Josh Grossman

Yeah but the hard part here isn't adding a bit of text to the CSP header, it is having the infra to collect the violation logs which is why I...

Yeah but it is a logging thing more than it is a browser header thing

I discussed this with Elar and he made two very good points 1) The report logging mechanism almost certainly will be outside of the application and is therefore technically not...

So we now also have: | # | Description | L1 | L2 | L3 | CWE | | :---: | :--- | :---: | :---: | :---: | :---:...

@elarlang any idea what the next stage is here

haha so now we also have 50.5.4. Reproducing the whole section here: | # | Description | L1 | L2 | L3 | CWE | | :---: | :--- |...

@elarlang how many requirements do you think this should be merged down to?

@elarlang that all makes sense to me

Current v50.6.1: > [MODIFIED, MOVED FROM 12.5.2, MERGED FROM 1.12.2, 14.4.2] Verify that security controls are in place to prevent browsers from rendering content or functionality in HTTP responses in...

Ok so let's leave it for now, I updated the Google Sheet