8 Commits

Author	SHA1	Message	Date
janekptacijarabaci	896e23c20e	CSP: connect-src 'self' should always include https: and wss: schemes	2018-02-22 11:30:29 +01:00
janekptacijarabaci	cdcfbde10d	CSP: Support IDNs in connect-src	2018-02-22 11:23:16 +01:00
janekptacijarabaci	b4dac5093a	CSP: Ignore nonces on <img> per spec	2018-02-22 11:20:38 +01:00
janekptacijarabaci	a06ce3f03b	CSP: Upgrade SO navigational requests per spec.	2018-02-22 11:18:23 +01:00
janekptacijarabaci	62d5359679	CSP 2 - ignore (x-)frame-options if CSP with frame-ancestors directive exists	2018-02-22 11:15:23 +01:00
wolfbeast	ef720ec250	Explicitly cancel channel after mixed content redirect.	2018-02-08 19:55:11 +01:00
wolfbeast	13e9a0c06d	CSP should only check host (not including path) when performing frame ancestors checks. ... This has been explicitly stated in the CSP-3 spec.	2018-02-06 09:03:16 +01:00
Matt A. Tobin	5f8de423f1	Add m-esr52 at 52.6.0	2018-02-02 04:16:08 -05:00