As stated in its charter, the mission of the Web Application Security Working Group is to develop security and policy mechanisms to improve the security of Web Applications, and enable secure cross-site communication.
| Past and Upcoming Events | |
|---|---|
| Weekly teleconference: every other Tuesday, 22:00-23:00 UTC (14:00-15:00
PST)
Next call: 2011-01-17 |
|
| 2011-12-19 | Call for Consensus to advance CORS to Last Call issued. |
| 2011-12-1 | Call for Exclusions for Content Security Policy issued. Deadline 27 April 2012 |
| 2011-11-29 | First Public Working Draft of Content Security Policy published |
| Name of Spec
(Editor's Draft) |
Last Publication | Type | Remarks | Testing | Plans |
| Content Security Policy | 29-Nov-2011 | WD | Editors: Brandon Sterne and Adam Barth | ||
| Cross-Origin Resource Sharing | 27-July-2010 | WD | Editor: Anne van Kesteren | Test Coordinator: Gopal Raghavan | CfC to go to LCWD issued 19-Dec-2011 |
| Uniform Messaging Policy, Level One | 15-June-2010 | Input document | Editors: Tyler Close and Mark Miller | Not on recommendation track at this time. | |
| Security on the Web | 4-Feb-2011 | Input document | summary by J. Kemp for the TAG - this document is not a TAG Finding |
This general practices of this WG are are documented on our Work Mode Page.
DRAFT: Call of 20 Dec 2011: http://www.w3.org/2011/webappsec/draft-minutes/20-webappsec-minutes.html
Call of 06 Dec 2011: http://www.w3.org/2011/12/06-webappsec-minutes.html
Call of 22 Nov 2011: http://www.w3.org/2011/11/01-webappsec-minutes.html
TPAC 2011, Day 1: http://www.w3.org/2011/10/31-webappsec-minutes.html
TPAC 2011, Day 2: http://www.w3.org/2011/11/01-webappsec-minutes.html
See the Working Group's tracker instance (Tracker's documentation).
The WG's Bugzilla instace is at: http://www.w3.org/Bugs/Public/describecomponents.cgi?product=WebAppsSec
Weekly teleconference: every other Tuesday, 22:00-23:00 UTC(14:00-15:00 PST)
The number for all calls on W3C Zakim bridge is +1.617.761.6200 then enter
conference passcode 92794 ('WASWG'). If you can't get into the bridge, dial *0
to speak to the operator — they can manually connect you. Zakim allows
participants to mute themselves by pressing 61# ("M" for mute, then "1" for on)
and unmute themselves with 60#.
It is possible to participate in meetings by telephone alone but participants' interaction is substantially improved by also joining the #webappsec irc channel or using the IRC Web interface (see also the comprehensive help for IRC). The group makes use of the following agents: zakim, rrsagent, and tracker.
Technical discussion takes place on the Working Group discussion list, public-webappsec@w3.org (archive). This is a public mailing list; to subscribe to the public-webappsec mailing list, please check the subscription procedure.
Proposals, experiments, etc. related to this WG's deliverables can be discussed on the W3C Web Security Wiki at http://www.w3.org/Security/wiki/Main_Page
The WG will begin work on Content Security Policy 1.1 concurrently with moving 1.0 on the Recommendation track. Suggestions for features in 1.1 should go to the wiki at: http://www.w3.org/Security/wiki/Content_Security_Policy. Experimental implementations to accompany such suggestions are highly encouraged. A brainstorm list of proposed directives is also available at https://wiki.mozilla.org/Security/CSP/Strawman
W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent.
The WebAppSec Working Group operates under its initial charter.