Add Content Security Policy check on request

[yutakahirano]

We only need the pre-request check. We don't need the post-request
check given there is no redirects on WebTransport.

This is for #59.

---

Preview | Diff

[yutakahirano]

@vasilvv @mikewest @annevk could you take a look at this change?

[mikewest]

This looks reasonable in the short term, but we should give you a cleaner hook for this: you shouldn't have to create an intermediate request object.

The behavior it specifies, however, would be equivalent to this: the empty destination will result in a connect-src (or default-src) check against the URL provided, using the policies specified on the document from which the connection is being established.

Do we have WPT covering this case?

[yutakahirano]

This looks reasonable in the short term, but we should give you a cleaner hook for this: you shouldn't have to create an intermediate request object.

The behavior it specifies, however, would be equivalent to this: the empty destination will result in a connect-src (or default-src) check against the URL provided, using the policies specified on the document from which the connection is being established.

Do we have WPT covering this case?

There are csp-pass.https.window.js and csp-fail.https.window.js.

[annevk]

I agree with @mikewest. Perhaps @antosart is willing to help with providing a lower-level hook in CSP for WebTransport.

[antosart]

I agree we should provide a better hook in CSP. I will think about it but I am not totally sure how to integrate it cleanly.

Nit: Notice that [=should request be blocked by Content Security Policy?=] does not check report-only policies, which is something we probably want to do in this case.

[yutakahirano]

Nit: Notice that [=should request be blocked by Content Security Policy?=] does not check report-only policies, which is something we probably want to do in this case.

Done.

[yutakahirano]

@martinthomson @vasilvv @jan-ivar can you take a look again?