Skip to content

Sketch out a CORP-only mode. #893

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Sketch out a CORP-only mode. #893

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c995443
Sketch out a CORP-only mode.
mikewest Apr 12, 2019
1d51622
fixup typo
mikewest Apr 12, 2019
e553fea
fixup more typos
mikewest Apr 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 66 additions & 34 deletions fetch.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2940,67 +2940,99 @@ run these steps:</p>

<h3 id=cross-origin-resource-policy-header>`<code>Cross-Origin-Resource-Policy</code>` header</h3>

<p>The
<p>Servers can use the
`<dfn export http-header id=http-cross-origin-resource-policy><code>Cross-Origin-Resource-Policy</code></dfn>`
response <a for=/>header</a> can be used to require checking a <a for=/>request</a>'s
<a for=request>current URL</a>'s <a for=url>origin</a> against a <a for=/>request</a>'s
<a for=request>origin</a> when <a for=/>request</a>'s <a for=request>mode</a> is
"<code>no-cors</code>".
response <a for=/>header</a> to control the contexts into which a given resource may be loaded. The
restrictions asserted by this header apply to "<code>no-cors</code>" subresource requests and to
<a>navigation requests</a> that target a frame or a window that's accessible from the request's
initiator.

<p>Its <a for=header>value</a> <a>ABNF</a>:

<pre><code class=lang-abnf>
Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" ; case-sensitive
Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-site" ; case-sensitive
</code></pre>

<p>To perform a <dfn>cross-origin resource policy check</dfn>, given a <var>request</var> and
<var>response</var>, run these steps:</p>

<ol>
<li><p>If <var>request</var>'s <a for=request>mode</a> is not "<code>no-cors</code>", then return
<b>allowed</b>.

<li>
<p>If <var>request</var>'s <a for=request>origin</a> is <a>same origin</a> with
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a>, then return
<b>allowed</b>.
<p>Return <b>allowed</b> if either of the following statements is true:
<ul class=brief>
<li><p><var>request</var>'s <a for=request>mode</a> is "<code>same-origin</code>",
"<code>cors</code>", or "<code>websocket</code>".

<p class="note no-backref">While redirects that carry a
`<a http-header><code>Cross-Origin-Resource-Policy</code></a>` header are checked, redirects
without such a header resulting in <var>response</var> do not contribute to this algorithm. I.e.,
<var>request</var>'s <a for=request>tainted origin flag</a> is not checked.
<li><p><var>request</var> is a <a>navigation request</a> whose <a for=request>reserved client</a>
is an <a for=/>environment</a> whose <a for=environment>target browsing context</a> is neither a
<a>nested browsing context</a> nor an <a>auxiliary browsing context</a>.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should explain why the auxiliary navigating the non-auxiliary is not a problem.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, hrm. I guess that actually is a problem without process isolation. attacker.site could open attacker.site in a new window, the latter could navigate the former to victim.site, and sadness would ensue. Perhaps this should instead ask whether we're navigating within a unit of related browsing contexts? Or whatever the new hotness is? "User agent cluster"?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Without process isolation on the agent cluster level, right.

I think the navigation checks only make sense when the flag is set on a document. And that flag only makes sense if COOP is also set. (COOP guaranteeing process isolation on the browsing context group level.)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New hotness background:

</ul>

<li>
<p>Let <var>policy</var> be the result of <a for="header list">getting</a>
`<a http-header><code>Cross-Origin-Resource-Policy</code></a>` from <var>response</var>'s
<a for=response>header list</a>.

<p class=note>This means that `<code>Cross-Origin-Resource-Policy: same-site, same-origin</code>`
ends up as <b>allowed</b> below as it will never match anything. Two or more
`<a http-header><code>Cross-Origin-Resource-Policy</code></a>` headers will have the same effect.

<li><p>If <var>policy</var> is `<code>same-origin</code>`, then return <b>blocked</b>.
ends up as <b>allowed</b> as it will not match any of the explicit options in the switch below.
Two or more `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` headers delivered in
the same response will similarly fall through to <b>allowed</b> below.

<li>
<p>If the following are true
<p>If <var>policy</var> is null, and <a for=/>request</a>'s <a for=request>client</a>'s
<a for="environment settings object">responsible browsing context</a>'s <a>active document</a>'s
<b>x-bikeshed-cross-origin-resource-policy-policy flag</b> is set, then set <var>policy</var> to
"<code>same-origin</code>".

<ul class=brief>
<li><var>request</var>'s <a for=request>origin</a>'s <a for=url>host</a> is <a>same site</a> with
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>
<li><var>request</var>'s <a for=request>origin</a>'s <a for=url>scheme</a> is
"<code>https</code>" or <var>response</var>'s <a for=response>HTTPS state</a> is
"<code>none</code>"
</ul>
<p class=XXX>This is a straw-proposal to clarify a suggestion in
<a href=https://github.com/whatwg/html/issues/4175>issue #4175</a>. The flag isn't yet defined,
and might end up looking completely different.

<p>then return <b>allowed</b>.
<li>Switch on <var>policy</var>:
<dl class=switch>
<dt>"<code>same-origin</code>"
<dd>
<ol>
<li><p>If <var>request</var>'s <a for=request>origin</a> is <a>same origin</a> with
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a>, return
<b>allowed</b>.
<li>Otherwise return <b>blocked</b>.
</ol>

<p class=note>This prevents HTTPS responses with
`<code>Cross-Origin-Resource-Policy: same-site</code>` from being accessed without secure
transport.
<dt>"<code>same-site</code>"
<dd>
<ol>
<li>
<p>Return <b>allowed</b> if the following are true:
<ul class=brief>
<li><var>request</var>'s <a for=request>origin</a>'s <a for=url>host</a> is <a>same site</a>
with <var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>

<li><p>If <var>policy</var> is `<code>same-site</code>`, then return <b>blocked</b>.
<li><var>request</var>'s <a for=request>origin</a>'s <a for=url>scheme</a> is
"<code>https</code>" or <var>response</var>'s <a for=response>HTTPS state</a> is
"<code>none</code>"
</ul>
<p class=note>`<code>Cross-Origin-Resource-Policy: same-site</code>` does not consider a
response delivered via a secure transport to match a non-secure requesting origin, even if
their hosts are otherwise <a>same site</a>. Securely-transported responses will only match a
securely-transported initiator.

<li><p>Return <b>allowed</b>.
<li><p>Otherwise, return <b>blocked</b>.
</ol>

<dt>"<code>cross-site</code>"
<dd>Return <b>allowed</b>.

<dt>Otherwise
<dd>
<p>Return <b>allowed</b>.

</dl>

<p class="note no-backref">While redirects that carry a
`<a http-header><code>Cross-Origin-Resource-Policy</code></a>` header are checked, redirects
without such a header resulting in <var>response</var> do not contribute to this algorithm. I.e.,
<var>request</var>'s <a for=request>tainted origin flag</a> is not checked.
</ol>


Expand Down