Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
Security Considerations section should contain additional guidance #58
CM API offers protection against a class of XSS attacks to obtain passwords. However, there are still some attacks not prevented by CM API itself. One is described in https://crbug.com/686487 and one more in a particular comment on that bug https://crbug.com/686487#c10. (Not listing those scenarios here until that bug is public.)
We could add a non-normative section in the Security Consideration, listing suggested additional security measures to be used in combination with CM API to provide the best protection against XSS attacks on passwords.