Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Drop all CSP X- header support if support is above X% #73

Closed
oreoshake opened this issue Oct 10, 2013 · 4 comments · Fixed by #75
Closed

Drop all CSP X- header support if support is above X% #73

oreoshake opened this issue Oct 10, 2013 · 4 comments · Fixed by #75

Comments

@oreoshake
Copy link
Contributor

Given that firefox/chrome GA releases support the standard... not much reasoning behind supoorting the X- versions. Especially since they break all the time.
@reedloden
Copy link
Contributor

The X- header for CSP only, I assume?

@oreoshake
Copy link
Contributor Author

Ha, yes. Tunnel vision.

@oreoshake
Copy link
Contributor Author

BLINK (renderer for Chrome) is dropping support soon, looks like version 33. https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/3AaCbkdGSPs/pnQO579qrNkJ

@oreoshake
Copy link
Contributor Author

Also, this was mainly motivated by the fact that Firefox fails closed. That jank aka code can go away.

This leaves the open question: "What about Safari?" who only plans to support the X-Webkit-CSP header for now.

Still waiting for numbers on Firefox upgrade paths.

@oreoshake oreoshake mentioned this issue Oct 15, 2013
Closed
@oreoshake oreoshake mentioned this issue Nov 5, 2013
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Standard header only github/secure_headers
2 participants
@reedloden @oreoshake