Make "site storage quota" less susceptible to side-channel attacks

whatwg / storage

Storage Standard

https://storage.spec.whatwg.org/

Other

124 stars 55 forks source link

Make "site storage quota" less susceptible to side-channel attacks #70

Open annevk opened 5 years ago

annevk commented 5 years ago

It's (somewhat encouraged to be) a global limit and as @tomvangoethem has pointed out, this can lead to cross-origin leaks (XSLeaks).

This relates to #31, but that focuses more on "site storage usage".

cc @whatwg/security

(Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1552848.)

annevk commented 5 years ago

(I removed a suggested approach from OP as it would only address fingerprinting. I recommend reading the Firefox bug for now for more considered approaches.)