imported trac comment
created: 2010-11-04 18:13:22
author: tnes

Is this just for domains/IPs? Because it would be good if you would specify as a regex permitted URL destinations. e.g. you could whitelist the destination http://www.mywebsite.org/public/ to only allow cross domain access to files within that directory.

imported trac comment
created: 2011-02-16 10:56:06
author: eibwen

Just an observation that using both regex and CIDR in the same policy may be useful, eg:
'''(https?|s?ftp)'''{{{://}}}'''127.0.0.0/8'''{{{/root_folder_is_really_here}}}

Note that the first slash after the ip address would be CIDR representation of the host and not the root folder...

imported trac comment
created: 2011-08-03 20:45:55
author: jbn

Regular expression capturing parentheses and backreferences could be a way to implement a feature I wish !RequestPolicy had -- automatic whitelisting of hosts in the same subdomain.

If I visit www.foo.com which hosts images on images.foo.com, and videos on video.foo.com, I want to allow www.foo.com to load stuff from the other *.foo.com sites so I can see the entire webpage. I figure that I apparently already trust foo.com's admins to know that I'm visiting the page, so letting those admins see that I'm also fetching page-related content should be okay. I would want to do this so often that I would want this to be a default setting for myself.

Regular expressions can help me accomplish what I'm after. If there were some way of saying:{{{ Allow requests from ^.+.(...)$ to ^\1$}}}\for all sites, that could help me get what I'm after.

So what about this feature? Any plans of doing something like that?

The problem is now showing itself rather often because of a major CDN service CloudFront which uses a whole bunch of ***.cloudfront.net domain names. Since most of the time it's the static content that's being hosted there, you will most likely allow the CloudFront domains, but since there are so many of them, you can hardly add them all to the whitelist manually. So at least something simple like *.cloudfront.net would be really useful.

I think that instead of waiting for the longest time trying to find enough resources to code all the text processing tools into the URL parser, at least a *.domain.name support could be implemented, at least for the time being. It's easier, and it's already something that will cover a half of all use-cases.

This Feature is already implemented in the Version 1.x Beta.
https://www.requestpolicy.com/1.0.html

issue #339
is about choosing a file-format to move away from prefs.js