Subject: Wellknown suffix proposal: csp.txt

From: hiburn 8 <[email-masked]>
Date: Fri, 22 May 2020 03:25:22 +0100

URI suffix:  csp.txt

Description:

The csp.txt suffix should point to a plaintext file. This file
describes the required Content-Security-Policy

(CSP) directives necessary for other origins to embed its content.

This would be of use for site administrators to quickly allow content
from other origins, without

being required to first determine the CSP attributes that permit
access to the content,

while maintaining the most restrictive/secure policy. This would also
allow site owners to quickly resolve

content issues; for example, when an allowed javascript file is
modified to require additional content from

another domain which is not permitted by CSP.

Specification:

There is only one mandatory field for a csp.txt, 'Content-Security-Policy'.

The value of which is identical to the attributes of a
Content-Security-Policy (rfc7762) header.

Example:

------------------This line is not included----------------------------

Content-Security-Policy: font-src example.com; connect-src example.com

------------------This line is not included----------------------------

Optionally, the 'Path' field indicates the coverage of the
'Content-Security-Policy' field.

It describes an absolute or relative path where the CSP attributes apply.

This is useful if there are different content services on different
paths, which can then be added to a CSP

selectively. Likewise, the 'Path' field can show the same information
for subdomains. An omitted 'Path' field

is identical to 'Path: /'

Example:

------------------This line is not included----------------------------

Path: /fonts

Content-Security-Policy: font-src example.com;

Path: /scripts

Content-Security-Policy: script-src example.com; connect-src example.com

Path: iframe.example.com

Content-Security-Policy: frame-src example

------------------This line is not included----------------------------

Additional Info: The main purpose for proposing this suffix is to tackle
the management overhead of

CSPs [Which is a pain in my ass], as well as make CSPs generally more secure.

- Daniel Reece @hbrn8

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 22 May 2020 12:35:14 +1000

Hello,

Thanks for the request.

The specification needs to be referred to using a URL, not inline. Generally, it's best to use an RFC or other publication by a standards body, or an organisational page (so that it's more likely to be stable over time).

That said, is this being run through the W3C WebAppSec Working Group? If not, we'd want to check with them before granting the registration; while registering this with a more specific name (e.g., `hiburn8-csp.txt`) wouldn't be a problem, consuming `csp.txt` without buy-in from them would be problematic.

Cheers,

> On 22 May 2020, at 12:25 pm, hiburn 8 <[email-masked]> wrote:
> 
> URI suffix:  csp.txt
> 
> Description: 
> The csp.txt suffix should point to a plaintext file. This file describes the required Content-Security-Policy 
> This would be of use for site administrators to quickly allow content from other origins, without
> being required to first determine the CSP attributes that permit access to the content,
> while maintaining the most restrictive/secure policy. This would also allow site owners to quickly resolve 
> content issues; for example, when an allowed javascript file is modified to require additional content from 
> The value of which is identical to the attributes of a Content-Security-Policy (rfc7762) header.
> Example:
> 
> Optionally, the 'Path' field indicates the coverage of the 'Content-Security-Policy' field.
> This is useful if there are different content services on different paths, which can then be added to a CSP
> selectively. Likewise, the 'Path' field can show the same information for subdomains. An omitted 'Path' field 
> Additional Info: The main purpose for proposing this suffix is to tackle the management overhead of 
> _______________________________________________
> wellknown-uri-review mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/wellknown-uri-review

--
Mark Nottingham   https://www.mnot.net/

---

From: hiburn 8 <[email-masked]>
Date: Fri, 22 May 2020 03:58:38 +0100

Hi Mark.
Thanks for the quick reply.

I did intend on creating an organisational page and registered csptxt.org
in its place, leave it with me and i'll resubmit with a URI. Will that be
acceptable? I could look into starting an RFC, but i have no experience
with this.

It has not yet been ran by the W3C WebAppSec Working Group (I am not
actually a member). Do you suggest I register and seek a consensus?

thanks again,

On Fri, May 22, 2020 at 3:35 AM Mark Nottingham <[email-masked]> wrote:

> Hello,
>
> Thanks for the request.
>
> The specification needs to be referred to using a URL, not inline.
> Generally, it's best to use an RFC or other publication by a standards
> body, or an organisational page (so that it's more likely to be stable over
> time).
>
> That said, is this being run through the W3C WebAppSec Working Group? If
> not, we'd want to check with them before granting the registration; while
> registering this with a more specific name (e.g., `hiburn8-csp.txt`)
> wouldn't be a problem, consuming `csp.txt` without buy-in from them would
> be problematic.
>
> Cheers,
>
>

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 22 May 2020 13:03:41 +1000

> On 22 May 2020, at 12:58 pm, hiburn 8 <[email-masked]> wrote:
> 
> Hi Mark.
> I did intend on creating an organisational page and registered csptxt.org in its place, leave it with me and i'll resubmit with a URI. Will that be acceptable? I could look into starting an RFC, but i have no experience with this. 

A web page run by a single person isn't ideal.

> It has not yet been ran by the W3C WebAppSec Working Group (I am not actually a member). Do you suggest I register and seek a consensus?

I highly recommend it. Again, I don't think we can register "csp.txt" without their buy-in.

Cheers,

---

From: hiburn 8 <[email-masked]>
Date: Fri, 22 May 2020 04:10:41 +0100

' A web page run by a single person isn't ideal. '
Agreed. I believe i can get support from OWASP on this then.

'I highly recommend it. Again, I don't think we can register "csp.txt"
without their buy-in.'
Ok, I'll do that now then. Cheers for your help!

On Fri, May 22, 2020 at 4:03 AM Mark Nottingham <[email-masked]> wrote:

> > I did intend on creating an organisational page and registered
> csptxt.org in its place, leave it with me and i'll resubmit with a URI.
> Will that be acceptable? I could look into starting an RFC, but i have no
> experience with this.
>