Clarify that CSP adds restrictions to SOP #35621
Merged
+1
−2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A coworker found the existing line alarming, interpreting it to mean that adding a badly written CSP could actually undo some of the protections of the SOP. (This is not unprecedented, as the frame-ancestors directive overrides an existing X-Frame-Options header.) I've tried rewriting those lines to clarify the situation.
github-actions
bot
added
Content:HTTP
|
Preview URLs (comment last updated: 2024-08-29 20:10:39) |
wbamberg
reviewed
Aug 29, 2024
files/en-us/web/http/csp/index.md
Outdated
Comment on lines
15
to
16
| Browsers that don't support it still work with servers that implement it, and vice versa. Browsers that don't support CSP ignore it, functioning as usual; they will only apply the protections of the standard [same-origin policy](/en-US/docs/Web/Security/Same-origin_policy) without the further restrictions that the CSP would add. | ||
| The same is true for when a site doesn't offer a CSP header. |
There was a problem hiding this comment.
I think this change is an improvement, definitely, but I don't think the last sentence is very clear: in particular, the scope of "the same is true" isn't very obvious. The same as what?
Personally I think it would be OK just to delete that sentence: the main point here is that if a site sets CSP, and the browser doesn't support it, then normal SOP applies.
There was a problem hiding this comment.
Good point, deleting that last sentence.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Clarify that CSP builds on top of SOP rather than replacing it.
Motivation
A coworker found the existing line alarming, interpreting it to mean that adding a badly written CSP could actually undo some of the protections of the SOP. (This is not unprecedented, as the frame-ancestors directive overrides an existing X-Frame-Options header.) I've tried rewriting those lines to clarify the situation.