Skip to content

Commit f60b8b4

Browse files
ArthurSonzogniArthurSonzogni
committed
Specify the behavior of COEP: credentialless,
(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
1 parent 5fac9e8 commit f60b8b4

1 file changed

Lines changed: 28 additions & 0 deletions

File tree

‎fetch.bs‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1870,6 +1870,25 @@ source of security bugs. Please seek security review for features that deal with
18701870
<a for="URL serializer"><i>exclude fragment</i></a> set to true.
18711871
</ol>
18721872

1873+
<p>To check <dfn export>Cross-Origin-Embedder-Policy allows credentials</dfn>, given a
1874+
<a for=/>request</a> <var>request</var>, run theses steps:
1875+
1876+
<ol>
1877+
<li><p>If <var>request</var>'s <a for=request>mode</a> is not <code>no-cors</code>", return
1878+
false.</p>
1879+
1880+
<li><p>If <var>request</var>'s <a for=request>client</a> is null, return false.</p>
1881+
1882+
<li><p>If <var>request</var>'s <a for=request>client</a>'s <a for="environment settings
1883+
object">embedder policy</a> is not "<code><a for="embedder policy
1884+
value">credentialless</a></code>", return false.</p>
1885+
1886+
<li><p>If <var>request</var>'s <a for=request>origin</a> is not <a>same origin</a> with
1887+
<var>request</var>'s <a for=request>client</a>'s <a for="environment settings object">origin</a>,
1888+
return false.</p>
1889+
1890+
<li><p>Return true.</p>
1891+
</ol>
18731892

18741893
<h4 id=responses>Responses</h4>
18751894

@@ -3399,6 +3418,10 @@ Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-or
33993418
"<code><a for="embedder policy value">require-corp</a></code>", then set <var>policy</var> to
34003419
`<code>same-origin</code>`.
34013420

3421+
<li><p>If <var>policy</var> is null, <var>embedderPolicyValue</var> is
3422+
"<code><a for="embedder policy value">credentialless</a></code>", and
3423+
<var>forNavigation</var> is true, then set <var>policy</var> to `<code>same-origin</code>`.
3424+
34023425
<li>
34033426
<p>Switch on <var>policy</var>:
34043427

@@ -4549,6 +4572,10 @@ steps. They return a <a for=/>response</a>.
45494572

45504573
<p>is true; otherwise false.
45514574

4575+
<li>
4576+
<p>If <a>Cross-Origin-Embedder-Policy allows credentials</a> with
4577+
<var>request</var>, set <var>includeCredentials</var> to false.</p>
4578+
45524579
<li><p>Let <var>contentLength</var> be <var>httpRequest</var>'s <a for=request>body</a>'s
45534580
<a for=body>length</a>, if <var>httpRequest</var>'s <a for=request>body</a> is non-null;
45544581
otherwise null.
@@ -7720,6 +7747,7 @@ Arkadiusz Michalski,
77207747
Arne Johannessen,
77217748
Artem Skoretskiy,
77227749
Arthur Barstow,
7750+
Arthur Sonzogni,
77237751
Asanka Herath,
77247752
Axel Rauschmayer,
77257753
Ben Kelly,

0 commit comments

Comments
 (0)