diff --git a/index.bs b/index.bs index 3531494b..029cf2ce 100644 --- a/index.bs +++ b/index.bs @@ -427,6 +427,55 @@ spec:reporting; urlPrefix: https://w3c.github.io/reporting/ +
+

+ The `` element +

+ + A {{Document}} may deliver a policy via one or more HTML <{meta}> elements + whose <{meta/http-equiv}> attributes are an ASCII case-insensitive + match for the string "`Feature-Policy`". For example: + +
+ 
+        <meta http-equiv="Feature-Policy" content="fullscreen 'none'; geolocation 'none'">
+
+
+ + Implementation details can be found in HTML's Feature Policy state + `http-equiv` processing instructions [[!HTML]]. + + Authors are strongly encouraged to place <{meta}> elements as early + in the document as possible, because policies in <{meta}> elements are not + applied to content which precedes them. + +
+ + For example, a script tag that preceded a <{meta}>-delivered policy + directive of `sync-xhr ‘none’` would still be able to call + `XMLHttpRequest.open()`. + + 
+        <script>
+          var req = new XMLHttpRequest();
+          req.open("GET", "/api/security_check.json", false);
+          req.send();
+        </script>
+
+        <meta http-equiv="Feature-Policy" content="sync-xhr ‘none">
+
+ + In the above, the call to `req.open` will succeed, because the policy + disabling `sync-xhr` occurs after it, in the markup. + +
+ + Note: A policy specified via a <{meta}> element will be enforced along with any other policies active, regardless of where they're specified. However, once a specific Feature Policy directive has been set by way of an HTTP header or <{meta}> element, that directive cannot be further updated or changed. + + + Note: Modifications to the <{meta/content}> attribute of a <{meta}> element after the element has been parsed will be ignored. + +

Policy Introspection from Scripts

@@ -1089,6 +1138,26 @@ partial interface HTMLIFrameElement {
  • Otherwise, return false.
    • +
    +

    Merge two declared policies

    +

    Given two declared policies, existing policy and new policy, this algorithm returns a single, merged declared policy.

    +
      +
    1. Let merged policy be a copy of existing policy.
      2. +
    2. For each feature → allowlist of new policy: +
      1. If merged policy does not contain an allowlist for feature, then set merged policy[feature] to allowlist. +
      +
      3. +
    3. Return merged policy.
      4. +
    +
    +

    This isn't all that different from Merge directive with declared policy, except that: +

    +

    So I guess, given that, does this really need to exist as a separate algorithm?

    +
    +