w3c / webappsec-secure-contexts

WebAppSec Secure Contexts
https://w3c.github.io/webappsec-secure-contexts/
Other
33 stars 38 forks source link

isSecureContext definition seems wrong in multi-global situations #36

Closed domenic closed 7 years ago

domenic commented 8 years ago

Both Window's isSecureContext and WorkerGlobalScope's isSecureContext attributes' getters return true if the relevant settings object for the getter’s global object is a secure context, and false otherwise.

This is saying that it looks at the getter's global object. In other words, it is equivalent to

Both Window's isSecureContext and WorkerGlobalScope's isSecureContext attributes' getters return true if the current settings object is a secure context, and false otherwise.

I think you want to instead look at the object to which the getter is applied. That would be:

Both Window's isSecureContext and WorkerGlobalScope's isSecureContext attributes' getters return true if this global object's relevant settings object is a secure context, and false otherwise.

or just using the fact that you've already defined "secure context" to apply to to global objects, you could do

Both Window's isSecureContext and WorkerGlobalScope's isSecureContext attributes' getters return true if this global object is a secure context, and false otherwise.

The difference is observable when doing this:

const getter = Object.getOwnPropertyDescriptor(window1, "isSecureContext").get;
console.log(getter.call(window2));

With the current spec this tells you if window1 is a secure context. I think it should tell you if window2 is a secure context.

mikewest commented 7 years ago

Closed with 040600a. Thank you!