Development record
The session chapter says the page's content-security policy loads scripts and styles from the page's own origin only (.abcd/development/brief/04-surfaces/37-session.md:145-147). internal/surface/session/web/index.html:6 declares style-src 'self' 'unsafe-inline', so inline styles are admitted as well; only script-src is 'self' alone.
issueopenminoriss-2611040554460352
The session chapter says the page's content-security policy loads scripts and styles from the page's own origin only (.abcd/development/brief/04-surfaces/37-session.md:145-147). internal/surface/session/web/index.html:6 declares style-src 'self' 'unsafe-inline', so inline styles are admitted as well; only script-src is 'self' alone.
Frontmatter
| id | iss-2611040554460352 |
|---|---|
| type | issue |
| lifecycle | open |
| severity | minor |
.abcd/work/issues/open/iss-2611040554460352-the-session-chapter-says-the-page-s.md
open on GitHub ↗ · commit history ↗