409.txt

[138] [DFN[CSP]] ([DFN[[RUBYB[内容セキュリティーポリシー]@en[content security policy]]]])
は、当該[[Webページ]]が満たすべき[[セキュリティー]]上の制約を記述するものです。
[[CSP]] を使うことで、 [[XSS]] などの[[脆弱性]]の影響範囲を限定するなど、
[[Webサイト]]の安全性を向上させることができます。

* 仕様書

[REFS[
- [117] [CITE@en[Content Security Policy Level 3]] ([TIME[2016-02-29 23:20:13 +09:00]] 版) <https://w3c.github.io/webappsec-csp/>
-- [48] 旧 [CITE@en[Content Security Policy]] ([TIME[2015-05-05 20:49:34 +09:00]] 版) <https://w3c.github.io/webappsec/specs/content-security-policy/>
- [118] [CITE@en[Content Security Policy: Document Features]] ([TIME[2016-02-29 23:20:13 +09:00]] 版) <https://w3c.github.io/webappsec-csp/document/>
- [59] [CITE@en-GB-x-hixie[HTML Standard]] ([TIME[2015-09-18 02:18:44 +09:00]] 版) <https://html.spec.whatwg.org/#attr-meta-http-equiv-content-security-policy>
- [82] [CITE@en-GB-x-hixie[HTML Standard]] ([TIME[2015-11-06 03:51:21 +09:00]] 版) <https://html.spec.whatwg.org/#concept-document-csp-list>
- [87] [CITE@en-GB-x-hixie[HTML Standard]] ([TIME[2015-11-06 03:51:21 +09:00]] 版) <https://html.spec.whatwg.org/#concept-workerglobalscope-csp-list>
- [112] [CITE@en[RFC 7762 - Initial Assignment for the Content Security Policy Directives Registry]]
([TIME[2016-01-29 12:26:08 +09:00]] 版)
<https://tools.ietf.org/html/rfc7762>
- [111] [CITE[Content Security Policy Directives]] ([TIME[2015-11-25 05:20:01 +09:00]] 版) <https://www.iana.org/assignments/content-security-policy-directives/content-security-policy-directives.xhtml>
]REFS]

* 指令

[71] 次の[[指令]]があります。
[FIG(middle list)[
- [CODE(HTTP)@en[[[block-all-mixed-content]]]]
- [CODE(HTTP)@en[[[report-uri]]]]
- [CODE(HTTP)@en[[[upgrade-insecure-requests]]]]
]FIG]

[113] (なぜか) [[IANA登録簿]]があります [SRC[>>112, >>111]]。

* CSP リスト

[83] [[文書]] [SRC[>>82]] や [CODE(DOMi)@en[[[WorkerGlobalScope]]]] [SRC[>>87]]
は、[DFN[[F[[RUBYB[[[CSPリスト]]]@en[CSP list]]]]]]を持ちます。

[84] これは適用される [[CSP]] のオブジェクトのリストです。初期状態では空です。 [SRC[>>82]]

[86] [[navigate]] では[[[CODE(DOMi)@en[Document]]のCSPリストの初期化]]により値が設定されます。

[88] [[run a worker]] では[[応答]]の[[CSPリスト]]が引き継がれます。

[85] [[overridden reload]] や [CODE(HTMLa)@en[[[srcdoc]]]]
[[属性]]の読み込みでは、元の[[文書]]の[F[[[CSPリスト]]]]が引き継がれます。

* 関連

[139] [[fetch]] や [[navigate]] や[[砂箱化]]と深く関係しています。

* 歴史

[1] [CITE@en[Security/CSP - MozillaWiki]]
([TIME[2009-10-09 22:03:58 +09:00]] 版)
<https://wiki.mozilla.org/Security/CSP>

[2] [CITE@en[Security/CSP/Spec - MozillaWiki]]
([TIME[2009-11-04 04:19:11 +09:00]] 版)
<https://wiki.mozilla.org/Security/CSP/Spec>

[3] [CITE@en[Security/CSP/Specification - MozillaWiki]]
([TIME[2010-05-22 03:46:34 +09:00]] 版)
<https://wiki.mozilla.org/Security/CSP/Specification>

[4] [CITE@en[XSS mitigation in browsers]]
( ([[Adam Barth]] 著, [TIME[2011-01-20 07:42:47 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-web-security/2011Jan/0002.html>

[5] [CITE@en[Content Security Policy]]
( ([TIME[2011-12-01 01:03:34 +09:00]] 版))
<http://www.w3.org/TR/2011/WD-CSP-20111129/>

[6] [CITE[IRC logs: freenode / #whatwg / 20111206]]
( ([TIME[2011-12-06 21:54:13 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20111206>

[7] [CITE['''['''whatwg''']''' CSP sandbox directive integration with HTML]]
([TIME[2011-12-07 09:36:37 +09:00]] 版)
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-December/034071.html>

[8] [CITE@en[Content Security Policy]]
( ([TIME[2012-04-14 10:44:44 +09:00]] 版))
<http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html>

[9] [CITE@en[draft-gondrom-websec-csp-header-00 - HTTP Header Content Security Policy]]
( ([TIME[2012-03-06 21:39:17 +09:00]] 版))
<http://tools.ietf.org/html/draft-gondrom-websec-csp-header-00>

[10] [CITE[Content Security Policy (CSP) - Google Chrome Extensions - Google Code]]
( ([TIME[2012-07-04 21:12:09 +09:00]] 版))
<http://code.google.com/chrome/extensions/contentSecurityPolicy.html>

[11] [CITE@en[Content Security Policy 1.0]]
( ([TIME[2012-07-08 08:24:03 +09:00]] 版))
<http://www.w3.org/TR/2012/WD-CSP-20120710/>

[12] [CITE@en[Content Security Policy 1.0]]
( ([TIME[2012-11-15 02:39:08 +09:00]] 版))
<http://www.w3.org/TR/2012/CR-CSP-20121115/>

[13] [CITE@en[User Interface Safety Directives for Content Security Policy]]
( ([TIME[2012-11-20 22:47:37 +09:00]] 版))
<http://www.w3.org/TR/2012/WD-UISafety-20121120/>

[14] [CITE[Content Security Policy 1.1]]
( ([TIME[2012-12-13 23:00:55 +09:00]] 版))
<http://www.w3.org/TR/2012/WD-CSP11-20121213/>

[15] [CITE[Chromium Blog: Chrome 25 Beta: Content Security Policy and Shadow DOM]]
( ([TIME[2013-01-16 03:52:16 +09:00]] 版))
<http://blog.chromium.org/2013/01/content-security-policy-and-shadow-dom.html>

[16] [CITE@en[Runtime and Security Model for Web Applications]]
( ([TIME[2013-03-21 23:02:32 +09:00]] 版))
<http://www.w3.org/TR/2013/WD-runtime-20130321/#csp-policy>

[17] [CITE@en[User Interface Security Directives for Content Security Policy]]
( ([TIME[2013-05-22 21:37:57 +09:00]] 版))
<http://www.w3.org/TR/2013/WD-UISecurity-20130523/>

[18] [CITE[Chromium Blog: Chrome 28 Beta: A more immersive web, everywhere]]
( ([TIME[2013-05-23 17:42:48 +09:00]] 版))
<http://blog.chromium.org/2013/05/chrome-28-beta-more-immersive-web.html>

[19] [CITE@en[Content Security Policy 1.1]]
( ([TIME[2013-06-04 06:35:02 +09:00]] 版))
<http://www.w3.org/TR/2013/WD-CSP11-20130604/>

[20] [CITE[Content Security Policy (CSP) - Google Chrome]]
( ([TIME[2013-10-13 01:58:37 +09:00]] 版))
<http://developer.chrome.com/extensions/contentSecurityPolicy.html>

[21] [CITE@en-US[Default CSP restrictions - Security | MDN]]
( ([TIME[2013-10-01 06:35:59 +09:00]] 版))
<https://developer.mozilla.org/en/docs/Security/CSP/Default_CSP_restrictions>

[22] [CITE@en-US[Introducing Content Security Policy - Security | MDN]]
( ([TIME[2013-09-30 19:27:42 +09:00]] 版))
<https://developer.mozilla.org/en-US/docs/Security/CSP/Introducing_Content_Security_Policy>

[23] [CITE@en[''''''[''''''webappsec'''''']'''''' Proposal: Closing the feature set of CSP 1.1]]
( ([[Brad Hill]] 著, [TIME[2013-09-10 09:14:02 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2013Sep/0019.html>

[24] [CITE@en[Content Security Policy 1.1]]
( ([TIME[2014-01-16 14:18:10 +09:00]] 版))
<http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html>

[25] [CITE[Bug 2494 – Add hooks for CSP]]
( ([TIME[2014-02-05 07:24:56 +09:00]] 版))
<https://bugs.ecmascript.org/show_bug.cgi?id=2494>

[26] [CITE@en[Content Security Policy 1.1]]
( ([TIME[2014-02-11 06:15:48 +09:00]] 版))
<http://www.w3.org/TR/2014/WD-CSP11-20140211/>

[27] [CITE@en[User Interface Security Directives for Content Security Policy]]
( ([TIME[2014-03-15 06:10:22 +09:00]] 版))
<http://www.w3.org/TR/2014/WD-UISecurity-20140318/>

[28] [CITE@en[User Interface Security Directives for Content Security Policy]]
( ([TIME[2014-04-25 10:54:40 +09:00]] 版))
<https://dvcs.w3.org/hg/user-interface-safety/raw-file/tip/user-interface-safety.html>

[29] [CITE[Clarify MIX and CSP hooks a bit · 682f68d · whatwg/fetch]]
( ([TIME[2014-06-16 03:02:02 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/682f68d5f0cce7f9637a8f6d9450b514ed276f9b>

[30] [CITE[Put MIX/CSP hooks in switch. Put second MIX check before tainting. · 567fe8a · whatwg/fetch]]
( ([TIME[2014-06-16 03:05:42 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/567fe8ad5f1804efdefa7aa273f2a366b223c70e>

[31] [CITE@en[Content Security Policy Level 2]]
( ([TIME[2014-07-03 04:53:53 +09:00]] 版))
<http://www.w3.org/TR/2014/WD-CSP2-20140703/>

[32] [CITE@en["Why is CSP failing? Trends and Challenges in CSP Adoption"]]
( ([[Oda, Terri]] 著, [TIME[2014-07-24 03:26:19 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Jul/0100.html>

[33] ( ([TIME[2014-07-15 00:50:45 +09:00]] 版))
<http://mweissbacher.com/publications/csp_raid.pdf>

[34] [CITE@en[''''''[''''''webappsec'''''']'''''' Call for Consensus: CSP Level 2 to Candidate Recommendation]]
( ([[Brad Hill]] 著, [TIME[2014-10-21 08:02:34 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Oct/0063.html>

[35] [CITE@en[''''''[''''''webappsec'''''']'''''' Call for Consensus: Stop work on Content Security Policy  1.0, transition to WG Note]]
( ([[Brad Hill]] 著, [TIME[2014-10-21 08:13:56 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Oct/0064.html>

[36] [CITE@en[CSP3: Starting on DOM API strawman. · 92b8dd4 · w3c/webappsec]]
( ([TIME[2014-11-04 03:23:06 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/92b8dd4778ad1a237e5b5be015f9482bd3ad2ff4>

[37] [CITE@en[CSP3: DOM API Strawman]]
( ([[Mike West]] 著, [TIME[2014-11-03 22:24:45 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Nov/0005.html>

[38] [CITE@en[''''''[''''''webappsec'''''']'''''' Rechartering: CSP Level 3]]
( ([[Brad Hill]] 著, [TIME[2014-11-10 09:02:46 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Nov/0126.html>

[39] [CITE@en[Official Gmail Blog: Reject the unexpected - Content Security Policy in Gmail]]
( ([TIME[2014-12-19 08:00:09 +09:00]] 版))
<http://gmailblog.blogspot.jp/2014/12/reject-unexpected-content-security.html>

[40] [CITE@en[Fix the order of CSP, HSTS, Mixed Content, and Referrer https://www.w3.o... · b8c2c49 · whatwg/fetch]]
([TIME[2015-01-28 18:20:53 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/b8c2c4964c233cd3616042c04e2c14e0ff25485d>

[41] [CITE@en[Re: CfC: Transition CSP2 to CR.]]
([[Mike West]] 著, [TIME[2015-02-08 02:05:21 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Feb/0124.html>

[42] [CITE@en[Content Security Policy 1.0]]
( ([TIME[2015-02-19 06:00:25 +09:00]] 版))
<http://www.w3.org/TR/2015/NOTE-CSP1-20150219/>

[43] [CITE@en[Content Security Policy Level 2]]
( ([TIME[2015-02-17 00:13:08 +09:00]] 版))
<http://www.w3.org/TR/2015/CR-CSP2-20150219/>

[44] [CITE@en[Content Security Policy Pinning]]
( ([TIME[2015-02-24 21:59:42 +09:00]] 版))
<http://www.w3.org/TR/2015/WD-csp-pinning-20150226/>

[45] [CITE@en[Content Security Policy Pinning]]
( ([TIME[2015-02-26 20:26:19 +09:00]] 版))
<https://w3c.github.io/webappsec/specs/csp-pinning/>

[46] [CITE[Content Security Policy]]
([TIME[2011-12-29 07:11:55 +09:00]] 版)
<http://people.mozilla.org/~bsterne/content-security-policy/index.html>

[47] [CITE@en[Security/CSP/Spec - MozillaWiki]]
([TIME[2015-03-31 11:52:15 +09:00]] 版)
<https://wiki.mozilla.org/Security/CSP/Spec>

[49] [CITE@en[Store a url list for requests and responses so CSP can do the right t… · whatwg/fetch@1d8173a]]
([TIME[2015-06-12 12:18:00 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/1d8173afffcffad2587f2922381878939c9cebea>

[50] [CITE@en[Add the response CSP check as open issue. Fixes #77. · whatwg/fetch@baeb561]]
([TIME[2015-07-15 12:37:36 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/baeb561384ee353b13a2ca0b2a31fd79b769caa2>

[51] [CITE@en[CSP: Blob URLs in new windows.]]
([[Mike West]] 著, [TIME[2015-07-20 13:40:23 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Jul/0126.html>

[FIG(quote)[
[FIGCAPTION[
[52] [CITE@en[Re: CfC: Mixed Content to PR; deadline July 6th.]]
([[Mike West]] 著, [TIME[2015-07-21 03:38:29 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Jul/0144.html>
]FIGCAPTION]

> Hammering out scope for CSP3 is on my list for this quarter. Rewriting
> enforcement and monitoring in terms of Fetch is totally going to happen.
> Sorry it's taken so long.
> 

]FIG]


[53] [CITE@en[Content Security Policy Level 2]]
( ([TIME[2015-07-21 00:31:23 +09:00]] 版))
<http://www.w3.org/TR/2015/CR-CSP2-20150721/>

[54] [CITE@en[Runtime and Security Model for Web Applications]]
([TIME[2015-08-04 19:31:42 +09:00]] 版)
<http://www.w3.org/TR/2015/NOTE-runtime-20150806/#csp-policy>

[55] [CITE@en[RE: CfC: CSP2 to PR; deadline Aug 18th.]]
([[Crispin Cowan]] 著, [TIME[2015-08-14 08:47:59 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Aug/0069.html>

[56] [CITE@en[JSON CSP]]
([TIME[2015-08-15 11:55:12 +09:00]] 版)
<https://gist.github.com/jonathanKingston/5699b440f608960dc089>

[57] [CITE@en[JSON representation of CSP policies]]
([[Jonathan Kingston]] 著, [TIME[2015-08-15 07:20:24 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Aug/0073.html>

[58] [CITE@en[Re: JSON representation of CSP policies]]
([[Mike West]] 著, [TIME[2015-08-17 22:48:08 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Aug/0079.html>

[60] [CITE@en[Fix #88: add the 'Content-Security-Policy' pragma directive · whatwg/html@5064a62]]
([TIME[2015-09-19 13:39:47 +09:00]] 版)
<https://github.com/whatwg/html/commit/5064a629f22bef29839ab4dc6f1ceef17f010bc5>

[61] [CITE@en[CSP-COOKIES: If nothing else, this will be a good argument aabout doc… · w3c/webappsec@8e1be6f]]
([TIME[2015-09-26 11:40:04 +09:00]] 版)
<https://github.com/w3c/webappsec/commit/8e1be6ff6407b71443b2efe5b21d9455aa607ef8>

[62] [CITE@en[CSP-COOKIES: Cleaning up for wider review. · w3c/webappsec@ee2d941]]
([TIME[2015-09-27 14:23:46 +09:00]] 版)
<https://github.com/w3c/webappsec/commit/ee2d9412e651eba82f5c2fc3d628b6d0e55c21be>

[63] [CITE@en[CSP3 as a polylithic set of modules?]]
([[Mike West]] 著, [TIME[2015-09-27 01:29:34 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Sep/0210.html>

[64] [CITE@en[Content Security Policy Pinning]]
([TIME[2015-10-06 19:45:04 +09:00]] 版)
<https://w3c.github.io/webappsec-csp/pinning/>

[65] [CITE@en[w3c/webappsec-csp]]
([TIME[2015-10-06 23:20:06 +09:00]] 版)
<https://github.com/w3c/webappsec-csp>

[66] [CITE[CSP: Defining the CH-CSP Client Hint. · 049a3c9 · w3c/webappsec]]
( ([TIME[2014-06-13 15:16:48 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/049a3c94817770487e21d6151b135bca4b19ba46>

[67] [CITE@en[CSP: Drop the 'CH-' prefix on the request header. · 548a228 · w3c/webappsec]]
( ([TIME[2014-09-02 08:17:30 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/548a228a5349b0eef8a14e048500e8eb3dbf3674>

[68] [CITE@en[CSP2: Note the issue the 'CSP' header was meant to solve. · w3c/webappsec@5233fe8]]
([TIME[2015-08-13 11:53:34 +09:00]] 版)
<https://github.com/w3c/webappsec/commit/5233fe8e75fd5b155135c6eca35fb48e685c14e5>


[69] [CITE@en[draft-west-webappsec-csp-reg-00 - Content Security Policy Directive Registry]]
([TIME[2015-10-07 03:48:16 +09:00]] 版)
<https://tools.ietf.org/html/draft-west-webappsec-csp-reg-00>

[70] [CITE@en[Hey, look at that. A strawman IANA registry. · w3c/webappsec-csp@224f8e6]]
([TIME[2015-10-07 13:49:13 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/224f8e6ac414119260af0fc8a0f8326b94bac655>

[72] [CITE@en[763879 – (CSP) implement blocking of inline stylesheets]]
([TIME[2015-10-09 21:54:26 +09:00]] 版)
<https://bugzilla.mozilla.org/show_bug.cgi?id=763879>

[73] [CITE@en[Clear response's CSP list before setting. · w3c/webappsec-csp@0545ae0]]
([TIME[2015-10-15 11:55:17 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/0545ae08d6c74788f006e07b2b991bbf925c9691>

[74] [CITE@en[Extensions should bypass CSP. · w3c/webappsec-csp@1b7b2c4]]
([TIME[2015-10-15 11:56:03 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/1b7b2c401ed1dc2b435cb3e68313ced19c88d597>

[75] [CITE@en[Update Fetch with shiny, new CSP hooks · whatwg/fetch@8ce550b]]
([TIME[2015-10-16 14:30:15 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/8ce550b53c53e2b6e8376373b94d66b2eeada8f8>

[76] [CITE@en[Drop Fetch issues after https://github.com/whatwg/fetch/commit/8ce550… · w3c/webappsec-csp@c2b6452]]
([TIME[2015-10-16 14:31:34 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/c2b64522fb6f4cb4f683344ee3cd890dfdcc515d>

[77] [CITE@en[Update CSP links · whatwg/html@7e8a536]]
([TIME[2015-10-22 11:44:39 +09:00]] 版)
<https://github.com/whatwg/html/commit/7e8a5367d1e0d9c1b7e84d2c86e7821af0ff167a>

[FIG(quote)[
[FIGCAPTION[
[78] [CITE@en[Upgrade Insecure Requests]]
([TIME[2015-10-07 03:24:10 +09:00]] 版)
<https://w3c.github.io/webappsec-upgrade-insecure-requests/#reporting-upgrades>
]FIGCAPTION]

> Upgrading insecure requests MUST not interfere with an authors' ability to track down requests that would be insecure in a user agent that does not support upgrades. To that end, upgrades MUST be performed after evaluating request against all monitored security policies, but before evaluating request against all enforced policies.

]FIG]


[FIG(quote)[
[FIGCAPTION[
[79] [CITE@en[Upgrade Insecure Requests]]
([TIME[2015-10-07 03:24:10 +09:00]] 版)
<https://w3c.github.io/webappsec-upgrade-insecure-requests/#violation-report-target>
]FIGCAPTION]

> When sending a violation report for an upgraded resource, user agents MUST target the Document or Worker that triggered the request, rather than the Document or Worker on which the upgrade-insecure-requests directive was set. Due to §3.3 Policy Inheritance, the latter might be a cross-origin ancestor of the former, and sending violation reports to that set of reporting endpoints could leak data in unexpected ways.
> Likewise, the SecurityPolicyViolationEvent MUST NOT target any Document other than the one which triggered the request, for the same reasons.

]FIG]


[80] [CITE@en[Allow upgrades from explicitly insecure expressions · w3c/webappsec-csp@0e81d81]]
([TIME[2015-10-29 12:41:01 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b9697ff7b60>

[81] [CITE@en[Use the URL from the response, if it has one · whatwg/fetch@ed37f5e]]
([TIME[2015-11-05 17:18:28 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/ed37f5e4cf0ec6615f93b8a575d7349b977ffc3a>

[89] [CITE@en[Split reporting and enforcement for Fetch. · w3c/webappsec-csp@6647d2d]]
([TIME[2015-11-08 15:43:35 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/6647d2de191283e94cec1059411f536e6d6b95b5>

[90] [CITE@en[Separate 'report-only' and 'enforce' CSP execution · whatwg/fetch@a58871a]]
([TIME[2015-11-08 15:50:14 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/a58871a92cbf9304ea4e661f31efb9f2b78bf44b>

[91] [CITE@en[Call out to CSP's inline element hooks · whatwg/html@ee3486e]]
([TIME[2015-11-08 16:32:16 +09:00]] 版)
<https://github.com/whatwg/html/commit/ee3486eb129bc350b5ca684d0c91dff23453ac1a>

[92] [CITE@en[Move to CSP2. · w3c/webappsec-csp@2a08d9b]]
([TIME[2015-11-21 16:09:45 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/2a08d9b2ee2a5cea8f0bd2bae1f7faedd9a700e7>

[93] [CITE@en[Updating EMBEDDED for a potential FPWD. · w3c/webappsec-csp@7260140]]
([TIME[2015-12-01 11:36:34 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/726014018c622455f72cd434a8622e784322318d>

[94] [CITE@en[CfC: CSP Embedded Enforcement to FPWD; deadline Dec. 7th.]]
([[Mike West]] 著, [TIME[2015-11-30 19:14:35 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Nov/0070.html>

[95] [CITE@en[Working on the split. · w3c/webappsec-csp@72c7f3e]]
([TIME[2015-12-03 14:41:14 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/72c7f3ecc3eae190bd5df656cb5e8dbc4abb5a9a>

[96] [CITE@en[new CSP draft.]]
([[Mike West]] 著, [TIME[2015-12-04 22:31:03 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Dec/0025.html>

[97] [CITE@en[Close #384: add CSP hooks to handle inline events and style · whatwg/html@920c918]]
([TIME[2015-12-15 20:07:56 +09:00]] 版)
<https://github.com/whatwg/html/commit/920c9183a7990968ecac1aeedae22391f3438791>

[98] [CITE@en[Content Security Policy: Cookie Controls]]
( ([TIME[2015-12-13 11:02:51 +09:00]] 版))
<http://www.w3.org/TR/2015/WD-csp-cookies-20151215/>

[99] [CITE@en[Content Security Policy: Embedded Enforcement]]
( ([TIME[2015-12-13 11:05:51 +09:00]] 版))
<http://www.w3.org/TR/2015/WD-csp-embedded-enforcement-20151215/>

[100] [CITE@en[Call for Exclusions: Content Security Policy: Cookie Controls and  Content Security Policy: Embedded Enforcement]]
([[Xueyuan Jia]] 著, [TIME[2015-12-15 17:14:45 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Dec/0034.html>

[101] [CITE@en[CfC: CSP3 to FPWD; deadline January 15th.]]
([[Mike West]] 著, [TIME[2016-01-08 18:59:12 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2016Jan/0034.html>

[102] [CITE@en[s/serialized policy/serialized CSP/g · w3c/webappsec-csp@17c18c0]]
([TIME[2016-01-13 12:09:31 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/17c18c04cbe94a0796e353aa99d972cb9021b3cf>

[103] [CITE@en[Update xrefs for CSP sandbox & frame-ancestors · whatwg/html@088f4f2]]
([TIME[2016-01-21 12:17:02 +09:00]] 版)
<https://github.com/whatwg/html/commit/088f4f210541f8c131fb92c4f331c40f4b6b3768>

[104] [CITE@en[Content Security Policy Level 3]]
( ([TIME[2016-01-26 01:08:50 +09:00]] 版))
<https://www.w3.org/TR/2016/WD-CSP3-20160126/>

[105] [CITE@en[IANA: AUTH48 version of the RFC. · w3c/webappsec-csp@1bfbb97]]
([TIME[2016-01-28 23:14:29 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/1bfbb97a12e6338c563e19bcfd2582291ab33e80>

[106] [CITE@en[Fix links to CSP list initialization algorithms · whatwg/html@59d9ae1]]
([TIME[2016-01-30 12:17:28 +09:00]] 版)
<https://github.com/whatwg/html/commit/59d9ae1ed8df16dbea7eb6906e333d12d8ceeecf>

[107] [CITE@en[CSP: Fix workers' CSP list initialization. · whatwg/html@05f9f32]]
([TIME[2016-01-30 13:30:44 +09:00]] 版)
<https://github.com/whatwg/html/commit/05f9f3266d6050b8b299ec365fdc63d5eab5b2b3>

[108] [CITE@en[No CSP report-uri|frame-ancestors|sandbox in meta · whatwg/html@3947072]]
([TIME[2016-01-30 20:55:24 +09:00]] 版)
<https://github.com/whatwg/html/commit/39470724136a366bab4e893efd889a513d61cc3e>

[109] [CITE@en[No CSP report-uri|frame-ancestors|sandbox in meta · whatwg/html@3947072]]
([TIME[2016-01-30 20:55:24 +09:00]] 版)
<https://github.com/whatwg/html/commit/39470724136a366bab4e893efd889a513d61cc3e>

[110] [CITE@en[RFC 7762 - Initial Assignment for the Content Security Policy Directives Registry]]
([TIME[2016-01-29 12:26:08 +09:00]] 版)
<https://tools.ietf.org/html/rfc7762>

[114] [CITE@en[FYI: RFC7762 established a registry of CSP directives]]
([[Mike West]] 著, [TIME[2016-02-12 21:07:55 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2016Feb/0047.html>

[115] [CITE@en[IANA bits. · w3c/webappsec-upgrade-insecure-requests@1d4db1a]]
([TIME[2016-02-14 00:56:36 +09:00]] 版)
<https://github.com/w3c/webappsec-upgrade-insecure-requests/commit/1d4db1a5be26ea83caa45e9bbebbb00a100c4102>

[116] [CITE@en[Making it easier to deploy CSP.]]
([[Mike West]] 著, [TIME[2016-02-12 22:56:58 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2016Feb/0048.html>

[119] [CITE@en[Call for Exclusions (Update): Content Security Policy: Cookie  Controls; Content Security Policy: Embedded Enforcement]]
([[Xueyuan Jia]] 著, [TIME[2016-03-15 23:47:16 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2016Mar/0033.html>

[120] [CITE@en[We're not going to enable 'sandbox' in '<meta>'. · w3c/webappsec-csp@8ca78f0]]
([TIME[2016-04-06 16:32:17 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/8ca78f0ed12bbbde0a11c4d58fb936ce0a25f9d7>

[121] [CITE@en[CSP Request Header and CORS preflight fetch. · Issue #52 · whatwg/fetch]]
([TIME[2016-04-11 12:51:01 +09:00]] 版)
<https://github.com/whatwg/fetch/issues/52>

[FIG(quote)[
[FIGCAPTION[
[122] [CITE[CloudFlare - The web performance & security company]]
([TIME[2016-04-16 06:06:26 +09:00]] 版)
<https://www.cloudflare.com/>
]FIGCAPTION]

> content-security-policy:default-src 'self' https://*; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://* data:; img-src 'self' https://* data:; style-src 'self' 'unsafe-inline' https://*; font-src 'self' https://* data:; frame-src https://*; connect-src 'self' data: https://*

]FIG]


[FIG(quote)[
[FIGCAPTION[
[123] [CITE@en[GitHub]]
([TIME[2016-04-18 00:53:37 +09:00]] 版)
<https://github.com/>
]FIGCAPTION]

> Content-Security-Policy:default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src render.githubusercontent.com; connect-src 'self' uploads.github.com status.github.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com api.braintreegateway.com client-analytics.braintreegateway.com wss://live.github.com; font-src assets-cdn.github.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: assets-cdn.github.com identicons.github.com www.google-analytics.com collector.githubapp.com *.gravatar.com *.wp.com checkout.paypal.com *.githubusercontent.com; media-src 'none'; object-src assets-cdn.github.com; plugin-types application/x-shockwave-flash; script-src assets-cdn.github.com; style-src 'unsafe-inline' assets-cdn.github.com

]FIG]


[FIG(quote)[
[FIGCAPTION[
[124] [CITE@ja[Twitter]]
([TIME[2016-04-18 00:56:15 +09:00]] 版)
<https://twitter.com/>
]FIGCAPTION]

> content-security-policy:script-src https://connect.facebook.net https://cm.g.doubleclick.net https://ssl.google-analytics.com https://graph.facebook.com https://twitter.com 'unsafe-eval' https://*.twimg.com https://api.twitter.com https://analytics.twitter.com https://publish.twitter.com https://ton.twitter.com https://syndication.twitter.com https://www.google.com https://t.tellapart.com https://platform.twitter.com 'nonce-ukbsoXB8DeM97dTLyRPKOw==' https://www.google-analytics.com 'self'; frame-ancestors 'self'; font-src https://twitter.com https://*.twimg.com data: https://ton.twitter.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https://netdna.bootstrapcdn.com 'self'; media-src https://twitter.com https://*.twimg.com https://ton.twitter.com blob: 'self'; connect-src https://graph.facebook.com https://*.giphy.com https://pay.twitter.com https://analytics.twitter.com https://media.riffsy.com https://upload.twitter.com https://api.mapbox.com 'self'; style-src https://fonts.googleapis.com https://twitter.com https://*.twimg.com https://translate.googleapis.com https://ton.twitter.com 'unsafe-inline' https://platform.twitter.com https://maxcdn.bootstrapcdn.com https://netdna.bootstrapcdn.com 'self'; object-src https://twitter.com https://pbs.twimg.com; default-src 'self'; frame-src https://staticxx.facebook.com https://twitter.com https://*.twimg.com https://player.vimeo.com https://pay.twitter.com https://www.facebook.com https://ton.twitter.com https://syndication.twitter.com https://vine.co twitter: https://www.youtube.com https://platform.twitter.com https://upload.twitter.com https://s-static.ak.facebook.com 'self' https://donate.twitter.com; img-src https://graph.facebook.com https://*.giphy.com https://twitter.com https://*.twimg.com data: https://fbcdn-profile-a.akamaihd.net https://www.facebook.com https://ton.twitter.com https://*.fbcdn.net https://syndication.twitter.com https://media.riffsy.com https://www.google.com https://stats.g.doubleclick.net https://*.tiles.mapbox.com https://www.google-analytics.com blob: 'self'; report-uri https://twitter.com/i/csp_report?a=NVQXGYLXFVYXO2LGOQ%3D%3D%3D%3D%3D%3D&ro=false;

]FIG]


[125] [CITE@en[Change to expression matching algorithm (#71) · w3c/webappsec-csp@e6d9233]]
([TIME[2016-04-18 13:02:38 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/e6d92335d0b9797fa72517c16dda01dd8e761449>

[126] [CITE@en[Define 'Content Security Policy'. · w3c/webappsec-csp@b98e59b]]
([TIME[2016-04-21 12:03:26 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/b98e59bd478435577f78699e65ee135954e2ce42>

[127] [CITE@en[Content Security Policy Level 3]]
([TIME[2016-04-25 18:02:58 +09:00]] 版)
<https://www.w3.org/TR/2016/WD-CSP3-20160425/>

[128] [CITE@en[Allow hashes to match external scripts · w3c/webappsec-csp@a299d38]]
([TIME[2016-04-26 12:11:05 +09:00]] 版)
<https://github.com/w3c/webappsec-csp/commit/a299d38d1b54e3d9612d11fb69cc8174b5e44051>

[129] [CITE@en[Fix up the logic in source list matching (#74)]]
( ([[shekyan]]著, [TIME[2016-05-03 18:53:58 +09:00]]))
<https://github.com/w3c/webappsec-csp/commit/8c1b6a88777374c3b47976fb5d4201d449a679f1>

[130] [CITE@en[Fold CSPDOCUMENT into CSP.]]
( ([[mikewest]]著, [TIME[2016-05-23 12:05:43 +09:00]]))
<https://github.com/w3c/webappsec-csp/commit/0cd4bf42b5e78168cd85efe798a9a5e719677b8e>

[131] [CITE@en[Updating references from CSPDOCUMENT to CSP]]
( ([[mikewest]]著, [TIME[2016-05-23 15:34:43 +09:00]]))
<https://github.com/whatwg/html/commit/c90e53cfa0d4ae43110589ea7c2718b65be3fda7>

[FIG(quote)[
[FIGCAPTION[
[132] [CITE[CloudFlare - The web performance & security company]]
( ([TIME[2016-05-19 04:03:42 +09:00]]))
<https://www.cloudflare.com/>
]FIGCAPTION]

> Content-Security-Policy: default-src 'self' https://*; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://* data:; img-src 'self' https://* data:; style-src 'self' 'unsafe-inline' https://*; font-src 'self' https://* data:; frame-src https://*; connect-src 'self' https://* wss://*.zopim.com data:;
> 

]FIG]


[FIG(quote)[
[FIGCAPTION[
[133] [CITE@en-US[Chrome incompatibilities - Mozilla | MDN]]
( ([TIME[2016-06-14 10:15:04 +09:00]]))
<https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Chrome_incompatibilities>
]FIGCAPTION]

> content_security_policy
> Firefox does not support:
> "http://127.0.0.1" or "http://localhost" as script sources: they must be served over HTTPS.

]FIG]


[134] [CITE@en-US[Content Security Policy - Mozilla | MDN]]
( ([TIME[2016-05-28 19:17:23 +09:00]]))
<https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Content_Security_Policy>

[135] [CITE@en[Content Security Policy Level 3]]
( ([TIME[2016-06-21 19:25:50 +09:00]]))
<https://www.w3.org/TR/2016/WD-CSP3-20160621/>

[136] [CITE@en[Add IANA considerations section referencing `require-sri-for`]]
([[shekyan]]著, [TIME[2016-06-23 02:17:37 +09:00]])
<https://github.com/w3c/webappsec-subresource-integrity/commit/853ab1bd8815e23001a24c57b68f424cdd09f0b5>

[FIG(quote)[
[FIGCAPTION[
[137] [CITE@en[amphtml/amp-html-format.md at master · ampproject/amphtml]]
([TIME[2016-07-04 11:16:59 +09:00]])
<https://github.com/ampproject/amphtml/blob/master/spec/amp-html-format.md>
]FIGCAPTION]

> AMP HTML documents must not trigger errors when served with a Content Security Policy that does not include the keywords unsafe-inline and unsafe-eval.

]FIG]


[FIG(quote)[
[FIGCAPTION[
[140] [CITE@en[Call for Consensus: Stop work and transition 3 Working Drafts to  Working Group Notes]]
([[Brad Hill]]著, [TIME[2016-07-13 06:33:27 +09:00]])
<https://lists.w3.org/Archives/Public/public-webappsec/2016Jul/0013.html>
]FIGCAPTION]

> CSP Cookie Controls
> https://www.w3.org/TR/csp-cookies/
> Last updated ~6 months ago.
> Reason to transition to Note: The Feature Policy proposal (
> https://wicg.github.io/feature-policy/) could be a better home for the
> intended functionality as part of a broader and more coherent approach,
> rather than putting this into CSP.

]FIG]


[FIG(quote)[
[FIGCAPTION[
[141] [CITE@en[Call for Consensus: Stop work and transition 3 Working Drafts to  Working Group Notes]]
([[Brad Hill]]著, [TIME[2016-07-13 06:33:27 +09:00]])
<https://lists.w3.org/Archives/Public/public-webappsec/2016Jul/0013.html>
]FIGCAPTION]

> CSP Pinning
> https://www.w3.org/TR/csp-pinning/
> Last updated ~6 months ago.
> Reason to transition to Note: While this kind of feature is still
> considered useful, like Cookie Controls and Feature Policy, the editor
> feels it would be better managed as part of a more generalized strategy for
> header pinning, and as part of that, with a strategy perhaps along the
> lines of a manifest, well-known resource or service worker that doesn't
> incur the cost of sending the pinning header with every request.

]FIG]


[142] [CITE@en[Transition Cookie Controls and Pinning to NOTE status (#103)]]
([[hillbrad]]著, [TIME[2016-08-02 03:53:52 +09:00]])
<https://github.com/w3c/webappsec-csp/commit/d3705f5c4fda042345bfb1457388ba9c27c69420>

[143] [CITE@en[Pass |origin| into matching algorithms.]]
([[@shekyan]]著, [TIME[2016-08-16 17:21:01 +09:00]])
<https://github.com/w3c/webappsec-csp/commit/3739f6f1b1406c3c88757803859aeb6836028d38>

[144] [CITE@en[Content Security Policy Level 3]]
([TIME[2016-08-18 17:25:03 +09:00]])
<https://www.w3.org/TR/2016/WD-CSP3-20160818/>

[145] [CITE@en[Allow "*" to match scheme of protected resource (#105)]]
([[shekyan]]著, [TIME[2016-08-19 14:24:12 +09:00]])
<https://github.com/w3c/webappsec-csp/commit/22c3ab8ff872668b2454227e87427e8677f4db7c>