Issues

• Planning TPAC 2026

  agenda
  w3c/webappsec#709 · Filter by author dveditz opened on Sep 11, 2026
  30

• Fetch Metadata should clarify what to set for externally supplied URLs

  w3c/webappsec#706 · Filter by author simon-friedberger opened on Jul 14, 2026

• Planning 2026-06-17.

  w3c/webappsec#702 · Filter by author mikewest opened on Apr 13, 2026
  12

• Request for feedback: /.well-known/recover-account proposal

  w3c/webappsec#701 · Filter by author felipecpaiva opened on Mar 28, 2026
  3

• CR preparation for CSP-3

  w3c/webappsec#693 · Filter by author simoneonofri opened on Oct 7, 2025
  4

• CR preparation for Fetch Metadata

  w3c/webappsec#692 · Filter by author simoneonofri opened on Oct 7, 2025
  3

• CR preparation for SRI-2

  w3c/webappsec#691 · Filter by author simoneonofri opened on Oct 7, 2025

• CR preparation for WebCrypto-2

  w3c/webappsec#690 · Filter by author simoneonofri opened on Oct 7, 2025

• Working mode for specs we're shifting to the CR snapshot model.

  w3c/webappsec#688 · Filter by author mikewest opened on Aug 26, 2025
  5

• CfC to move CSP-3 to CR < 2025-07-16

  CfC
  w3c/webappsec#682 · Filter by author simoneonofri opened on Jul 9, 2025
  2

  

• CfC to move Fetch Metadata to CR < 2025-07-16

  CfC
  w3c/webappsec#681 · Filter by author simoneonofri opened on Jul 9, 2025
  3

  

• CfC to move SRI-2 to CR < 2025-07-16

  CfC
  w3c/webappsec#680 · Filter by author simoneonofri opened on Jul 9, 2025
  3

  

• CfC to move WebCrypto-2 to CR < 2025-07-16

  CfC
  w3c/webappsec#679 · Filter by author simoneonofri opened on Jul 9, 2025
  2

  

• TOTP-Based Session Cookies to defend against session hijacking

  w3c/webappsec#673 · Filter by author abose opened on Apr 5, 2025
  1

• Provide clear guidelines for what Timing-Allow-Origin should expose

  w3c/webappsec#664 · Filter by author noamr opened on Jan 2, 2025
  8

• Surfacing capability URLs

  w3c/webappsec#657 · Filter by author yoavweiss opened on Sep 11, 2024
  1

• CSP and data exfiltration

  w3c/webappsec#656 · Filter by author yoavweiss opened on Sep 11, 2024
  27

• Revive require-sri-for?

  w3c/webappsec#655 · Filter by author yoavweiss opened on Sep 11, 2024

• Support for clearing Client Hints in Clear-Site-Data header

  w3c/webappsec#628 · Filter by author arichiv opened on Jul 7, 2023
  

• Different behavior with CSP and HTML imports

  w3c/webappsec#616 · Filter by author lmuntaner opened on Oct 22, 2022

• Transfer issues to appropriate repos?

  w3c/webappsec#601 · Filter by author marcoscaceres opened on Aug 12, 2021

• Move to auto-publish

  w3c/webappsec#600 · Filter by author marcoscaceres opened on Aug 12, 2021
  

• [meta] Adopting the Sanitizer API

  charter
  w3c/webappsec#596 · Filter by author mozfreddyb opened on Jul 12, 2021
  24

• Concerns with moving to living standard model

  w3c/webappsec#580 · Filter by author pes10k opened on Apr 26, 2021
  4

• Web Applications should not have internet access by default

  w3c/webappsec#578 · Filter by author ghost opened on Mar 30, 2021
  9