w3c/webappsec-csp

View on GitHub

WebAppSec Content Security Policy

Stars: 224
Forks: 93
Open beginner issues: 0
Indexed issues: 191
Avg merge: 18d 20h
Merged PRs (30d): 1

Dominant language: HTML
License: No license data
Last GitHub push: Sep 16, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

191 open issues indexed

`'strict-dynamic'` might be bypassed with `<link rel=modulepreload>` Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-csp#823 · Opened Sep 17, 2026
Enhancing import map handling under CSP without `script-src 'unsafe-inline'` in effect Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#822 · Opened Aug 26, 2026
Should csp-hash/csp-violation be reported to ReportingObserver when no report-to directive is specified? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#819 · Opened Aug 4, 2026
Ambiguity regarding frame-src enforcement for <object> and <embed> child navigables Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#816 · Opened May 22, 2026
Clarification RFC 7234 caches for present nonce-sources Open

Difficulty 5/5 Over a week Newbie friendliness 28/100

w3c/webappsec-csp#815 · 1 comment · 1 reaction · Opened May 7, 2026
Clarify object-src behavior when plugin content has no associated URL Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

w3c/webappsec-csp#814 · 5 comments · Opened May 1, 2026
Embedded enforcement links are broken Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

w3c/webappsec-csp#811 · Opened Apr 9, 2026
`frame-src` WPT test expects path to be stripped when loading cross-origin URL Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#809 · 1 comment · Opened Mar 28, 2026
Proposal: CSP control over interactive HTTP authentication for subresources Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#801 · Opened Feb 16, 2026
Integration point for WebDriver BiDi CSP bypass Open

addition/proposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#798 · Opened Feb 5, 2026
Providing a directive for XSLT Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#797 · Opened Jan 21, 2026
Attackers can exploit CSP to block requests to legitimate domains Open

addition/proposal needs implementer interest needs tests

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#792 · 11 comments · Opened Nov 25, 2025
Broken links in Content Security Policy Level 3 Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

w3c/webappsec-csp#789 · Opened Nov 3, 2025
Incorrect assertion in Obtain the deprecated serialization of violation Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

w3c/webappsec-csp#788 · Opened Oct 30, 2025
Incorrect assertion in form-action Pre-Navigation Check Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

w3c/webappsec-csp#782 · Opened Jul 28, 2025
`report-multiple-violations-{01,02}` don't conform with the spec Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#781 · Opened Jul 11, 2025
CSP report referrer should adhere to referrer policy Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#775 · 1 comment · Opened Jul 7, 2025
setting cssText rather than style Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#774 · 2 comments · 1 reaction · Opened Jul 1, 2025
Making CSP more usable for organizations at scale Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#736 · 11 comments · Opened Jun 18, 2025
Implementation differences with "Strip URL for use in reports" Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

w3c/webappsec-csp#735 · 19 comments · Opened Jun 13, 2025
Add Back The `prefetch-src` Directive to The CSP Header Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-csp#733 · 3 comments · Opened Jun 6, 2025
report-to directive to support multiple endpoints Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

w3c/webappsec-csp#785 · 6 comments · Opened May 23, 2025
Strict-Dynamic CSP doesn't prevent execution of parser inserted scripts via document.createRange().createContextualFragment Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-csp#708 · Opened Feb 26, 2025
"source file" lacks a real defintion Open

clarification interop

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#707 · 2 comments · Opened Feb 14, 2025
connect-src test suite allows multiple non-interopable implementations. Open

interop

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-csp#706 · 7 comments · Opened Jan 30, 2025
Clipping of violation’s sample to the 40 first characters Open

needs tests

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#704 · 6 comments · Opened Jan 23, 2025
How to specify 2 endpoints for Reporting-Endpoints? Open

meta

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/webappsec-csp#701 · 2 comments · Opened Jan 15, 2025
EnsureCSPDoesNotBlockStringCompilation: calling "Get Trusted Type compliant string" Open

editorial

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-csp#698 · Opened Dec 4, 2024
EnsureCSPDoesNotBlockStringCompilation: Explain why we need to check TrustedScript's data (and add tests) Open

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

w3c/webappsec-csp#697 · Opened Dec 4, 2024
https://w3c.github.io/webappsec-csp/#report-violation invokes "Queue a task" without passing a task source Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

w3c/webappsec-csp#696 · Opened Dec 2, 2024
Allow RFC3986 scheme relative URIs in host-source Open

addition/proposal

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-csp#694 · 2 comments · Opened Nov 27, 2024
Consider recommending the usage of events instead of CSP reports for CSP WPTs Open

meta

Difficulty 2/5 1-3 hours Newbie friendliness 50/100

w3c/webappsec-csp#690 · 1 comment · Opened Nov 19, 2024
Should "Should navigation request of type be blocked by Content Security Policy?" set the violation object's element? Open

clarification editorial

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#687 · 5 comments · Opened Oct 24, 2024
port-part being null is not handled Open

editorial

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#680 · Opened Sep 13, 2024
Feedback request on not capturing the caller in `new Function` and indirect `eval` Open

addition/proposal needs concrete proposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#679 · Opened Sep 4, 2024
Should font-src reporting kick in on font-face reference or font request? Open

agenda+

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#677 · 8 comments · Opened Aug 22, 2024
loading local stylesheets without self source Open

needs concrete proposal

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#676 · 2 comments · Opened Aug 13, 2024
Consider using SecurityPolicyViolationEvent.sourceFile a USVString Open

needs concrete proposal

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#674 · 1 comment · Opened Jul 31, 2024
CSP spec not user-friendly Open

needs concrete proposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#673 · 1 comment · Opened Jul 23, 2024
CSP Report Does Not Reflect Redirected Blocked Domains Open

wontfix

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#672 · 8 comments · Opened Jul 15, 2024
Add new CSP sandbox directive to allow SameSite=None cookies on top-level frames Open

agenda+

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/webappsec-csp#664 · 7 comments · Opened May 24, 2024
frame-src is not effective in restricting the possible origins of subframes Open

needs concrete proposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#662 · 3 comments · Opened May 21, 2024
Possibility to block all javascript: URLs Open

needs concrete proposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#658 · 4 comments · 5 reactions · Opened Apr 30, 2024
Document columnNumber format Open

editorial

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#649 · 1 comment · Opened Mar 13, 2024
Google Analytics URLs Open

needs concrete proposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#648 · 1 comment · Opened Feb 29, 2024
"Is element nonceable" not applied to non-<script> elements in Chrome? Open

needs tests

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-csp#643 · Opened Feb 12, 2024
`service-worker-src` directive Open

needs concrete proposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-csp#638 · 1 reaction · Opened Jan 17, 2024
Does "Is Element Nonceable" apply to non-inline scripts? Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-csp#635 · 1 comment · Opened Jan 12, 2024
Chrome/Safari trim nonces Open

clarification needs tests

Difficulty 2/5 1-3 hours Newbie friendliness 42/100

w3c/webappsec-csp#634 · 11 comments · Opened Jan 5, 2024
Some way to allow workers other than URL and strict-dynamic Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

w3c/webappsec-csp#632 · 2 reactions · Opened Dec 19, 2023

w3c/webappsec-csp

Get new issues in your inbox