Planning 2025-10-15.

[mikewest]

Planning the agenda for 2025-09-17:

• Proposal: schemeful-site Referrer-Policy webappsec-referrer-policy#176 (@arichiv)\
• Consider extracting PasswordCredential and FederatedCredential to separate specs? webappsec-credential-management#255 (@lukewarlow)
• <geolocation> (@andypaicu)
• TPAC (carryover from August)
• Exfiltration mitigation (outside of CSP) (@mikewest)
• Admin:
  • Updates on the path to CR (@simoneonofri)
  • Working mode for specs we're shifting to the CR snapshot model. #688 (@mikewest)
• (Your idea here!)

[arichiv]

I'd like to request: w3c/webappsec-referrer-policy#176

[mikewest]

Adding w3c/webappsec-credential-management#255 (@lukewarlow).

[mikewest]

Shifting this to cover the 2025-10-15 meeting; we're cancelling the 2025-09-17 meeting due to conflicts.

[simon-friedberger]

@mikewest could you give an update on the state of Sec-Fetch-? The Fetch standard is currently linking to https://w3c.github.io/webappsec-fetch-metadata/ which is still in draft state.

[mikewest]

@simon-friedberger: We can certainly add updates on our outstanding CR migrations to the agenda. Also CC'd you on the relevant issue.

[MinhAnhL]

We would love to request https://github.com/WICG/PEPC/blob/main/geolocation_explainer.md to add to the agenda
and optional if time also https://github.com/WICG/PEPC/blob/main/usermedia_element.md
@andypaicu will present

[lukewarlow]

I've just realised I'm OOO the week of this meeting so won't be able to attend, w3c/webappsec-credential-management#255 - this should still be possible to discuss without me though.

[mikewest]

Extended the agenda with the above topics.

@lukewarlow: I'd suggest sending an email to public-webappsec@ to make the proposal, and we can resolve the conversation there rather than waiting for the next meeting. At the end of the day, tt should be a decision that the editors of the Credential Management spec can make. We're not talking about any change of scope for the group, so the charter will cover the work. It's just a matter of splitting one deliverable into a few deliverables, but no formal change beyond that.

[simon-friedberger]

We should also discuss the future of https://github.com/w3c/webappsec-permissions-policy/issues/
It seems to have received little attention lately and is not moving along in the process.

[mikewest]

@clelland: WDYT about Permissions Policy?

And that reminds me: @miketaylr and @marcoscaceres, WDYT about advancing Permissions API to the CR snapshot model?

[miketaylr]

And that reminds me: @miketaylr and @marcoscaceres, WDYT about advancing Permissions API to the CR snapshot model?

Sounds reasonable to me. Will look at #688 to understand what that actually means though. :)