HTTP restrictions

Explain some of the restrictions we impose to balance minimal implementation and being able to implement all targeted user applications.

Mandatory

Quality of life improvement

To research

XMLHttpRequest CORS

Verdict: partial
Implementation complexity: intermediate
Restriction: only for unauthenticated public access (Access-Control-Allow-Origin: *)
Use cases: third party integration
Workaround: JSONP, custom CSS content embedding

Content Security Policy

Verdict: probably unsupported
Implementation complexity: high
Incidence rate: low where it would matter
Use case: iframe sandbox of an online code snippet pad

X-Frame-Ancestors

Verdict: support
Implementation complexity: low
Incidence rate: high
Use case: if iframe is also supported
Workaround: none

Partial

Referrer policy

Verdict: partial
Implementation complexity: low
Restriction: implement as little as required to authenticate against storage API of our targeted existing services
Workaround: none

Unsupported