{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/115","repository_url":"https://api.github.com/repos/w3c/webappsec-csp","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/115/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/115/comments","events_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/115/events","html_url":"https://github.com/w3c/webappsec-csp/issues/115","id":175983007,"number":115,"title":"Embedding-CSP header","user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/w3c/webappsec-csp/labels/CSP","name":"CSP","color":"ededed"},{"url":"https://api.github.com/repos/w3c/webappsec-csp/labels/EMBEDDED","name":"EMBEDDED","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-09T10:59:02Z","updated_at":"2016-09-09T13:29:08Z","closed_at":null,"body":"This is a new header that apparently ruins CORS preflight guarantees. When are we going to stop doing that?"},"comment":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/comments/245912832","html_url":"https://github.com/w3c/webappsec-csp/issues/115#issuecomment-245912832","issue_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/115","id":245912832,"user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"created_at":"2016-09-09T13:29:08Z","updated_at":"2016-09-09T13:29:08Z","body":"> This is a new header that apparently ruins CORS preflight guarantees.\r\n\r\nThe new header is limited to navigational requests generate from `<iframe>` elements, which might not be clear from the current document.\r\n\r\nWith that in mind, the client-side CORS impacts should be limited, as we're operating in `navigate` mode, and wouldn't give access to the bits coming back across the wire in any event. The server-side impacts are limited to sites that are using the `Embedding-CSP` header for some internal purpose, and don't expect user agents to send them along with requests.\r\n\r\n> When are we going to stop doing that?\r\n\r\nWhen we no longer build features that require request-side signals. :)\r\n\r\nWhat would you like us to do here? Is there a design you'd prefer to header-based signaling?"}}
{"actor":{"display_login":"mikewest"}}