RFC 7762
Initial Assignment for the Content Security Policy Directives Registry
Initial Assignment for the Content Security Policy Directives Registry ✨
Okay bestie, this is RFC 7762 🎀 It's an Informational doc (not a Standards Track spec, so it's not a Big Official Internet Standard, but it's still super important 💅). M. West from Google, Inc wrote it, and it was published in January 2016 🌸 ISSN: 2070-1721. It doesn't obsolete or update anything else, so it's giving fresh start energy 🦋
Abstract
So this doc sets up an IANA registry (that's the Internet Assigned Number Authority, the org that keeps track of all the official numbers and names 🧚) for Content Security Policy directives. It also fills that registry with the directives from the Content Security Policy Level 2 spec. Iconic 👑
Status of This Memo
Real talk, this is not an Internet Standards Track spec. It's published just for info 💜
It IS a product of the IETF, and it reflects consensus from the IETF community. It got public review and was approved by the Internet Engineering Steering Group (IESG). But not every IESG-approved doc is a candidate for an Internet Standard, so see Section 2 of RFC 5741 for the deets 🌈
You can check the current status, errata, and feedback info at:
http://www.rfc-editor.org/info/rfc7762
Copyright Notice
Copyright (c) 2016 IETF Trust and the document authors. All rights reserved 🔥
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were on the publication date. Please actually read those, bestie, because they explain your rights and restrictions 🙈 Any Code Components pulled out of this doc must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, per the Simplified BSD License 💀
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2
3. Use of the Registry . . . . . . . . . . . . . . . . . . . . . 2
4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3
4.1. Content Security Policy Directives Registry . . . . . . . 3
4.2. Registration Policy for Content Security Policy
Directives . . . . . . . . . . . . . . . . . . . . . . . 4
5. Security Considerations . . . . . . . . . . . . . . . . . . . 4
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 5
6.1. Normative References . . . . . . . . . . . . . . . . . . 5
6.2. Informative References . . . . . . . . . . . . . . . . . 5
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 5
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 51. Introduction 🧚
So the Content Security Policy (CSP) spec [CSP] gives web devs a way to control which resources a page can fetch or run, plus a bunch of other security-related policy stuff 🔒
The policy language in that spec is made of an extensible set of "directives." Each one controls a specific resource type or policy decision. This spec sets up a registry so that every CSP extension gets listed and standardized, which is lowkey essential 💖
2. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] ✨
3. Use of the Registry 🎀
Okay so, CSP directives MUST be documented in a readily available public specification before IANA will register them. 💅 That documentation MUST fully explain the syntax, intended usage, and semantics of the directive. The whole point is to make sure independent implementations can interoperate, and to stop accidental namespace collisions between implementations of totally different features 🫶
Documents that define new CSP directives MUST register them with IANA, as described in Section 3. The IANA registration policy for these is "Specification Required" [RFC5226], and it's discussed more in Section 3.2 🌸
4. IANA Considerations 🦋
This spec creates a brand-new top-level IANA registry called "Content Security Policy Directives" 👑
4.1. Content Security Policy Directives Registry 💜
New CSP directives MUST be registered with IANA, and so do updates to existing ones 🔥
When you register a new CSP directive, you MUST provide the following info:
- The directive's name. It's an ASCII string that conforms to the "directive-name" rule in Section 4.1 of [CSP]. The ABNF [RFC5234] looks like this:
directive-name = 1*( ALPHA / DIGIT / "-" )- A reference to the readily available public specification that defines the new directive's syntax, usage, and semantics ✨
Here are the initial values for this registry 🧚
+-----------------+-----------+
| Directive Name | Reference |
+-----------------+-----------+
| base-uri | [CSP] |
| child-src | [CSP] |
| connect-src | [CSP] |
| default-src | [CSP] |
| font-src | [CSP] |
| form-action | [CSP] |
| frame-ancestors | [CSP] |
| frame-src | [CSP] |
| img-src | [CSP] |
| media-src | [CSP] |
| object-src | [CSP] |
| plugin-types | [CSP] |
| report-uri | [CSP] |
| sandbox | [CSP] |
| script-src | [CSP] |
| style-src | [CSP] |
+-----------------+-----------+4.2. Registration Policy for Content Security Policy Directives 🍓
The registration policy for CSP directives is "Specification Required" [RFC5226], which means a designated expert reviews the spec 🧐
When appointing an Expert (or Experts), the IESG SHOULD draw from the W3C's security community, coordinating through the liaison 💅
When the designated expert is deciding whether to add a new directive to the registry, they SHOULD consider the following criteria. It's not an exhaustive list, just representative of the stuff to think about when making the call 🌈
- CSP is a restrictive feature. It lets web devs deny themselves access to resources and APIs that would otherwise be available. So deploying CSP is, by design, a strict reduction in risk. The expert SHOULD carefully consider whether a proposed directive would violate this property 🫶
- Granular directives are valuable, but the expert SHOULD strive for a reasonable balance between giving devs all the knobs and switches possible, and giving them only the ones with known security implications ⭐
5. Security Considerations 💀
Okay, this part is serious 😭 The registry itself doesn't have security implications on its own. The directives it lists, however, absolutely do 🔥
The documents referenced when registering new directives MUST contain detailed security and privacy considerations sections, and SHOULD contain usage information that tells web developers how the directive is expected to be implemented.
6. References 📚
6.1. Normative References 💖
[CSP] West, M., Barth, A., and D. Veditz, "Content Security
Policy Level 2", July 2015, <https://www.w3.org/TR/CSP2>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226,
DOI 10.17487/RFC5226, May 2008,
<http://www.rfc-editor.org/info/rfc5226>.
[RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", STD 68, RFC 5234,
DOI 10.17487/RFC5234, January 2008,
<http://www.rfc-editor.org/info/rfc5234>.6.2. Informative References 🦋
[RFC5341] Jennings, C. and V. Gurbani, "The Internet Assigned Number
Authority (IANA) tel Uniform Resource Identifier (URI)
Parameter Registry", RFC 5341, DOI 10.17487/RFC5341,
September 2008, <http://www.rfc-editor.org/info/rfc5341>.Acknowledgements 🧡
Much of this doc's structure comes from [RFC5341]. Big thanks to Cullen Jennings and Vijay K. Gurbani for giving the author a reasonable template to work within, and to Barry Leiba for the helpful commentary and suggestions 🫶
Author's Address 🎀
Mike West
Google, Inc
Email: mkwst@google.com
URI: https://mikewest.org/📦 where this page comes from
- ietf: rfc7762 2016-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms