Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions files/en-us/mozilla/firefox/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ page-type: landing-page
sidebar: firefox
---

[Firefox](https://www.firefox.com/en-US/) is Mozilla's popular Web browser, available for multiple platforms including Windows, macOS, and Linux on the desktop and all Android and iOS mobile devices. With broad compatibility, the latest in Web technologies, and powerful development tools, Firefox is a great choice for both Web developers and end users.
[Firefox](https://www.firefox.com/en-US/) is Mozilla's popular web browser, available for multiple platforms including Windows, macOS, and Linux on the desktop and all Android and iOS mobile devices. With broad compatibility, the latest in web technologies, and powerful development tools, Firefox is a great choice for both web developers and end users.

Firefox is an open source project; much of the code is contributed by our huge community of volunteers. Here you can learn about how to contribute to the Firefox project and you will also find links to information about the construction of Firefox add-ons, using the developer tools in Firefox, and other topics.
Firefox is an open-source project; much of the code is contributed by our huge community of volunteers. Here you can learn about how to contribute to the Firefox project and you will also find links to information about the construction of Firefox add-ons, using the developer tools in Firefox, and other topics.

Learn how to create add-ons for [Firefox](https://www.firefox.com/en-US/), how to develop and build Firefox itself, and how the internals of Firefox and its subprojects work.

Expand All @@ -26,7 +26,7 @@ Firefox is available in five **channels**.

### Firefox Nightly

Each night we build Firefox from the latest code in [mozilla-central](https://hg-edge.mozilla.org/mozilla-central/). These builds are for Firefox developers or those who want to try out the very latest cutting edge features while they're still under active development.
Each night we build Firefox from the latest code in [mozilla-central](https://hg-edge.mozilla.org/mozilla-central/). These builds are for Firefox developers or those who want to try out the very latest cutting-edge features while they're still under active development.

[Download Firefox Nightly](https://www.firefox.com/en-US/channel/desktop/#nightly)

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ browser-compat: api.RTCStatsReport.type_inbound-rtp.totalInterFrameDelay
The **`totalInterFrameDelay`** property of the {{domxref("RTCInboundRtpStreamStats")}} dictionary indicates the total accumulated time between consecutively rendered frames, in seconds.
It is recorded after each frame is rendered.

The interframe delay variance be calculated from `totalInterFrameDelay`, {{domxref("RTCInboundRtpStreamStats.totalSquaredInterFrameDelay","totalSquaredInterFrameDelay")}} , and {{domxref("RTCInboundRtpStreamStats.framesRendered","framesRendered")}} according to the formula: `(totalSquaredInterFrameDelay - totalInterFrameDelay^2/ framesRendered)/framesRendered`.
The interframe delay variance can be calculated from `totalInterFrameDelay`, {{domxref("RTCInboundRtpStreamStats.totalSquaredInterFrameDelay","totalSquaredInterFrameDelay")}} , and {{domxref("RTCInboundRtpStreamStats.framesRendered","framesRendered")}} according to the formula: `(totalSquaredInterFrameDelay - totalInterFrameDelay^2/ framesRendered)/framesRendered`.

> [!NOTE]
> The property is undefined for audio streams.
Expand Down
6 changes: 3 additions & 3 deletions files/en-us/web/css/flex-basis/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,9 @@ The `flex-basis` property is specified as either the keyword `content` or a `<'w

### Values

- `content`
- : Indicates automatic sizing, based on the flex item's content.

- `<'width'>`
- : Any of the following units:
- {{cssxref("&lt;length&gt;")}} sets an absolute value.
Expand All @@ -95,9 +98,6 @@ The `flex-basis` property is specified as either the keyword `content` or a `<'w
- {{cssxref("min-content")}} sets the intrinsic minimum width.
- {{cssxref("fit-content")}} sets the maximum possible size of a containing block's content area, bounded by the `min-content` and `max-content` values, and calculated based on the content of the current element.

- `content`
- : Indicates automatic sizing, based on the flex item's content.

## Formal definition

{{cssinfo}}
Expand Down
2 changes: 1 addition & 1 deletion files/en-us/web/html/reference/elements/label/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@ An {{HTMLElement("input")}} element with a `type="button"` declaration and a val
</tr>
<tr>
<th scope="row">Tag omission</th>
<td>None, both the starting and ending tag are mandatory.</td>
<td>None, both the starting and ending tags are mandatory.</td>
</tr>
<tr>
<th scope="row">Permitted parents</th>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ sidebar: http

The HTTP **`Integrity-Policy-Report-Only`** response header allows website administrators to report on resources that the user agent loads that would violate [Subresource Integrity](/en-US/docs/Web/Security/Subresource_Integrity) guarantees if the integrity policy was enforced (using the {{HTTPHeader("Integrity-Policy")}} header).

Reports may be generated for requests on specified [request destinations](/en-US/docs/Web/API/Request/destination) that omit integrity metadata, or that are made in [no-cors](/en-US/docs/Web/API/Request/mode#no-cors) mode.
Reports may be generated for requests on specified [request destinations](#blocked-destinations) that omit integrity metadata, or that are made in [no-cors](/en-US/docs/Web/API/Request/mode#no-cors) mode.
For reports to be sent to a reporting endpoint, the `Integrity-Policy-Report-Only` header must specify a valid reporting endpoint name that matches an endpoint declared using the {{HTTPHeader("Reporting-Endpoints")}} header.
Reports are generated using the [Reporting API](/en-US/docs/Web/API/Reporting_API), and may also be observed in the page for which the integrity policy is being reported, using a [ReportingObserver](/en-US/docs/Web/API/ReportingObserver).
Reports are generated using the [Reporting API](/en-US/docs/Web/API/Reporting_API), and may also be observed in the page for which the integrity policy is being reported, using a [`ReportingObserver`](/en-US/docs/Web/API/ReportingObserver).
The format of the report body is given by the {{domxref("IntegrityViolationReportBody")}} dictionary (a JSON-serialized form of this body is sent in POSTs to reporting server endpoints).

The header allow developers to test [integrity policies](/en-US/docs/Web/Security/Subresource_Integrity#integrity_policy) and fix any content issues before eventually deploying an {{HTTPHeader("Integrity-Policy")}} header to enforce the policy.
The header allows developers to test [integrity policies](/en-US/docs/Web/Security/Subresource_Integrity#integrity_policy) and fix any content issues before eventually deploying an {{HTTPHeader("Integrity-Policy")}} header to enforce the policy.

<table class="properties">
<tbody>
Expand All @@ -42,15 +42,22 @@ Integrity-Policy-Report-Only: blocked-destinations=(<destination>),sources=(<sou
The header values are defined as structured field dictionaries with the following keys:

- `blocked-destinations`

- : A list of [request destinations](/en-US/docs/Web/API/Request/destination) that must include valid integrity metadata.
Allowed values are:

- `script`
- : Script resources.
- `style`
- : Stylesheet resources.

- `sources` {{optional_inline}}

- : A list of integrity sources that must include integrity metadata.
Allowed values are:

- `inline`

- : The integrity metadata source is inline to the content, such as the [integrity attribute](/en-US/docs/Web/API/HTMLScriptElement/integrity).
This is the default.

Expand Down
11 changes: 8 additions & 3 deletions files/en-us/web/http/reference/headers/integrity-policy/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,10 @@ sidebar: http

The HTTP **`Integrity-Policy`** response header allows website administrators to ensure that all resources the user agent loads (of a certain type) have [Subresource Integrity](/en-US/docs/Web/Security/Subresource_Integrity) guarantees.

When set the user agent will block requests on specified [request destinations](/en-US/docs/Web/API/Request/destination) that omit integrity metadata, and will also block requests in [no-cors](/en-US/docs/Web/API/Request/mode#no-cors) mode from ever being made.
When set the user agent will block requests on specified [request destinations](#blocked-destinations) that omit integrity metadata, and will also block requests in [no-cors](/en-US/docs/Web/API/Request/mode#no-cors) mode from ever being made.

Violation reports may also be sent to if the header includes a reporting endpoint name that matches an endpoint declared using the {{HTTPHeader("Reporting-Endpoints")}} header.
Reports are generated using the [Reporting API](/en-US/docs/Web/API/Reporting_API), and may also be observed in the page for which the integrity policy is being enforced, using a [ReportingObserver](/en-US/docs/Web/API/ReportingObserver).
Reports are generated using the [Reporting API](/en-US/docs/Web/API/Reporting_API), and may also be observed in the page for which the integrity policy is being enforced, using a [`ReportingObserver`](/en-US/docs/Web/API/ReportingObserver).
The format of the report body is given by the {{domxref("IntegrityViolationReportBody")}} dictionary (a JSON-serialized form of this body is sent in POSTs to reporting server endpoints).

This helps guard against content manipulation of fetched subresources.
Expand Down Expand Up @@ -45,13 +45,18 @@ The header values are defined as structured field dictionaries with the followin
- `blocked-destinations`
- : A list of [request destinations](/en-US/docs/Web/API/Request/destination) that must include valid integrity metadata.
Allowed values are:

- `script`
- : Script resources.

- `style`
- : Stylesheet resources.
- `sources` {{optional_inline}}

- : A list of integrity sources that must include integrity metadata.
Allowed values are:

- `inline`

- : The integrity metadata source is inline to the content, such as the [integrity attribute](/en-US/docs/Web/API/HTMLScriptElement/integrity).
This is the default.

Expand Down
12 changes: 6 additions & 6 deletions files/en-us/web/security/subresource_integrity/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -112,17 +112,17 @@ Browsers handle SRI by doing the following:

## Integrity policy

The {{httpheader("Integrity-Policy")}} and {{httpheader("Integrity-Policy-Report-Only")}} HTTP headers enable a document to enforce a policy regarding the integrity metadata requirements on loaded subresources of specified types (currently scripts only).
The {{httpheader("Integrity-Policy")}} and {{httpheader("Integrity-Policy-Report-Only")}} HTTP headers enable a document to enforce a policy regarding the integrity metadata requirements on loaded script and stylesheet subresources.

When an `Integrity-Policy` header is specified, the browser blocks requests with [no-cors](/en-US/docs/Web/API/Request/mode#no-cors) mode or without an `integrity` attribute from being made, and will also report violations if a valid reporting endpoint is specified.
When an `Integrity-Policy-Report-Only` header is specified the browser allows requests that violate the policy, but will report violations to the reporting endpoint (if a valid reporting endpoint is specified).
When an `Integrity-Policy-Report-Only` header is specified, the browser allows requests that violate the policy, but will report violations to the reporting endpoint (if a valid reporting endpoint is specified).

Developers would typically use `Integrity-Policy-Report-Only` as a first deployment step in their Integrity Policy journey, to ensure that all the scripts loaded in their documents have appropriate integrity metadata. Once they'd see that no violation reports are being received, they'd know that they can enable blocking using the `Integrity-Policy` header without risking user-facing breakage.
Developers would typically use `Integrity-Policy-Report-Only` as a first deployment step in their Integrity Policy journey, to ensure that all the scripts and stylesheets loaded in their documents have appropriate integrity metadata. Once they'd see that no violation reports are being received, they'd know that they can enable blocking using the `Integrity-Policy` header without risking user-facing breakage.

The header values are defined as structured field dictionaries with the following keys:

- `blocked-destinations`
- : Defines a list of [request destinations](/en-US/docs/Web/API/Request/destination) to be blocked. The only allowed value is `script`.
- : Defines a list of [request destinations](/en-US/docs/Web/API/Request/destination) to be blocked. The only allowed values are `script` and `style`.
- `sources` {{optional_inline}}
- : Defines a list of integrity sources. The default and only currently supported value is `inline`. As a result, adding `sources=(inline)` to the header has a similar effect as omitting `sources`.
- `endpoints` {{optional_inline}}
Expand Down Expand Up @@ -165,13 +165,13 @@ You can use the following {{HTMLElement("script")}} element to tell a browser th

### Integrity enforcement with the `Integrity-Policy` header

You can add the {{httpheader("Integrity-Policy")}} header to your document in order to ensure that all the external scripts it loads are loaded with integrity (and aren't loaded with [no-cors](/en-US/docs/Web/API/Request/mode#no-cors) mode)
You can add the {{httpheader("Integrity-Policy")}} header to your document to ensure that the external resources it loads (in this case, scripts) are loaded with integrity (and aren't loaded with [no-cors](/en-US/docs/Web/API/Request/mode#no-cors) mode)

```http
Integrity-Policy: blocked-destinations=(script), endpoints=(integrity-endpoint, some-other-integrity-endpoint)
```

In case you're not sure all your the external scripts have integrity metadata, you can enable the report-only version of the feature and start getting reports of violations.
If you're unsure that all the external scripts have integrity metadata, you can enable the report-only version of the feature and start getting reports of violations.
You can do that with the {{httpheader("Integrity-Policy-Report-Only")}} header.

```http
Expand Down