{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/215","repository_url":"https://api.github.com/repos/w3c/webappsec-csp","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/215/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/215/comments","events_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/215/events","html_url":"https://github.com/w3c/webappsec-csp/issues/215","id":228325068,"node_id":"MDU6SXNzdWUyMjgzMjUwNjg=","number":215,"title":"Multiple CSP headers restriction is unclear","user":{"login":"ameshkov","id":5947035,"node_id":"MDQ6VXNlcjU5NDcwMzU=","avatar_url":"https://avatars0.githubusercontent.com/u/5947035?v=4","gravatar_id":"","url":"https://api.github.com/users/ameshkov","html_url":"https://github.com/ameshkov","followers_url":"https://api.github.com/users/ameshkov/followers","following_url":"https://api.github.com/users/ameshkov/following{/other_user}","gists_url":"https://api.github.com/users/ameshkov/gists{/gist_id}","starred_url":"https://api.github.com/users/ameshkov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ameshkov/subscriptions","organizations_url":"https://api.github.com/users/ameshkov/orgs","repos_url":"https://api.github.com/users/ameshkov/repos","events_url":"https://api.github.com/users/ameshkov/events{/privacy}","received_events_url":"https://api.github.com/users/ameshkov/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2017-05-12T15:21:03Z","updated_at":"2018-07-26T13:01:42Z","closed_at":"2017-05-12T15:49:15Z","author_association":"NONE","body":"We're [struggling to understand](https://github.com/gorhill/uBlock/issues/1930#issuecomment-301078116) what does that clause mean in the documentation:\r\n\r\nhttps://www.w3.org/TR/CSP2/#content-security-policy-header-field\r\n\r\n> A server MUST NOT send more than one HTTP header field named Content-Security-Policy with a given resource representation.\r\n\r\n> A server MAY send different Content-Security-Policy header field values with different representations of the same resource or with different resources.\r\n\r\n> Upon receiving an HTTP response containing at least one Content-Security-Policy header field, the user agent MUST enforce each of the policies contained in each such header field.\r\n\r\nAs I understand, the first part means that server must not send multiple CSP headers in a single response, while the third part implies, that it could.\r\n\r\nI see, that in the draft `MUST NOT` was replaced with `SHOULD NOT`, but anyway, it stays unclear."},"comment":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/comments/408089455","html_url":"https://github.com/w3c/webappsec-csp/issues/215#issuecomment-408089455","issue_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/215","id":408089455,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODA4OTQ1NQ==","user":{"login":"cnsgithub","id":13161711,"node_id":"MDQ6VXNlcjEzMTYxNzEx","avatar_url":"https://avatars3.githubusercontent.com/u/13161711?v=4","gravatar_id":"","url":"https://api.github.com/users/cnsgithub","html_url":"https://github.com/cnsgithub","followers_url":"https://api.github.com/users/cnsgithub/followers","following_url":"https://api.github.com/users/cnsgithub/following{/other_user}","gists_url":"https://api.github.com/users/cnsgithub/gists{/gist_id}","starred_url":"https://api.github.com/users/cnsgithub/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cnsgithub/subscriptions","organizations_url":"https://api.github.com/users/cnsgithub/orgs","repos_url":"https://api.github.com/users/cnsgithub/repos","events_url":"https://api.github.com/users/cnsgithub/events{/privacy}","received_events_url":"https://api.github.com/users/cnsgithub/received_events","type":"User","site_admin":false},"created_at":"2018-07-26T13:01:42Z","updated_at":"2018-07-26T13:01:42Z","author_association":"NONE","body":"Can someone give me a hint if it would be safe to generate a unique `nonce `per session and reuse it for all upcoming `script `blocks? At least browsers seem not to refuse those scripts?"}}
{"actor":{"display_login":"cnsgithub"}}