npm - opera-devtools-mcp - Versions diffs - 0.2.4 → 0.3.0 - Mend

opera-devtools-mcp 0.2.4 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (330) hide show

package/build/src/third_party/issue-descriptions/CoepCorpNotSameOrigin.md CHANGED Viewed

@@ -1,7 +1,7 @@
-# Specify a more permissive Cross-Origin Resource Policy to prevent a resource from being blocked
+# Specify a more permissive Cross-Origin Resource Policy to stop a resource from being blocked
 Your site tries to access an external resource that only allows same-origin usage.
-This behavior prevents a document from loading any non-same-origin resources which don’t explicitly grant permission to be loaded.
+This behavior stops a document from loading any non-same-origin resources which don’t explicitly grant permission to be loaded.
 To solve this, add the following to the resource’s HTML response header:
 * `Cross-Origin-Resource-Policy: same-site` if the resource and your site are served from the same site.

package/build/src/third_party/issue-descriptions/CoepCorpNotSameOriginAfterDefaultedToSameOriginByCoep.md CHANGED Viewed

@@ -1,11 +1,11 @@
-# Specify a Cross-Origin Resource Policy to prevent a resource from being blocked
+# Specify a Cross-Origin Resource Policy to stop a resource from being blocked
 Because your site has the Cross-Origin Embedder Policy (COEP) enabled, each
 resource must specify a suitable Cross-Origin Resource Policy (CORP). This
-behavior prevents a document from loading cross-origin resources which don’t
+behavior stops a document from loading cross-origin resources which don’t
 explicitly grant permission to be loaded.
-To solve this, add the following to the resource’ response header:
+To solve this, add the following to the resource’s response header:
 * `Cross-Origin-Resource-Policy: same-site` if the resource and your site are
   served from the same site.
 * `Cross-Origin-Resource-Policy: cross-origin` if the resource is served from

package/build/src/third_party/issue-descriptions/CoepCorpNotSameSite.md CHANGED Viewed

@@ -1,7 +1,7 @@
-# Specify a more permissive Cross-Origin Resource Policy to prevent a resource from being blocked
+# Specify a more permissive Cross-Origin Resource Policy to stop a resource from being blocked
 Your site tries to access an external resource that only allows same-site usage.
-This behavior prevents a document from loading any non-same-site resources which don’t explicitly grant permission to be loaded.
+This behavior stops a document from loading any non-same-site resources which don’t explicitly grant permission to be loaded.
 To solve this, add the following to the resource’s HTML response header: `Cross-Origin-Resource-Policy: cross-origin`
 ⚠️If you set this header, any website can embed this resource.

package/build/src/third_party/issue-descriptions/CoepFrameResourceNeedsCoepHeader.md CHANGED Viewed

@@ -1,4 +1,4 @@
-# Specify a Cross-Origin Embedder Policy to prevent this frame from being blocked
+# Specify a Cross-Origin Embedder Policy to stop this frame from being blocked
 Because your site has the Cross-Origin Embedder Policy (COEP) enabled, each
 embedded iframe must also specify this policy. This behavior protects private

package/build/src/third_party/issue-descriptions/CompatibilityModeQuirks.md CHANGED Viewed

@@ -2,4 +2,4 @@
 One or more documents in this page is in Quirks Mode, which will render the affected document(s) with quirks incompatible with the current HTML and CSS specifications.
-Quirks Mode exists mostly due to historical reasons. If this is not intentional, you can [add or modify the DOCTYPE to be `<!DOCTYPE html>`](issueQuirksModeDoctype) to render the page in No Quirks Mode.
+Quirks Mode exists mostly due to historical reasons. If this isn’t intentional, you can [add or modify the DOCTYPE to be `<!DOCTYPE html>`](issueQuirksModeDoctype) to render the page in No Quirks Mode.

package/build/src/third_party/issue-descriptions/CookieAttributeValueExceedsMaxSize.md CHANGED Viewed

@@ -1,5 +1,5 @@
 # Ensure cookie attribute values don’t exceed 1024 characters
-Cookie attribute values exceeding 1024 characters in size will result in the attribute being ignored. This could lead to unexpected behavior since the cookie will be processed as if the offending attribute / attribute value pair were not present.
+Cookie attribute values exceeding 1024 characters in size will result in the attribute being ignored. This could lead to unexpected behavior since the cookie will be processed as if the offending attribute / attribute value pair weren’t present.
-Resolve this issue by ensuring that cookie attribute values don’t exceed 1024 characters.
+Resolve this issue by ensuring that cookie attribute values don’t exceed 1024 characters.

package/build/src/third_party/issue-descriptions/LowTextContrast.md CHANGED Viewed

@@ -2,4 +2,4 @@
 Low-contrast text is difficult or impossible for users to read. A [minimum contrast ratio (AA) of 4.5](issuesContrastWCAG21AA) is recommended for all text. Since font size and weight affect color perception, an exception is made for very large or bold text — in this case, a contrast ratio of 3.0 is allowed. The [enhanced conformance level (AAA)](issuesContrastWCAG21AAA) requires the contrast ratio to be above 7.0 for regular text and 4.5 for large text.
-Update colors or change the font size or weight to achieve sufficient contrast. You can use the [“Suggest color” feature](issuesContrastSuggestColor) in the DevTools color picker to automatically select a better text color.
+Update colors or change the font size or weight to achieve sufficient contrast. You can use the [“Suggest color” feature](issuesContrastSuggestColor) in the DevTools color picker to automatically select a better text color.

package/build/src/third_party/issue-descriptions/SameSiteNoneInsecureErrorRead.md CHANGED Viewed

@@ -5,4 +5,4 @@ This behavior protects user data from being sent over an insecure connection.
 Resolve this issue by updating the attributes of the cookie:
 * Specify `SameSite=None` and `Secure` if the cookie should be sent in cross-site requests. This enables third-party use.
-* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be sent in cross-site requests.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie shouldn’t be sent in cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteNoneInsecureErrorSet.md CHANGED Viewed

@@ -5,4 +5,4 @@ This behavior protects user data from being sent over an insecure connection.
 Resolve this issue by updating the attributes of the cookie:
 * Specify `SameSite=None` and `Secure` if the cookie is intended to be set in cross-site contexts. Note that only cookies sent over HTTPS may use the `Secure` attribute.
-* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be set by cross-site requests.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie shouldn’t be set by cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteNoneInsecureWarnRead.md CHANGED Viewed

@@ -5,4 +5,4 @@ This behavior protects user data from being sent over an insecure connection.
 Resolve this issue by updating the attributes of the cookie:
 * Specify `SameSite=None` and `Secure` if the cookie should be sent in cross-site requests. This enables third-party use.
-* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be sent in cross-site requests.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie shouldn’t be sent in cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteNoneInsecureWarnSet.md CHANGED Viewed

@@ -5,4 +5,4 @@ This behavior protects user data from being sent over an insecure connection.
 Resolve this issue by updating the attributes of the cookie:
 * Specify `SameSite=None` and `Secure` if the cookie is intended to be set in cross-site contexts. Note that only cookies sent over HTTPS may use the `Secure` attribute.
-* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be set by cross-site requests.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie shouldn’t be set by cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteUnspecifiedLaxAllowUnsafeRead.md CHANGED Viewed

@@ -1,9 +1,9 @@
 # Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute
-Because a cookie’s `SameSite` attribute was not set or is invalid, it defaults to `SameSite=Lax`,
-which will prevent the cookie from being sent in a cross-site request in a future version of the browser.
+Because a cookie’s `SameSite` attribute wasn’t set or is invalid, it defaults to `SameSite=Lax`,
+which will stop the cookie from being sent in a cross-site request in a future version of the browser.
 This behavior protects user data from accidentally leaking to third parties and cross-site request forgery.
 Resolve this issue by updating the attributes of the cookie:
 * Specify `SameSite=None` and `Secure` if the cookie should be sent in cross-site requests. This enables third-party use.
-* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be sent in cross-site requests.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie shouldn’t be sent in cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteUnspecifiedLaxAllowUnsafeSet.md CHANGED Viewed

@@ -1,9 +1,9 @@
 # Indicate whether a cookie is intended to be set in cross-site context by specifying its SameSite attribute
-Because a cookie’s `SameSite` attribute was not set or is invalid, it defaults to `SameSite=Lax`,
-which will prevents the cookie from being set in a cross-site context in a future version of the browser.
+Because a cookie’s `SameSite` attribute wasn’t set or is invalid, it defaults to `SameSite=Lax`,
+which will stops the cookie from being set in a cross-site context in a future version of the browser.
 This behavior protects user data from accidentally leaking to third parties and cross-site request forgery.
 Resolve this issue by updating the attributes of the cookie:
 * Specify `SameSite=None` and `Secure` if the cookie is intended to be set in cross-site contexts. Note that only cookies sent over HTTPS may use the `Secure` attribute.
-* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be set by cross-site requests.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie shouldn’t be set by cross-site requests.

package/build/src/third_party/issue-descriptions/bounceTrackingMitigations.md CHANGED Viewed

@@ -1,3 +1,3 @@
 # Chrome may soon delete state for intermediate websites in a recent navigation chain
-In a recent navigation chain, one or more websites without prior user interaction were visited. If these websites don't get such an interaction soon, Chrome will delete their state.
+In a recent navigation chain, one or more websites without prior user interaction were visited. If these websites don’t get such an interaction soon, Chrome will delete their state.

package/build/src/third_party/issue-descriptions/connectionAllowlistEmbeddingRequirementNotSatisfied.md ADDED Viewed

@@ -0,0 +1,26 @@
+# A framed document did not accept its embedder's `Connection-Allowlist`.
+An embedder can require a framed document to enforce a `Connection-Allowlist` by
+setting the `connectionallowlist` attribute on the frame. The framed document
+must agree, in one of two ways:
+*   by responding with an `Allow-Connection-Allowlist-From` header naming the
+    embedder's origin (or `*` to accept any embedder), which installs the
+    embedder's allowlist on the framed document, or
+*   by responding with a `Connection-Allowlist` header of its own that is at
+    least as strict as the one required, which is then enforced instead.
+This response did neither, so it was not displayed.
+For example, a document framed by an embedder requiring
+`("https://cdn.example/")` may accept that requirement outright:
+```
+Allow-Connection-Allowlist-From: *
+```
+or satisfy it with an allowlist that is no more permissive:
+```
+Connection-Allowlist: ("https://cdn.example/")
+```

package/build/src/third_party/issue-descriptions/connectionAllowlistIFrameAttributeLoosensEmbeddingRequirement.md ADDED Viewed

@@ -0,0 +1,19 @@
+# A frame's `connectionallowlist` attribute was discarded.
+An embedder can require a framed document to enforce a `Connection-Allowlist` by
+setting the `connectionallowlist` attribute on the frame. When a requirement is
+already in effect for the embedder itself, a nested frame's attribute may only
+make that requirement stricter, never looser.
+This frame's attribute allowed connections that the requirement it inherits from
+an ancestor does not, so the attribute was discarded and the inherited
+requirement applies unchanged.
+For example, the nested frame below cannot re-admit `https://example.com/`, so
+it inherits `("https://cdn.example/")` rather than the value it asked for:
+```
+<!-- Framed by an ancestor that requires ("https://cdn.example/"): -->
+<iframe connectionallowlist='("https://cdn.example/" "https://example.com/")'
+        src="..."></iframe>
+```

package/build/src/third_party/issue-descriptions/connectionAllowlistInvalidAllowConnectionAllowlistFrom.md ADDED Viewed

@@ -0,0 +1,21 @@
+# The `Allow-Connection-Allowlist-From` header is invalid.
+A document that is framed by an embedder requiring a `Connection-Allowlist` can
+accept that requirement by responding with an `Allow-Connection-Allowlist-From`
+header. The header's value must be either `*`, or a single serialized origin
+naming the embedder whose requirement it is willing to accept.
+This response's header was neither, so it could not be used to accept the
+embedder's requirement.
+For example, both of the following are valid:
+```
+Allow-Connection-Allowlist-From: *
+Allow-Connection-Allowlist-From: https://example.com
+```
+Note that an origin's serialization has no trailing slash, and carries no path,
+query, or userinfo. Values like `https://example.com/` and
+`https://user@example.com/path` are therefore rejected rather than being
+silently reinterpreted as `https://example.com`.

package/build/src/third_party/issue-descriptions/connectionAllowlistInvalidAllowlistItemType.md CHANGED Viewed

@@ -1,6 +1,6 @@
-# An item in the `Connection-Allowlist` header is invalid.
+# An item in the `Connection-Allowlist` header is invalid
-Each item in the `Connection-Allowlist`'s header's [Inner List](sfInnerList)
+Each item in the `Connection-Allowlist`’s header’s [Inner List](sfInnerList)
 must be a [String](sfString) representing a [URL Pattern](urlPatternSpec), or
 the [Token](sfToken) `response-origin`.

package/build/src/third_party/issue-descriptions/connectionAllowlistInvalidHeader.md CHANGED Viewed

@@ -1,6 +1,6 @@
-# The `Connection-Allowlist` header is not formatted as a Structured Field List.
+# The `Connection-Allowlist` header isn’t formatted as a Structured Field List
-Responses' `Connection-Allowlist` header should be formatted as a [List](sfList)
+Responses’ `Connection-Allowlist` header should be formatted as a [List](sfList)
 containing a single [Inner List](sfInnerList) that declares the allowed set of
 [URL Patterns](urlPatternSpec) for a given context.

package/build/src/third_party/issue-descriptions/connectionAllowlistInvalidUrlPattern.md CHANGED Viewed

@@ -1,8 +1,8 @@
-# An item in the `Connection-Allowlist` header is not a valid URL pattern.
+# An item in the `Connection-Allowlist` header isn’t a valid URL pattern
 Each item in the `Connection-Allowlist` header must be a valid
-[URL Pattern](urlPatternSpec) that can be used to match against the request's
+[URL Pattern](urlPatternSpec) that can be used to match against the request’s
 origin.
-Note that our current implementation does not allow regular expressions to be
+Note that our current implementation doesn’t allow regular expressions to be
 used as part of the pattern.

package/build/src/third_party/issue-descriptions/connectionAllowlistItemNotInnerList.md CHANGED Viewed

@@ -1,6 +1,6 @@
-# An item in the `Connection-Allowlist` header is not an Inner List.
+# An item in the `Connection-Allowlist` header isn’t an Inner List
-Responses' `Connection-Allowlist` header should be formatted as a [List](sfList)
+Responses’ `Connection-Allowlist` header should be formatted as a [List](sfList)
 containing a single [Inner List](sfInnerList) that declares the allowed set of
 [URL Patterns](urlPatternSpec) for a given context.

package/build/src/third_party/issue-descriptions/connectionAllowlistMoreThanOneList.md CHANGED Viewed

@@ -1,6 +1,6 @@
-# `Connection-Allowlist` has multiple items.
+# `Connection-Allowlist` has multiple items
-Responses' `Connection-Allowlist` header should be formatted as a [List](sfList)
+Responses’ `Connection-Allowlist` header should be formatted as a [List](sfList)
 containing a single [Inner List](sfInnerList) that declares the allowed set of
 [URL Patterns](urlPatternSpec) for a given context. This response was a
 [List](sfList) containing more than one item: all but the first have been

package/build/src/third_party/issue-descriptions/connectionAllowlistReportingEndpointNotToken.md CHANGED Viewed

@@ -1,4 +1,4 @@
-# The `report-to` parameter in the `Connection-Allowlist` header is not a token.
+# The `report-to` parameter in the `Connection-Allowlist` header isn’t a token
 If provided, the `report-to` parameter must be a [Token](sfToken)
 naming a reporting endpoint.

package/build/src/third_party/issue-descriptions/cookieCrossSiteRedirectDowngrade.md CHANGED Viewed

@@ -1,6 +1,6 @@
 # Cookie is blocked due to a cross-site redirect chain
-The cookie was blocked because the URL redirect chain was not fully same-site,
+The cookie was blocked because the URL redirect chain wasn’t fully same-site,
 meaning the final request was treated as a cross-site request.
 Like other cross-site requests, this blocks cookies with `SameSite=Lax` or
 `SameSite=Strict`.
@@ -8,5 +8,5 @@ Like other cross-site requests, this blocks cookies with `SameSite=Lax` or
 For example: If site A redirects to site B which then redirects back to site A,
 the final request to site A will be a cross-site request.
-If this behavior is causing breakage, please file a bug report with the link
-below.
+If this behavior is causing breakage, file a bug report with the link
+below.

package/build/src/third_party/issue-descriptions/cookieExcludeBlockedWithinRelatedWebsiteSet.md CHANGED Viewed

@@ -1,4 +1,4 @@
 # Third-party cookie blocked within the same Related Website Set
-A cookie embedded by a site in the top-level page's Related Website Set was blocked
+A cookie embedded by a site in the top-level page’s Related Website Set was blocked
 by third-party cookie blocking.

package/build/src/third_party/issue-descriptions/cookieExcludePortMismatch.md CHANGED Viewed

@@ -1,4 +1,4 @@
-# Cookie was not sent due to port mismatch
+# Cookie wasn’t sent due to port mismatch
 Cookies can only be accessed by origins that share the same port as the origin
 that initially set the cookie.

package/build/src/third_party/issue-descriptions/cookieExcludeSchemeMismatch.md CHANGED Viewed

@@ -1,4 +1,4 @@
-# Cookie was not sent due to scheme mismatch
+# Cookie wasn’t sent due to scheme mismatch
 The cookie can only be accessed by origins that share the same scheme as
 the origin that initially set it.

package/build/src/third_party/issue-descriptions/cookieExcludeThirdPartyPhaseoutSet.md CHANGED Viewed

@@ -3,4 +3,4 @@
 Cookies with the `SameSite=None; Secure` and not `Partitioned` attributes that operate in cross-site contexts are third-party cookies.
 Third-party cookies are restricted for this browser either because of Chrome flags or browser configuration.
-Learn more from the linked article about preparing your site to avoid potential breakage due to this.
+Learn more from the linked article about preparing your site to avoid potential breakage due to this.

package/build/src/third_party/issue-descriptions/cookieWarnThirdPartyPhaseoutRead.md CHANGED Viewed

@@ -3,4 +3,4 @@
 Cookies with the `SameSite=None; Secure` and not `Partitioned` attributes that operate in cross-site contexts are third-party cookies.
 Chrome is moving towards a new experience that allows users to choose to browse without third-party cookies.
-Learn more from the linked article about preparing your site to avoid potential breakage.
+Learn more from the linked article about preparing your site to avoid potential breakage.

package/build/src/third_party/issue-descriptions/corsAllowCredentialsRequired.md CHANGED Viewed

@@ -1,6 +1,6 @@
 # Ensure CORS requests include credentials only when allowed
-A cross-origin resource sharing (CORS) request was blocked because it was configured to include credentials but the `Access-Control-Allow-Credentials` response header of the request or the associated preflight request was not set to `true`.
+A Cross-Origin Resource Sharing (CORS) request was blocked because it was configured to include credentials but the `Access-Control-Allow-Credentials` response header of the request or the associated preflight request wasn’t set to `true`.
 To fix this issue, ensure that resources that expect credentialed CORS requests set the `Access-Control-Allow-Credentials` header to `true`.
 Note that this requires the `Access-Control-Allow-Origin` header to not be a wildcard `*`.

package/build/src/third_party/issue-descriptions/corsDisabledScheme.md CHANGED Viewed

@@ -1,7 +1,7 @@
 # Ensure CORS requests are made on supported schemes
-A cross-origin resource sharing (CORS) request was blocked because the scheme of the request's URL doesn't support CORS.
+A Cross-Origin Resource Sharing (CORS) request was blocked because the scheme of the request’s URL doesn’t support CORS.
 To fix this issue, ensure all CORS request URLs specify a supported scheme, e.g. most commonly https://.
-Note that if an opaque response is sufficient, then for some schemes the request's mode can be set to `no-cors` to fetch the resource with CORS disabled; that way the scheme doesn't need to support CORS, but the response content is inaccessible (opaque).
+Note that if an opaque response is sufficient, then for some schemes the request’s mode can be set to `no-cors` to fetch the resource with CORS disabled; that way the scheme doesn’t need to support CORS, but the response content is inaccessible (opaque).

package/build/src/third_party/issue-descriptions/corsDisallowedByMode.md CHANGED Viewed

@@ -1,7 +1,7 @@
 # Ensure only same-origin resources are fetched with same-origin request mode
-A cross-origin resource sharing (CORS) request to a cross-origin resource was blocked because the request mode was set to `same-origin`.
+A Cross-Origin Resource Sharing (CORS) request to a cross-origin resource was blocked because the request mode was set to `same-origin`.
 To fix this issue, ensure that only same-origin resources are fetched with the `same-origin` request mode. If you need to fetch a cross-origin resource, use a request mode such as `cors`.
-Note that if an opaque response is sufficient, the request's mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers are not required but the response content is inaccessible (opaque).
+Note that if an opaque response is sufficient, the request’s mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers aren’t required but the response content is inaccessible (opaque).

package/build/src/third_party/issue-descriptions/corsHeaderDisallowedByPreflightResponse.md CHANGED Viewed

@@ -1,5 +1,5 @@
 # Ensure CORS request includes only allowed headers
-A cross-origin resource sharing (CORS) request was blocked because it contained request headers that were neither CORS-safelisted (`Accept`, `Accept-Language`, `Content-Language`, `Content-Type`) nor allowed by the `Access-Control-Allow-Headers` response header of the associated preflight request.
+A Cross-Origin Resource Sharing (CORS) request was blocked because it contained request headers that were neither CORS-safelisted (`Accept`, `Accept-Language`, `Content-Language`, `Content-Type`) nor allowed by the `Access-Control-Allow-Headers` response header of the associated preflight request.
 To fix this issue, include the additional request headers you want to use in the `Access-Control-Allow-Headers` response header of the associated preflight request.

package/build/src/third_party/issue-descriptions/corsInvalidHeaderValues.md CHANGED Viewed

@@ -1,7 +1,7 @@
 # Ensure CORS response header values are valid
-A cross-origin resource sharing (CORS) request was blocked because of invalid or missing response headers of the request or the associated [preflight request](issueCorsPreflightRequest).
+A Cross-Origin Resource Sharing (CORS) request was blocked because of invalid or missing response headers of the request or the associated [preflight request](issueCorsPreflightRequest).
-To fix this issue, ensure the response to the CORS request and/or the associated [preflight request](issueCorsPreflightRequest) are not missing headers and use valid header values.
+To fix this issue, ensure the response to the CORS request and/or the associated [preflight request](issueCorsPreflightRequest) aren’t missing headers and use valid header values.
-Note that if an opaque response is sufficient, the request's mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers are not required but the response content is inaccessible (opaque).
+Note that if an opaque response is sufficient, the request’s mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers aren’t required but the response content is inaccessible (opaque).

package/build/src/third_party/issue-descriptions/corsLocalNetworkAccessPermissionDenied.md CHANGED Viewed

@@ -1,7 +1,7 @@
 # Ensure that local network requests are compatible with restrictions
 A site requested a resource from a network that it could only access because of
-its users' privileged network position.
+its users’ privileged network position.
 These requests expose devices and servers to the internet, increasing the risk
 of a cross-site request forgery (CSRF) attack and/or information leakage.

package/build/src/third_party/issue-descriptions/corsMethodDisallowedByPreflightResponse.md CHANGED Viewed

@@ -1,5 +1,5 @@
 # Ensure CORS request uses allowed method
-A cross-origin resource sharing (CORS) request was blocked because it neither uses one of the CORS-safelisted methods (`GET`, `HEAD`, `POST`) nor was the request method explicitly allowed by the `Access-Control-Allow-Methods` response header of the associated [preflight request](issueCorsPreflightRequest).
+A Cross-Origin Resource Sharing (CORS) request was blocked because it neither uses one of the CORS-safelisted methods (`GET`, `HEAD`, `POST`) nor was the request method explicitly allowed by the `Access-Control-Allow-Methods` response header of the associated [preflight request](issueCorsPreflightRequest).
 To fix this issue, include the request method in the `Access-Control-Allow-Methods` header of the associated preflight request.

package/build/src/third_party/issue-descriptions/corsNoCorsRedirectModeNotFollow.md CHANGED Viewed

@@ -1,5 +1,5 @@
 # Ensure no-cors requests configure redirect mode follow
-A cross-origin resource sharing (CORS) request was blocked because it was configured to use request mode `no-cors` but did not use the redirect mode `follow`.
+A Cross-Origin Resource Sharing (CORS) request was blocked because it was configured to use request mode `no-cors` but did not use the redirect mode `follow`.
 To fix this issue, ensure that whenever the request mode `no-cors` is set then the redirect mode is set to `follow`.

package/build/src/third_party/issue-descriptions/corsOriginMismatch.md CHANGED Viewed

@@ -1,6 +1,6 @@
-# Ensure CORS requesting origin matches resource's allowed origin
+# Ensure CORS requesting origin matches resource’s allowed origin
-A cross-origin resource sharing (CORS) request was blocked because the `Access-Control-Allow-Origin` response header of the request or the associated [preflight request](issueCorsPreflightRequest) specified an origin different from the origin of the context that initiated the request.
+A Cross-Origin Resource Sharing (CORS) request was blocked because the `Access-Control-Allow-Origin` response header of the request or the associated [preflight request](issueCorsPreflightRequest) specified an origin different from the origin of the context that initiated the request.
-To fix this issue, ensure that the `Access-Control-Allow-Origin` header for the resource matches the request context's origin.
+To fix this issue, ensure that the `Access-Control-Allow-Origin` header for the resource matches the request context’s origin.
 If the resource never needs to be accessed with credentials, the `Access-Control-Allow-Origin` header may be set to a wildcard `*` to allow access from everywhere.

package/build/src/third_party/issue-descriptions/corsPreflightResponseInvalid.md CHANGED Viewed

@@ -1,5 +1,5 @@
 # Ensure preflight responses are valid
-A cross-origin resource sharing (CORS) request was blocked because the response to the associated [preflight request](issueCorsPreflightRequest) failed, had an unsuccessful HTTP status code, and/or was a redirect.
+A Cross-Origin Resource Sharing (CORS) request was blocked because the response to the associated [preflight request](issueCorsPreflightRequest) failed, had an unsuccessful HTTP status code, and/or was a redirect.
-To fix this issue, ensure all CORS preflight `OPTIONS` requests are answered with a successful HTTP status code (2xx) and do not redirect.
+To fix this issue, ensure all CORS preflight `OPTIONS` requests are answered with a successful HTTP status code (2xx) and don’t redirect.

package/build/src/third_party/issue-descriptions/corsRedirectContainsCredentials.md CHANGED Viewed

@@ -1,5 +1,5 @@
-# Ensure CORS requests are not redirected to URLs containing credentials
+# Ensure CORS requests aren’t redirected to URLs containing credentials
-A cross-origin resource sharing (CORS) request was blocked because the response was a redirect to a URL that includes credentials, i.e. redirected to a URL of the form `https://username:password@example.com`.
+A Cross-Origin Resource Sharing (CORS) request was blocked because the response was a redirect to a URL that includes credentials, i.e. redirected to a URL of the form `https://username:password@example.com`.
-To fix this issue, ensure CORS requests are not redirected to URLs that include credentials.
+To fix this issue, ensure CORS requests aren’t redirected to URLs that include credentials.

package/build/src/third_party/issue-descriptions/corsWildcardOriginNotAllowed.md CHANGED Viewed

@@ -1,8 +1,9 @@
-# Ensure credentialed requests are not sent to CORS resources with origin wildcards
+# Ensure credentialed requests aren’t sent to CORS resources with origin wildcards
-A cross-origin resource sharing (CORS) request was blocked because it was configured to `include` credentials and the `Access-Control-Allow-Origin` response header of the request or the associated [preflight request](issueCorsPreflightRequest) was set to a wildcard `*`. CORS requests may only include credentials for resources where the `Access-Control-Allow-Origin` header is not a wildcard.
+A Cross-Origin Resource Sharing (CORS) request was blocked because it was configured to `include` credentials and the `Access-Control-Allow-Origin` response header of the request or the associated [preflight request](issueCorsPreflightRequest) was set to a wildcard `*`. CORS requests may only include credentials for resources where the `Access-Control-Allow-Origin` header isn’t a wildcard.
 To fix this issue, ensure that either the request is configured to not include credentials, or change the `Access-Control-Allow-Origin` header of the resource to not be a wildcard.
-Note that if an opaque response is sufficient, the request's mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers are not required but credentials are not sent and the response content is inaccessible (opaque).
+Note that if an opaque response is sufficient, the request’s mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers aren’t required but credentials aren’t sent and the response content is inaccessible (opaque).

package/build/src/third_party/issue-descriptions/cspEvalViolation.md CHANGED Viewed

@@ -1,9 +1,9 @@
-# Content Security Policy of your site blocks the use of 'eval' in JavaScript`
+# Content Security Policy of your site blocks the use of `eval` in JavaScript
-The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unathorized code on your site.
+The Content Security Policy (CSP) stops the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unauthorized code on your site.
-To solve this issue, avoid using `eval()`, `new Function()`, `setTimeout([string], ...)` and `setInterval([string], ...)` for evaluating strings.
+To solve this issue, avoid using `eval()`, `new Function()`, `setTimeout([string], …)` and `setInterval([string], …)` for evaluating strings.
 If you absolutely must: you can enable string evaluation by adding `unsafe-eval` as an allowed source in a `script-src` directive.
-⚠️ Allowing string evaluation comes at the risk of inline script injection.
+⚠️ Allowing string evaluation comes at the risk of inline script injection.

package/build/src/third_party/issue-descriptions/cspInlineViolation.md CHANGED Viewed

@@ -1,10 +1,10 @@
 # Content Security Policy blocks inline execution of scripts and stylesheets
-The Content Security Policy (CSP) prevents cross-site scripting attacks by blocking inline execution of scripts and style sheets.
+The Content Security Policy (CSP) stops cross-site scripting attacks by blocking inline execution of scripts and style sheets.
 To solve this, move all inline scripts (e.g. `onclick=[JS code]`) and styles into external files.
 ⚠️ Allowing inline execution comes at the risk of script injection via injection of HTML script elements. If you absolutely must, you can allow inline script and styles by:
 * adding `unsafe-inline` as a source to the CSP header
-* adding the hash or nonce of the inline script to your CSP header.
+* adding the hash or nonce of the inline script to your CSP header.

package/build/src/third_party/issue-descriptions/cspTrustedTypesPolicyViolation.md CHANGED Viewed

@@ -1,5 +1,5 @@
 # Trusted Type policy creation blocked by Content Security Policy
-Your site tries to create a Trusted Type policy that has not been allowed by the Content Security Policy. The Content Security Policy may restrict the set of valid names for Trusted Type policies, and forbid more than one policy of each name.
+Your site tries to create a Trusted Type policy that hasn’t been allowed by the Content Security Policy. The Content Security Policy may restrict the set of valid names for Trusted Type policies, and forbid more than one policy of each name.
-To solve this, make sure that the names of the policies listed below are declared in the `trusted-types` CSP directive. To allow redefining policies add the `allow-duplicates` keyword. If you want to remove all restrictions on policy names, remove the `trusted-types` directive entirely (not recommended).
+To solve this, make sure that the names of the policies listed below are declared in the `trusted-types` CSP directive. To allow redefining policies add the `allow-duplicates` keyword. If you want to remove all restrictions on policy names, remove the `trusted-types` directive entirely (not recommended).

package/build/src/third_party/issue-descriptions/cspTrustedTypesSinkViolation.md CHANGED Viewed

@@ -1,8 +1,8 @@
-# Trusted Type expected, but String received
+# Trusted Type expected, but got String
-Your site tries to use a plain string in a DOM modification where a Trusted Type is expected. Requiring Trusted Types for DOM modifications helps to prevent cross-site scripting attacks.
+Your site tries to use a plain string in a DOM change where a Trusted Type is expected. Requiring Trusted Types for DOM changes helps to stop cross-site scripting attacks.
-To solve this, provide a Trusted Type to all the DOM modifications listed below. You can convert a string into a Trusted Type by:
+To solve this, provide a Trusted Type to all the DOM changes listed below. You can convert a string into a Trusted Type by:
 * defining a policy and using its corresponding `createHTML`, `createScript` or `createScriptURL` function.
-* defining a policy named `default` which will be automatically called.
+* defining a policy named `default` which will be automatically called.

package/build/src/third_party/issue-descriptions/cspURLViolation.md CHANGED Viewed

@@ -1,10 +1,10 @@
 # Content Security Policy of your site blocks some resources
-Some resources are blocked because their origin is not listed in your site's Content Security Policy (CSP). Your site's CSP is allowlist-based, so resources must be listed in the allowlist in order to be accessed.
+Some resources are blocked because their origin isn’t listed in your site’s Content Security Policy (CSP). Your site’s CSP is allowlist-based, so resources must be listed in the allowlist to be accessed.
-A site's Content Security Policy is set either via an HTTP header (recommended), or via a meta HTML tag.
+A site’s Content Security Policy is set either via an HTTP header (recommended), or via a meta HTML tag.
 To fix this issue do one of the following:
-* (Recommended) If you're using an allowlist for `'script-src'`, consider switching from an allowlist CSP to a strict CSP, because strict CSPs are [more robust against XSS](issuesCSPWhyStrictOverAllowlist). [See how to set a strict CSP](issuesCSPSetStrict).
-* Or carefully check that all of the blocked resources are trustworthy; if they are, include their sources in the CSP of your site. ⚠️Never add a source you don't trust to your site's CSP. If you don't trust the source, consider hosting resources on your own site instead.
+* (Recommended) If you’re using an allowlist for `'script-src'`, consider switching from an allowlist CSP to a strict CSP, because strict CSPs are [more robust against XSS](issuesCSPWhyStrictOverAllowlist). [See how to set a strict CSP](issuesCSPSetStrict).
+* Or carefully check that all of the blocked resources are trustworthy; if they are, include their sources in the CSP of your site. ⚠️Never add a source you don’t trust to your site’s CSP. If you don’t trust the source, consider hosting resources on your own site instead.

package/build/src/third_party/issue-descriptions/emailVerificationRequestAccountsEmptyList.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the accounts endpoint returned an empty list of accounts

package/build/src/third_party/issue-descriptions/emailVerificationRequestAccountsHttpNotFound.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the accounts endpoint wasn’t found (HTTP 404)

package/build/src/third_party/issue-descriptions/emailVerificationRequestAccountsInvalidContentType.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the accounts endpoint returned an invalid Content-Type

package/build/src/third_party/issue-descriptions/emailVerificationRequestAccountsInvalidResponse.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the accounts endpoint returned an invalid response

package/build/src/third_party/issue-descriptions/emailVerificationRequestAccountsNoResponse.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the accounts endpoint did not respond

package/build/src/third_party/issue-descriptions/emailVerificationRequestDnsFetchFailed.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the DNS fetch failed

package/build/src/third_party/issue-descriptions/emailVerificationRequestDnsInvalidRecord.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the DNS record is invalid

package/build/src/third_party/issue-descriptions/emailVerificationRequestEmailVerificationWellKnownHttpNotFound.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the email verification well-known file wasn’t found (HTTP 404)

package/build/src/third_party/issue-descriptions/emailVerificationRequestEmailVerificationWellKnownInvalidContentType.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the email verification well-known file returned an invalid Content-Type

package/build/src/third_party/issue-descriptions/emailVerificationRequestEmailVerificationWellKnownInvalidResponse.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the email verification well-known file returned an invalid response

package/build/src/third_party/issue-descriptions/emailVerificationRequestEmailVerificationWellKnownNoResponse.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the email verification well-known file did not respond

package/build/src/third_party/issue-descriptions/emailVerificationRequestInvalidEmail.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the email address is invalid

package/build/src/third_party/issue-descriptions/emailVerificationRequestJwksHttpNotFound.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the JWKS endpoint wasn’t found (HTTP 404)

package/build/src/third_party/issue-descriptions/emailVerificationRequestJwksInvalidResponse.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the JWKS endpoint returned an invalid response

package/build/src/third_party/issue-descriptions/emailVerificationRequestKeyBindingSigningFailed.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because key binding signing failed

package/build/src/third_party/issue-descriptions/emailVerificationRequestRpOriginIsOpaque.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the Relying Party origin is opaque

package/build/src/third_party/issue-descriptions/emailVerificationRequestTokenHttpNotFound.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the token endpoint wasn’t found (HTTP 404)

package/build/src/third_party/issue-descriptions/emailVerificationRequestTokenInvalidContentType.md ADDED Viewed

	@@ -0,0 +1 @@
1	+ # Email verification request failed because the token endpoint had an invalid Content-Type