Open annevk opened 9 months ago
+CC @camillelamy and @mikewest who might want to bring more informations.
Some data we have: ~94% of <iframe credentialless>
are not sandboxed.
About repurposing sandbox
to implement <iframe credentialless>
. This was documented here:
Thank you for reiterating those. Here's how I was thinking about them:
disallow-unscoped-origin
could be a feature of sandboxing generally and perhaps not need to be opt-in. As all browsers transition towards blocking cross-site cookies, that should be easier.disallow-autofill
, but maybe that's possible to do by default as well. We'd have to measure how many logins happen in sandboxed documents.disallow-unscoped-origin
. The server with the CSP policy would have to know not to react to cookies. As for COOP+COEP, are we sure it won't work? We could consider this declaration to be equivalent to COEP: require-corp/credentialless or some such, maybe?
Looking at this again for https://github.com/WebKit/standards-positions/issues/45 it occurred to us with everyone aligning on cross-site cookies, repurposing the
sandbox
attribute in some manner might be within grasp?I realize this was discussed to some extent before in https://github.com/mozilla/standards-positions/issues/628#issuecomment-1202183489 but it would be nice to have this flushed out a bit more. And also discussed in a place that's a bit more appropriate.