 comment by @arichiv)
-
Update "Is feature enabled in document for origin?" behavior w3c/webappsec-permissions-policy#499 (1 comment by @arichiv)
-
Update section on 'Other and related mechanisms' w3c/webappsec-permissions-policy#82 (1 comment by @arichiv)
-
Add security/privacy questionnaire for focus-without-user-activation w3c/webappsec-permissions-policy#583 (1 comment by @arichiv)
-
[focus-without-user-activation] Update explainer w3c/webappsec-permissions-policy#584 (1 comment by @arichiv)
-
Ignore wildcard hosts in the iframe allow attribute w3c/webappsec-permissions-policy#595 (1 comment by @arichiv)
-
Ignore blob URLs and URLs with credentials in the iframe allow attribute w3c/webappsec-permissions-policy#597 (1 comment by @arichiv)
-
w3c/webappsec
-
1 issue opened.
-
DM Network business information w3c/webappsec#711, by @dinsovannpanha80-png.
-
-
2 issues closed.
-
Planning 2026-10-21 w3c/webappsec#710.
-
DM Network business information w3c/webappsec#711.
-
-
2 issues received 29 new comments.
-
Planning TPAC 2026 w3c/webappsec#709 (28 comments by @annevk, @antosart, @arnar, @arturjanc, @azaika, @camillelamy, @DCtheTall, @decleezy, @hubertchao, @johannhof, @marcoscaceres, @MayyaSunil, @miketaylr, @mikewest, @mozfreddyb, @noamr, @torgo, @vickiez, @yoavweiss)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Registration request still requires an Authorization header that has been removed w3c/webappsec-dbsc#269, by @Sam-Hobson.
-
-
1 pull request opened.
-
Treat 429 like a 5xx in the session request algorithm w3c/webappsec-dbsc#270, by @MarshallOfSound.
-
w3c/webappsec-cspee
-
1 pull request received 4 new comments.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36 (4 comments by @antosart, @koto, @vickiez)
-
w3c/trusted-types
-
2 issues opened.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618, by @hybrist.
-
[meta] What's left to do before everything is upstreamed? w3c/trusted-types#617, by @lukewarlow.
-
-
3 issues closed.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618.
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615.
-
-
3 issues received 4 new comments.
-
Update Integrations wiki: React 19.3.0 has shipped Trusted Types support w3c/trusted-types#618 (2 comments by @hybrist, @lukewarlow)
-
[meta] What's left to do before everything is upstreamed? w3c/trusted-types#617 (1 comment by @lukewarlow)
-
HTMLScriptElement doesn't show trusted types API in `@webref/idl` w3c/trusted-types#605 (1 comment by @lukewarlow)
-
-
2 pull requests merged.
-
Add new update script trustedness algorithm for the HTML spec to call w3c/trusted-types#607.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606.
-
-
1 pull request received 4 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (4 comments by @annevk, @noamr, @zcorpan)
-
TR publications
-
5 documents published.
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Participants
-
2 participants joined.
-
Viktoria Zlatinova (Microsoft Corporation) joined.
-
Alfie Fresta (Meta) joined.
-
-
3 participants left.
-
Kaushik Satpathy (Yahoo Holdings Inc.) left.
-
Uday Bhaskar Seelamantula (Autodesk) left.
-
Mert Coskuner (Yahoo Holdings Inc.) left.
-
-
1 organization joined.
-
WebDINO Japan joined.
-
-
2 organizations left.
-
Autodesk left.
-
Yahoo Holdings Inc. left.
-
GitHub
w3c/webappsec
-
2 issues opened.
-
Planning 2026-10-21 w3c/webappsec#710, by @dveditz.
-
Planning TPAC 2026 w3c/webappsec#709, by @dveditz.
-
-
2 issues received 5 new comments.
w3c/trusted-types
-
1 issue opened.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615, by @noamr.
-
-
1 issue received 18 new comments.
-
Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) w3c/trusted-types#615 (18 comments by @annevk, @lukewarlow, @mozfreddyb, @noamr, @zcorpan)
-
-
1 pull request opened.
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616, by @zcorpan.
-
-
1 pull request merged.
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616.
-
-
1 pull request reopened.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606, by @noamr.
-
-
3 pull requests received 35 new comments.
-
Enable createParserOptions, passing a sanitizer to trusted types w3c/trusted-types#606 (32 comments by @annevk, @evilpie, @noamr, @zcorpan)
-
Reject `TrustedHTML` with an unvetted sanitizer or `runScripts` w3c/trusted-types#616 (2 comments by @zcorpan)
-
Add new update script trustedness algorithm for the HTML spec to call w3c/trusted-types#607 (1 comment by @lukewarlow)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Add further necessary text to the “Navigation through history” bulleted item in “Directly User-Initiated Requests” w3c/webappsec-fetch-metadata#100, by @sideshowbarker.
-
-
1 pull request opened.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99, by @TimvdLippe.
-
-
1 pull request merged.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99.
-
-
1 pull request received 4 new comments.
-
Use current URL for `Sec-Fetch-` headers w3c/webappsec-fetch-metadata#99 (4 comments by @annevk, @mikewest, @TimvdLippe, @w3cbot)
-
w3c/webcrypto
-
1 issue opened.
-
ECDSA normalization: repeated name getters and transfer-test expectations w3c/webcrypto#563, by @afflom.
-
-
1 issue received 1 new comment.
-
ECDSA normalization: repeated name getters and transfer-test expectations w3c/webcrypto#563 (1 comment by @twiss)
-
-
1 pull request opened.
-
Add randomUUIDv7() method (RFC 9562) w3c/webcrypto#562, by @gianluca-pettenon.
-
-
1 pull request received 1 new comment.
w3c/webappsec-secure-contexts
-
3 issues opened.
-
Taking wats Mys 💯 w3c/webappsec-secure-contexts#120, by @odiged8-hash.
-
chamchamal w3c/webappsec-secure-contexts#119, by @sherkoaziz8-eng.
-
Secure contexts non-normative introduction w3c/webappsec-secure-contexts#118, by @wbamberg.
-
-
2 issues closed.
-
chamchamal w3c/webappsec-secure-contexts#119.
-
Taking wats Mys 💯 w3c/webappsec-secure-contexts#120.
-
w3c/webappsec-permissions-policy
-
4 issues received 20 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (16 comments by @Dreamsorcerer, @ecki, @Gunni, @jvoisin, @RealAlphabet)
-
Proposal: allow grouping permissions by year w3c/webappsec-permissions-policy#481 (2 comments by @IchordeDionysos)
-
How to format report-to directives? w3c/webappsec-permissions-policy#577 (1 comment by @IchordeDionysos)
-
-
2 pull requests opened.
-
Update Owners w3c/webappsec-permissions-policy#593, by @arichiv.
-
Link Structured Fields token and parse report-to parameter as token w3c/webappsec-permissions-policy#592, by @apasel422.
-
-
2 pull requests merged.
-
Update Owners w3c/webappsec-permissions-policy#593.
-
Link Structured Fields token and parse report-to parameter as token w3c/webappsec-permissions-policy#592.
-
-
1 pull request received 1 new comment.
w3c/permissions
-
1 issue opened.
w3c/webappsec-csp
-
1 issue opened.
-
`'strict-dynamic'` might be bypassed with `<link rel=modulepreload>` w3c/webappsec-csp#823, by @lebr0nli.
-
-
1 issue closed.
-
CSP script-src self and blobs w3c/webappsec-csp#487.
-
-
2 pull requests merged.
-
Update nonceable attribute checks for link elements w3c/webappsec-csp#810.
-
Handle blob scheme when matching 'self' w3c/webappsec-csp#821.
-
-
2 pull requests received 5 new comments.
-
Update nonceable attribute checks for link elements w3c/webappsec-csp#810 (3 comments by @annevk, @evilpie, @mikewest)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172, by @kyle-elliott-tob.
-
-
1 issue closed.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172.
-
-
1 issue received 1 new comment.
-
Clarify mixed-case hash tokens and WSP in Parse Metadata w3c/webappsec-subresource-integrity#172 (1 comment by @kyle-elliott-tob)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Implementation report: dbsc-server (TypeScript server library for Node, Bun, Deno) w3c/webappsec-dbsc#267, by @enda-kelly.
-
-
1 pull request opened.
-
Derive .well-known URLs strictly from canonical origins w3c/webappsec-dbsc#268, by @alhijazi.
-
-
1 pull request merged.
-
Derive .well-known URLs strictly from canonical origins w3c/webappsec-dbsc#268.
-
w3c/webappsec-cspee
-
1 pull request received 1 new comment.
-
Define Trusted Types support in CSP Embedded Enforcement w3c/webappsec-cspee#36 (1 comment by @vickiez)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Permissions Policy rejection in "Request a `Credential`" leaves the credential type active w3c/webappsec-credential-management#305, by @marcoscaceres.
-
-
1 pull request opened.
-
Validate every requested credential type before marking any of them active w3c/webappsec-credential-management#306, by @marcoscaceres.
-
-
1 pull request merged.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304.
-
-
1 pull request received 4 new comments.
-
Reject origin-bound credentials from opaque origins w3c/webappsec-credential-management#304 (4 comments by @marcoscaceres, @mohamedamir)
-