The specific issue we were debating in WebAppSec was whether or not a document's Content Security Policy (and Referrer Policy, et al) should be inherited by a dedicated worker, or whether the dedicated worker ought to be considered a distinct environment entirely with its own policy (which is the model we use for <iframe>, as well as Shared Workers and Service Workers).

Firefox implements the latter model, while Chrome implements the former. This is unfortunate, and we need some help working out the principles at play here.

We're trying to figure out how relevant this issue still is. @mikewest do you think it is? I suspect that if the TAG needs to do something here, it would be helpful to have some sort of explainer or other written document.

This relates to https://github.com/w3ctag/design-principles/issues/111 and https://github.com/whatwg/html/issues/3270. This was discussed at TPAC of which I wrote a summary at https://github.com/whatwg/html/issues/3270#issuecomment-535062970. I think this can be closed at this point.

Will close here and follow up in https://github.com/w3ctag/design-principles/issues/111

We discussed this briefly in today's teleconference and decided that there's probably some documenting of the state of things that should be done, but the open w3ctag/design-principles#111 is a better place to do that than here.