Skip to content

Issues: w3c/webappsec-suborigins

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

24 Open 21 Closed
24 Open 21 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

Mark spec as no longer being worked on? And archive this repo?
#81 opened Mar 17, 2021 by sideshowbarker
Document how Referrer Policy would work with suborigins
#80 opened Apr 23, 2018 by jeremylong v1
1
Tainting a canvas in case of different suborigins
#79 opened Nov 2, 2017 by mniemietz
2
Integration with the Storage Standard
#78 opened Sep 28, 2017 by annevk
Consider renaming unsafe-postmessage-* to unsafe-window-postmessage-*
#77 opened Sep 27, 2017 by annevk
Tradeoff between unsafe-* and refactoring
#76 opened Sep 27, 2017 by annevk
Remove unsafe-cookies
#75 opened Sep 27, 2017 by annevk
1
Alternate postMessage() design
#74 opened Sep 27, 2017 by annevk
1
Alternate CORS design
#73 opened Sep 27, 2017 by annevk
1
Rename Suborigin request header to Sec-suborigin
#72 opened May 23, 2017 by annevk
Protecting Suborigined content from non-suborigined content
#71 opened May 18, 2017 by adob
4
Keep the published editors draft in sync with master
#70 opened May 18, 2017 by adob
6
Remove Unicode serialization of a suborigin
#69 opened May 17, 2017 by annevk v1
Remove need for serializing a suborigin
#66 opened Apr 18, 2017 by jeisinger
same-physical-origin not defined for opaque origins
#65 opened Feb 24, 2017 by clelland
2
Use path prefixes instead?
#64 opened Jan 20, 2017 by hlandau
3
Update security model opt-out flags to interact with processing models
#51 opened Oct 11, 2016 by joelweinberger v1
What to do with WebSockets enhancement
#44 opened Sep 8, 2016 by joelweinberger vNext
6
Suborigin cookies should not be treated as third-party
#43 opened Sep 7, 2016 by devd v1
2
document.suborigin or something should allow JS to detect if in suborigin
#35 opened May 9, 2016 by devd v1
7
How to treat localStorage and sessionStorage
#34 opened May 3, 2016 by joelweinberger v1
18
Think through the suborigin is more trusted than the parent scenario
#29 opened Mar 9, 2016 by devd v1
2
think through fetch modifications
#25 opened Mar 9, 2016 by devd v1
2
Make workers (including service workers) work
#21 opened Mar 6, 2016 by mitar vNext
4
ProTip! no:milestone will show everything without a milestone.