Reintroduce the dependency on a parent's security.

w3c / webappsec-secure-contexts

WebAppSec Secure Contexts

https://w3c.github.io/webappsec-secure-contexts/

Other

33 stars 28 forks source link

Reintroduce the dependency on a parent's security. #55

Closed mikewest closed 6 years ago

mikewest commented 6 years ago

The patch in 98f2c26 inadvertantly removed the check which ensured that nested browsing contexts would be treated as non-secure in cases where an ancestor was non-secure. This patch reintroduces that check by requiring 'contextual security' for any parent browsing context's active document.

Closes #54. Thanks to @bzbarsky for noticing the removal.

Preview | Diff

mikewest commented 6 years ago

WDYT, @bzbarsky/@annevk?

estark37 commented 6 years ago

LGTM!

annevk commented 6 years ago

This looks good. I did find #56 while looking at the overall algorithm again though. (Might not be a problem per se in implementations. Not sure if anyone supports nested workers yet.)

annevk commented 6 years ago

Also found #57.

bzbarsky commented 6 years ago

Gecko supports nested workers. I'll follow up in #56 on what we implement.