Cancel navigation on invalid required CSP attribute

[antosart]

If the document A includes <iframe src="B" csp="some-policy">, and B includes <iframe src="C" csp="some-other-policy"> and some-policy does not subsume some-other-policy, right now CSPEE ignores some-other-policy and required from C to comply with some-policy. This seems dangerous since CSPEE ignores then the requirements from B. This changes tries to fix that by canceling the navigation in such a case.

[antosart]

Actually, I believe this is still not optimal since it makes it very difficult for the owner of B to require some CSP from C in case B is to be embedded in several, different documents that could in principle require different CSPs. In that case, the only possibility for B would be to generate the csp attr for C after parsing the Sec-Required-CSP header, being sure to add that to the CSPs B wants to require from C. In short terms, there is no easy way for B to say: I just want to require from C this additional CSP, and I am fine with all other requirements coming from A, whatever they are.