Add Permissions-Policy and Document-Policy support #65
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Would love to see this being added; do you know of anyone that could merge this @bazzadp ? |
|
I see @theacodes has writing access to this repo; would you be up for reviewing this PR? It's an important feature for Flask Talisman to stay up to date on the newest security related headers! I took a quick look, and to me the implementation of @bazzadp is pretty neat. I think it's ready to merge as it is! |
This was referenced Jun 9, 2021
|
Closing this as this has been merged and merged into the fork discussed in #78 and released in v8.0.0, which has been uploaded to PyPi |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Feature-Policy has been split into Permissions-Policy and Document-Policy. Although these are not supported in browsers yet, it is likely that they will be at some point in the not too distant future.
In addition the popular SecurityHeaders.com tool has started flagging when Permissions-Policy header is not being sent which is likely to increase interest in publishing a Permissions-Policy alongside the original Feature-Policy header.
This PR adds support for both headers, though does not set them by default, nor does it retire Feature-Policy.