{"action":"closed","issue":{"url":"https://api.github.com/repos/aidantwoods/SecureHeaders/issues/1","repository_url":"https://api.github.com/repos/aidantwoods/SecureHeaders","labels_url":"https://api.github.com/repos/aidantwoods/SecureHeaders/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/aidantwoods/SecureHeaders/issues/1/comments","events_url":"https://api.github.com/repos/aidantwoods/SecureHeaders/issues/1/events","html_url":"https://github.com/aidantwoods/SecureHeaders/issues/1","id":188755328,"number":1,"title":"[Feature Request] Support 'strict-dynamic' by default","user":{"login":"mikispag","id":991637,"avatar_url":"https://avatars.githubusercontent.com/u/991637?v=3","gravatar_id":"","url":"https://api.github.com/users/mikispag","html_url":"https://github.com/mikispag","followers_url":"https://api.github.com/users/mikispag/followers","following_url":"https://api.github.com/users/mikispag/following{/other_user}","gists_url":"https://api.github.com/users/mikispag/gists{/gist_id}","starred_url":"https://api.github.com/users/mikispag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikispag/subscriptions","organizations_url":"https://api.github.com/users/mikispag/orgs","repos_url":"https://api.github.com/users/mikispag/repos","events_url":"https://api.github.com/users/mikispag/events{/privacy}","received_events_url":"https://api.github.com/users/mikispag/received_events","type":"User","site_admin":false},"labels":[{"id":464207388,"url":"https://api.github.com/repos/aidantwoods/SecureHeaders/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"closed","locked":false,"assignee":{"login":"aidantwoods","id":3288888,"avatar_url":"https://avatars.githubusercontent.com/u/3288888?v=3","gravatar_id":"","url":"https://api.github.com/users/aidantwoods","html_url":"https://github.com/aidantwoods","followers_url":"https://api.github.com/users/aidantwoods/followers","following_url":"https://api.github.com/users/aidantwoods/following{/other_user}","gists_url":"https://api.github.com/users/aidantwoods/gists{/gist_id}","starred_url":"https://api.github.com/users/aidantwoods/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aidantwoods/subscriptions","organizations_url":"https://api.github.com/users/aidantwoods/orgs","repos_url":"https://api.github.com/users/aidantwoods/repos","events_url":"https://api.github.com/users/aidantwoods/events{/privacy}","received_events_url":"https://api.github.com/users/aidantwoods/received_events","type":"User","site_admin":false},"assignees":[{"login":"aidantwoods","id":3288888,"avatar_url":"https://avatars.githubusercontent.com/u/3288888?v=3","gravatar_id":"","url":"https://api.github.com/users/aidantwoods","html_url":"https://github.com/aidantwoods","followers_url":"https://api.github.com/users/aidantwoods/followers","following_url":"https://api.github.com/users/aidantwoods/following{/other_user}","gists_url":"https://api.github.com/users/aidantwoods/gists{/gist_id}","starred_url":"https://api.github.com/users/aidantwoods/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aidantwoods/subscriptions","organizations_url":"https://api.github.com/users/aidantwoods/orgs","repos_url":"https://api.github.com/users/aidantwoods/repos","events_url":"https://api.github.com/users/aidantwoods/events{/privacy}","received_events_url":"https://api.github.com/users/aidantwoods/received_events","type":"User","site_admin":false}],"milestone":null,"comments":8,"created_at":"2016-11-11T13:00:27Z","updated_at":"2016-11-14T09:36:12Z","closed_at":"2016-11-14T09:36:12Z","body":"It would be really cool if you could add support for `'strict-dynamic'` ([W3C](https://w3c.github.io/webappsec-csp/#strict-dynamic-usage)) by default.\r\n\r\nGoogle is offering [Google Patch Rewards](https://csp.withgoogle.com/docs/faq.html#csp-patches) for integrating CSP in popular frameworks and facilitating adoption (as you already did, so please apply!). \r\n\r\nThe most recent research on CSP demonstrated that [the whitelist-based approach is intrinsically flawed for XSS mitigation](https://research.google.com/pubs/pub45542.html), and that [a nonce/hash + 'strict-dynamic' policy](https://csp.withgoogle.com/docs/strict-csp.html), similar to the ones already served by important Google products, is in the quasi-totality of cases the only working solution.\r\n\r\nThere are a lot of misconceptions about CSP, and getting rid of things that are proven not to work is good - the worst thing you can have is a false sense of security.\r\n\r\nIf you could also add a link to the [CSP Evaluator](https://csp-evaluator.withgoogle.com/) to your README, to let users evaluate the quality of their policy, it would be awesome.\r\n\r\nPlease do not hesitate to get back to me if you need any additional information or have doubts.\r\n\r\n## More resources\r\n\r\n- https://csp.withgoogle.com\r\n- https://csp.withgoogle.com/docs/strict-csp.html\r\n- https://csp-evaluator.withgoogle.com\r\n- https://www.google.com/about/appsecurity/patch-rewards/\r\n\r\n"}}
{"actor":{"display_login":"aidantwoods"}}