Chrome Version: 70.0.3524.0 (Official Build) canary (64-bit)
OS: MacOS X
Consider the following page:
<html>
<body>
...
<script>
console.log('did I run?');
</script>
</body>
</html>
It's widely considered a best practice to move scripts to the bottom of the page. A really common example is loading Google analytics (ran into this myself on a demo page testing feature policy!):
...
<script async src="https://www.googletagmanager.com/..."></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'UA-120357238-1');
</script>
</body>
</html>
However, this code is blocked under `Feature-Policy: sync-script 'none'`.
This is tricky, because technically the policy is doing what it's supposed to...but
I'd hate to penalize developers for doing the right thing.
Can/should we ignore inline scripts? Or should we ignore final scripts like this?
==
Steps to repro:
1. Visit https://chain-dragon.glitch.me/
What is the expected result?
This inline script at the bottom of the page is not blocked by feature policy.
What is happens instead?
Sending `Feature-Policy: sync-script 'none'` blocks the script.
Comment 1 by ekaramad@chromium.org
, Sep 10Labels: -Type-Bug OS-Android OS-Chrome OS-Linux OS-Mac OS-Windows Type-Feature
Owner: japhet@chromium.org
Status: Assigned (was: Untriaged)