Skip to content

Commit 2b03205

Browse files
ArthurSonzogniArthurSonzogni
committed
Specify the behavior of COEP: credentialless,
(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
1 parent 0fe0e23 commit 2b03205

1 file changed

Lines changed: 54 additions & 3 deletions

File tree

‎fetch.bs‎

Lines changed: 54 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1892,6 +1892,25 @@ source of security bugs. Please seek security review for features that deal with
18921892
<a for="URL serializer"><i>exclude fragment</i></a> set to true.
18931893
</ol>
18941894

1895+
<p>To check <dfn export>Cross-Origin-Embedder-Policy allows credentials</dfn>, given a
1896+
<a for=/>request</a> <var>request</var>, run theses steps:
1897+
1898+
<ol>
1899+
<li><p>If <var>request</var>'s <a for=request>mode</a> is not <code>no-cors</code>", return
1900+
true.</p>
1901+
1902+
<li><p>If <var>request</var>'s <a for=request>client</a> is null, return true.</p>
1903+
1904+
<li><p>If <var>request</var>'s <a for=request>client</a>'s <a for="environment settings
1905+
object">embedder policy</a> is not
1906+
"<code><a for="embedder policy value">credentialless</a></code>", return true.</p>
1907+
1908+
<li><p>If <var>request</var>'s <a for=request>origin</a> is not <a>same origin</a> with
1909+
<var>request</var>'s <a for=request>client</a>'s <a for="environment settings object">origin</a>,
1910+
return true.</p>
1911+
1912+
<li><p>Return false.</p>
1913+
</ol>
18951914

18961915
<h4 id=responses>Responses</h4>
18971916

@@ -1978,6 +1997,10 @@ initially unset.
19781997
being provided to an API that didn't make a range request. See the flag's usage for a detailed
19791998
description of the attack.
19801999

2000+
<p>A <a for=/>response</a> has an associated <dfn for=response
2001+
id=concept-response-request-include-credentials>request-include-credentials</dfn>, which is
2002+
initially set.
2003+
19812004
<p>A <a for=/>response</a> has an associated
19822005
<dfn for=response id=concept-response-timing-allow-passed>timing allow passed flag</dfn>, which is
19832006
initially unset.
@@ -3421,9 +3444,29 @@ Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-or
34213444
<li><p>If <var>policy</var> is neither `<code>same-origin</code>`, `<code>same-site</code>`, nor
34223445
`<code>cross-origin</code>`, then set <var>policy</var> to null.
34233446

3424-
<li><p>If <var>policy</var> is null and <var>embedderPolicyValue</var> is
3425-
"<code><a for="embedder policy value">require-corp</a></code>", then set <var>policy</var> to
3426-
`<code>same-origin</code>`.
3447+
<li><p>If <var>policy</var> is null, switch on <var>embedderPolicyValue</var>:
3448+
<dl class=switch>
3449+
<dt>`<a for="embedder policy value">unsafe-none</a>`
3450+
<dt>`<a for="embedder policy value">credentialless</a>`
3451+
<dd> Set <var>policy</var> to `<code>same-origin</code>` if one of the
3452+
following is true:
3453+
<ul>
3454+
<li><var>response</var>'s <a for="response">request-include-credentials</a> is true and
3455+
<var>response</var>'s <a for="response">type</a> is "<code>opaque</code>".
3456+
<li><var>forNavigation</var> is true.
3457+
</ul>
3458+
3459+
<dt>`<a for="embedder policy value">require-corp</a>`
3460+
<dd> Set <var>policy</var> to `<code>same-origin</code>`.
3461+
</dl>
3462+
</li>
3463+
3464+
<li><p>If <var>policy</var> is null, <var>embedderPolicyValue</var> is
3465+
"<code><a for="embedder policy value">credentialless</a></code>", and
3466+
<var>forNavigation</var> is true, then set <var>policy</var> to `<code>same-origin</code>`.
3467+
3468+
<li><p>If <var>policy</var> is null and <var>embedderPolicyValue</var> is "<code><a for="embedder
3469+
policy value">require-corp</a></code>", then set <var>policy</var> to `<code>same-origin</code>`.
34273470

34283471
<li>
34293472
<p>Switch on <var>policy</var>:
@@ -4585,6 +4628,10 @@ steps. They return a <a for=/>response</a>.
45854628

45864629
<p>is true; otherwise false.
45874630

4631+
<li>
4632+
<p>If <a>Cross-Origin-Embedder-Policy allows credentials</a> with
4633+
<var>request</var> is false, set <var>includeCredentials</var> to false.</p>
4634+
45884635
<li><p>Let <var>contentLength</var> be <var>httpRequest</var>'s <a for=request>body</a>'s
45894636
<a for=body>length</a>, if <var>httpRequest</var>'s <a for=request>body</a> is non-null;
45904637
otherwise null.
@@ -4945,6 +4992,9 @@ steps. They return a <a for=/>response</a>.
49454992
<li><p>If <var>httpRequest</var>'s <a for=request>header list</a> <a for="header list">contains</a>
49464993
`<code>Range</code>`, then set <var>response</var>'s <a for=response>range-requested flag</a>.
49474994

4995+
<li><p>Set <var>response</var>'s <a for=response>request-include-credentials</a> to
4996+
<var>includeCredentials</var>.
4997+
49484998
<li>
49494999
<p>If <var>response</var>'s <a for=response>status</a> is 401, <var>httpRequest</var>'s
49505000
<a for=request>response tainting</a> is not "<code>cors</code>", <var>includeCredentials</var> is
@@ -7758,6 +7808,7 @@ Arkadiusz Michalski,
77587808
Arne Johannessen,
77597809
Artem Skoretskiy,
77607810
Arthur Barstow,
7811+
Arthur Sonzogni,
77617812
Asanka Herath,
77627813
Axel Rauschmayer,
77637814
Ben Kelly,

0 commit comments

Comments
 (0)