{"action":"created","issue":{"url":"https://api.github.com/repos/ampproject/amphtml/issues/6992","repository_url":"https://api.github.com/repos/ampproject/amphtml","labels_url":"https://api.github.com/repos/ampproject/amphtml/issues/6992/labels{/name}","comments_url":"https://api.github.com/repos/ampproject/amphtml/issues/6992/comments","events_url":"https://api.github.com/repos/ampproject/amphtml/issues/6992/events","html_url":"https://github.com/ampproject/amphtml/issues/6992","id":200184860,"number":6992,"title":"Don't forbid nonces in AMP spec","user":{"login":"aidantwoods","id":3288888,"avatar_url":"https://avatars.githubusercontent.com/u/3288888?v=3","gravatar_id":"","url":"https://api.github.com/users/aidantwoods","html_url":"https://github.com/aidantwoods","followers_url":"https://api.github.com/users/aidantwoods/followers","following_url":"https://api.github.com/users/aidantwoods/following{/other_user}","gists_url":"https://api.github.com/users/aidantwoods/gists{/gist_id}","starred_url":"https://api.github.com/users/aidantwoods/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aidantwoods/subscriptions","organizations_url":"https://api.github.com/users/aidantwoods/orgs","repos_url":"https://api.github.com/users/aidantwoods/repos","events_url":"https://api.github.com/users/aidantwoods/events{/privacy}","received_events_url":"https://api.github.com/users/aidantwoods/received_events","type":"User","site_admin":false},"labels":[{"id":270707801,"url":"https://api.github.com/repos/ampproject/amphtml/labels/Type:%20Discussion","name":"Type: Discussion","color":"207de5","default":false}],"state":"open","locked":false,"assignee":{"login":"cramforce","id":89679,"avatar_url":"https://avatars.githubusercontent.com/u/89679?v=3","gravatar_id":"","url":"https://api.github.com/users/cramforce","html_url":"https://github.com/cramforce","followers_url":"https://api.github.com/users/cramforce/followers","following_url":"https://api.github.com/users/cramforce/following{/other_user}","gists_url":"https://api.github.com/users/cramforce/gists{/gist_id}","starred_url":"https://api.github.com/users/cramforce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cramforce/subscriptions","organizations_url":"https://api.github.com/users/cramforce/orgs","repos_url":"https://api.github.com/users/cramforce/repos","events_url":"https://api.github.com/users/cramforce/events{/privacy}","received_events_url":"https://api.github.com/users/cramforce/received_events","type":"User","site_admin":false},"assignees":[{"login":"cramforce","id":89679,"avatar_url":"https://avatars.githubusercontent.com/u/89679?v=3","gravatar_id":"","url":"https://api.github.com/users/cramforce","html_url":"https://github.com/cramforce","followers_url":"https://api.github.com/users/cramforce/followers","following_url":"https://api.github.com/users/cramforce/following{/other_user}","gists_url":"https://api.github.com/users/cramforce/gists{/gist_id}","starred_url":"https://api.github.com/users/cramforce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cramforce/subscriptions","organizations_url":"https://api.github.com/users/cramforce/orgs","repos_url":"https://api.github.com/users/cramforce/repos","events_url":"https://api.github.com/users/cramforce/events{/privacy}","received_events_url":"https://api.github.com/users/cramforce/received_events","type":"User","site_admin":false}],"milestone":null,"comments":9,"created_at":"2017-01-11T19:27:36Z","updated_at":"2017-01-17T18:34:25Z","closed_at":null,"body":"Nonces are currently forbidden in the AMP spec. \r\n\r\nAMP requires that their own content security policy does not produce any errors with AMP pages that others produce (https://www.ampproject.org/docs/reference/spec#security), while simultaneously making the advice given by Google towards best practices for the future of CSP (https://research.google.com/pubs/pub45542.html) incompatible with the specification.\r\n\r\nSearching through previous issues, there has been some address to the reasoning for this (https://github.com/ampproject/amphtml/issues/323#issuecomment-147589460):\r\n\r\n> We cannot use nonces in AMP because they are not compatible with cache-control: public (besides not being supported in Safari).\r\n\r\nSafari now supports nonces (so does [Microsoft Edge](https://blogs.windows.com/msedgedev/2017/01/10/edge-csp-2/)). Additionally, servers that cache content could implement stripping of nonces/forgo sending a CSP header containing a nonce (which would then transfer the scripting risk to their domain).\r\n\r\nIt should be up to the original website to decide whether setting cache-control: public (and forgoing nonces) is a worthwhile tradeoff. (As far as I know, most AMP pages are served through Google's cache anyway – so the original site's cache-control usually won't matter)."},"comment":{"url":"https://api.github.com/repos/ampproject/amphtml/issues/comments/273257191","html_url":"https://github.com/ampproject/amphtml/issues/6992#issuecomment-273257191","issue_url":"https://api.github.com/repos/ampproject/amphtml/issues/6992","id":273257191,"user":{"login":"aidantwoods","id":3288888,"avatar_url":"https://avatars.githubusercontent.com/u/3288888?v=3","gravatar_id":"","url":"https://api.github.com/users/aidantwoods","html_url":"https://github.com/aidantwoods","followers_url":"https://api.github.com/users/aidantwoods/followers","following_url":"https://api.github.com/users/aidantwoods/following{/other_user}","gists_url":"https://api.github.com/users/aidantwoods/gists{/gist_id}","starred_url":"https://api.github.com/users/aidantwoods/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aidantwoods/subscriptions","organizations_url":"https://api.github.com/users/aidantwoods/orgs","repos_url":"https://api.github.com/users/aidantwoods/repos","events_url":"https://api.github.com/users/aidantwoods/events{/privacy}","received_events_url":"https://api.github.com/users/aidantwoods/received_events","type":"User","site_admin":false},"created_at":"2017-01-17T18:34:25Z","updated_at":"2017-01-17T18:34:25Z","body":"@cramforce (just to pick up on the discussion here)\r\n\r\nThat seems sensible. Change would only to be to allow the nonce attribute in scripts and styles – arbitrary scripts should stay illegal per spec.\r\n\r\ni.e. `<script nonce='whatever'></script>` is still not allowed.\r\n\r\nBut currently allowed scripts should permit use of the nonce attribute."}}
{"actor":{"display_login":"aidantwoods"}}