There are numerous open issues about "inheritance" of policies such as CSP, referrer policy, origin, cookie URL (not defined), base URL, service worker registration, etc. into a dedicated/shared worker or nested document whose URL is about:blank, about:srcdoc, a blob URL, or a data URL.

The idea behind this issue is to research these policies, see if we can make them consistent, and add infrastructure in place that makes existing policies more rigorous and introducing new policies drastically simpler.

The imagined infrastructure takes the form of a "policy container" that supports a "clone" operation. Each policy would also have to define a "clone" operation (unless the policy can be expressed in an Infra map or list perhaps). We'd then define exactly when the policy container is cloned and how to instantiate a new document with a policy container containing a number of policies.

TODO:

• Link existing issues.

(See w3c/FileAPI#142 for dealing with blob URLs. A policy container would it easy to formalize that idea.)

cc @mikewest @hiroshige-g @wanderview