Summarizing our latest meeting.
Initial Work For Trust and Safety
is-on-https
We want to align on the "mixed content" issues that will be landing in CDT soon. See this issue for more: #10615
COEP
One approach would be to fail if there is no COEP header. However, we are hesitant to do this because the benefits aren't universally applicable.
The approach we're going with is simply listing the frames that are blocked due to the embedder policy. This information will come from the backend, but it's still a WIP.
Existing audits
In addition, we want to re-home these existing audits:
external-anchors-use-rel-noopenerredirects-httpgeolocation-on-startnotification-on-startvulnerabilities
#10623
Place in the report
We have two options:
- A new category
- Group in best-practices
If we did 1, there's a question of how to present the score–badge vs score (and pass/fail vs numerical score). Due to that, we are leaning towards option 2.
Summarizing our latest meeting.
Initial Work For Trust and Safety
is-on-https
We want to align on the "mixed content" issues that will be landing in CDT soon. See this issue for more: #10615
COEP
One approach would be to fail if there is no COEP header. However, we are hesitant to do this because the benefits aren't universally applicable.
The approach we're going with is simply listing the frames that are blocked due to the embedder policy. This information will come from the backend, but it's still a WIP.
Existing audits
In addition, we want to re-home these existing audits:
external-anchors-use-rel-noopenerredirects-httpgeolocation-on-startnotification-on-startvulnerabilities#10623
Place in the report
We have two options:
If we did 1, there's a question of how to present the score–badge vs score (and pass/fail vs numerical score). Due to that, we are leaning towards option 2.