Understand relationship of OriginPolicy with FeaturePolicy/ContentSecurityPolicy about webappsec-permissions-policy

[igrigorik]

My mental model on OriginPolicy is a bit different than what @mikewest and @igrigorik were discussing. I was picturing that we'd have FeaturePolicy and ContentSecurityPolicy. OriginPolicy would just be a way to enable either of those at an origin-wide level.

That's still true, sorry I may have confused things in my comment in #16.

Mike mentioned that he was considering pulling CSP-cookies into FP. However, my concern is that target use cases don't match FP. Specifically, host and secure modify behavior of how cookies are processed, whereas FP is focused on 'enable/disable' which only works for none case in that spec. As such, we could pull out none case into FP and disable both document.cookie and Set-Cookie processing.. if it makes sense for this functionality to cascade down when disabled -- does it? We should keep the other directives within CSP. Or, we can keep all three in CSP.. arguably, less confusion for developers.

Origin-Policy is mostly orthogonal to all of the above.. If we keep the mechanism in CSP it just provides an origin-wide opt-in mechanism.

[igrigorik]

Closing, see #43.