search

whatwg / html

HTML Standard
https://html.spec.whatwg.org/multipage/
Other
8.17k stars 2.69k forks source link

COOP + non-HTTP non-initial-about:blank inheritance #5198

Open annevk opened 4 years ago

annevk commented 4 years ago

Part of this is tracked by #5168 where I think we have good solutions for initial about:blank. #4916 tracks this for COEP.

data: cannot work as it's not a secure context.

about:blank and blob: remain for popups. I think we should inherit for them as we do normally, presumably from the source browsing context document.

Work in progress tests:

cc @clelland @zcorpan @jugglinmike @ParisMeuleman @mikewest @hemeryar

annevk commented 4 years ago

The big problem with defining the exact model for blob: URLs (@zcorpan asked in https://github.com/web-platform-tests/wpt/pull/19947#issuecomment-572576713) is that the existing model for them is not defined.

In particular:

cc @hiroshige-g @mkruisselbrink

annevk commented 4 years ago

@whatwg/cross-origin-isolation please see https://github.com/w3c/webappsec-secure-contexts/issues/69 for some further thoughts on data: URLs.

annevk commented 4 years ago

Blob URL scenarios:

I think the proposed changes are good and they are also likely web-compatible given how esoteric things are, but we might have to tweak things, depending.

yutakahirano commented 4 years ago

Does that apply when the URL is persisted to a storage?

annevk commented 4 years ago

The blob URL? I would expect the lifetime of its associated blob in the blob URL store to not outlive the global that created it. https://w3c.github.io/FileAPI/#url states this as fact, but does not in fact require it.

yutakahirano commented 4 years ago

Ah I see thank you.

annevk commented 4 years ago

Update on data: URLs. They cannot be navigated to in top-level browsing contexts so it's mostly moot, but we haven't exactly enforced that fully. I think if user agents do allow navigation to them in a top-level browsing context they should always ensure that it's a fresh browsing context group, especially if the creator is from a COOP browsing context group.

ParisMeuleman commented 3 years ago

I (re)came across this while exploring the addition of COOP to the PolicyContainer within Chromium and the behavior we expect for the local schemes, specifically "about:blank" as the initial empty document and data are already covered. Note that this seems to really matter only in the COOP:same-origin-allow-popup mixed with popups having COOP: unsafe-none cases. Current Chromium behavior (and my understanding of the spec following a short discussion with Camille) is to keep the previous documents' policy, this seems an odd behavior, I'd expect to inherit from the document that initiates the navigation.

My understanding is that's what you are suggest here about:blank and blob: remain for popups. [...] inherit as we do normally, presumably from the source document., assuming that the source document is associated to the navigating across documents spec source browsing context, i.e. the document responsible for starting the navigation.

I would suggest however that we mimic the behavior of the initial empty document instead: inherit from the source document top level document if they are both same-origin, unsafe-none otherwise. Indeed, unless I misunderstood, we don't inherit to child frames, nor do they process COOP from response headers.

annevk commented 3 years ago

Yeah that sounds reasonable and I guess that's also what we want for blob: URLs created in a nested document, right? (Assuming we successfully migrate to the model where we store their policy at creation time.)

ParisMeuleman commented 3 years ago

yes I think that would be the desired behavior for blob: as well, with the provided assumption.

ParisMeuleman commented 3 years ago

One thing I did not mention though is switching the browsing context group due to that navigation to those local schemes in some conditions:

This seems the correct behavior to me and is identical to what would happen if B was navigated to a page that is same-origin with A and had COOP - same-origin-allow-popups. Could switching the browsing context group be a problem for local schemes?

annevk commented 3 years ago

I think that is fine as it would also happen if you navigated B to another A. The weird thing might be that it'll be a (useless) blank document, but I don't see a reason to add a special case for that. User agents might want to show this as some kind of error to end users? Not sure.

ParisMeuleman commented 3 years ago

Sound good, and I don't think there's any reason to display an error.