natechapin

> I went through the spec and I think the closest equivalent to what we do in chrome is to extend the condition and call [URL and history update steps](https://html.spec.whatwg.org/multipage/browsing-the-web.html#url-and-history-update-steps)...

> * Chrome 76.0.3800.0 dev: Blocks the execution if either _source_ or _target_ has a CSP that would block execution, which just isn't supported at all by the current spec,...

> > but it avoids having to snapshot the client's CSP > > The "client's CSP" doesn't depend on the targeted document, right? > > We could add more special-casing...

Sorry for the late reply. The chromium logic is primarily starting [here](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/frame/local_frame.cc;l=2267;drc=8900162810d457b64286ce653cb61bc2009c5068). Going through your steps: > > 1. If the target BC is not top-level, return OK line 2267...