Repository navigation
Reporting behavior between normal vs. Report-Only #6
Description
Chrome 135, original trial
With some example codes
<div class="violation-test">
<iframe id="cross-origin-iframe" src="https://example.com" title="Cross-origin iframe"></iframe>
<button id="access-iframe-btn">Try to Access Iframe Content</button>
<div id="iframe-result" class="result">Result will appear here</div>
<script>
console.log(window.crossOriginIsolated)
fetch('https://picsum.photos/100')
.then(response => {
const img = document.createElement('img');
img.src = response.url;
document.querySelector('.violation-test').appendChild(img);
});
</script>
</div>
Setting header to actual
c.header("Document-Isolation-Policy", `isolate-and-credentialless;report-to="dip-endpoint"`);
enables crossOriginIsolated correctly, no report being sent and the resources are accessible.
If change header to report-only
c.header("Document-Isolation-Policy-Only", `isolate-and-credentialless;report-to="dip-endpoint"`);
crossOriginIsolatedis false (expected)- resources are accessible (expected)
- violation report with type
corpreported 👈 Is this expected?
Given the header value is isolate-and-credentialless I expected corp type violation won't be reported. Also if it's expected violation, would like to understand why only reported with Report-only.
Activity