Script 重要なs
見解／翻訳／版 0.2 - 2005-04-03
Introduction
This is an idea for the （弁護士の）依頼人-味方する mitigation of Cross-場所／位置 Scripting (XSS). It's based on the same 原則 as "Content 制限s" - that of the 場所／位置 owner 明示するing which scripts should be permitted and which not - but takes a わずかに different and complementary approach. This is an updated 見解／翻訳／版 of an 初めの 提案 in a blog 地位，任命する.
Idea
An HTTP header, Script-重要な, defines a 無作為の string or "重要な", and only script 含む／封じ込めるing that string is 許すd to 遂行する／発効させる. As the string will be different for every page 負担, static 注入するd script would not be 正確に labelled and therefore would not be permitted to run. 明白に, if it can't run, it can't （悪事，秘密などを）発見する the 重要な and label itself in any way.
The text of the script just has to 含む／封じ込める the 重要な - in a comment is 罰金. So the labelling might work as follows:
Content-Type: text/html
Script-重要な: D3FC219A
...
<script type="text/javascript">
// D3FC219A
...
</script>
...
<p onclick="/* D3FC219A */ ..." >
...
</p>
正確に／まさに how to label 外部の scripts is still to be decided. It may be that the 重要な has to be in the text of the 外部の script とじ込み／提出する, or it may be that we would 許す this:
Content-Type: text/html
Script-重要な: D3FC219A
...
<script src="somescript.js">
// D3FC219A
</script>
This latter approach has the advantage that the 外部の script とじ込み／提出する can be the same for all 使用者s (static), but has the disadvantage that if an 攻撃者 can manipulate the "src" せいにする, they can point it at their own script.
Discussion
正確に／まさに what the 重要な is made up of, and how often and when it changes is 完全に up to the 実施. This gives 最大限 freedom to balance 安全 and convenience. At one extreme, having a 完全に static 重要な doesn't defend against much (except perhaps 自動化するd attacks against a large number of 場所／位置s running the same ソフトウェア). At the other, having the 重要な change with every page 負担 would 原因（となる） problems if 外部の scripts are （武器などの）隠匿場所d and so have an incorrect 重要な.
Having the 重要な 始める，決める on a per-使用者 basis, 存在 蓄える／店d in a database or even just 存在 their 開会／開廷／会期 ID, has much to recommend it. This 許すs （弁護士の）依頼人-味方する （武器などの）隠匿場所ing to work much as before, and 許すs another server to take over serving pages to that 使用者 in a 負担-balancing 状況／情勢.
公式文書，認める that Script 重要なs don't have to be used in every part of a 場所／位置. For example, 純粋に static pages would not need to use them, because there's no 危険 of XSS.
Comparison
So how does this approach compare with Content 制限s? The two are complementary. Content 制限s 制限するs by ability - so two 封鎖するs of code doing 正確に／まさに the same thing would have the same abilities, and would work or fail in the same way. Script 重要なs 許すs you to distinguish between those two 封鎖するs, so that one 作品 and one fails, but does not 許す you to 制限する the ability of either 封鎖する once it's running.