Specify the behavior of `COEP: credentialless`, by ArthurSonzogni · Pull Request #1229 · whatwg/fetch

ArthurSonzogni · 2021-05-03T16:46:24Z

Originally described in: https://github.com/mikewest/credentiallessness

credentialless and require-corp are similar. One or the other is a requirements for the window.crossOriginIsolated capability.
They differ mostly in the fetch specification. require-corp requires a CORP header for cross-origin no-cors responses. credentialless doesn't, but omits credentials (Cookies, clients certificates, etc...) in the request.

HTML (Add credentialless value to COEP (HTML spec) html#6638)
- Define how to parse the credentialless value.
- From the HTML spec point of view, credentialless and require-corp are equivalent. They have been grouped into compatible with cross-origin isolation and the HTML spec rewritten to use this concept.
Fetch: (Specify the behavior of COEP: credentialless, #1229)
- Define Cross-Origin-Embedder-Policy allows credentials algorithm. It omit credentials for no-cors, cross-origin, COEP:credentialless requests.
- Define response's request-include-credentials flag.
- In the Cross-Origin-Resource-Policy check, if embedderPolicy is credentialless, require CORP for navigational responses, and opaque responses with request-include-credentials.

See: whatwg/html#6637

At least two implementers are interested (and none opposed):
- Chrome: https://chromestatus.com/feature/4918234241302528#details
- Firefox: COEP: credentialless mozilla/standards-positions#539 (worth prototyping)
- Safari: https://lists.webkit.org/pipermail/webkit-dev/2021-June/031898.html (pending)
Tests are written and can be reviewed and commented upon at:
- https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless
Implementation bugs are filed:
- Chrome: https://crbug.com/1175099
- Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1731778
- Safari: https://bugs.webkit.org/show_bug.cgi?id=230550

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

ArthurSonzogni · 2021-05-03T16:55:39Z

This is still work in progress.
I still need write PR for ServiceWorker. Happy to get early feedback if you have nevertheless.

@whatwg/cross-origin-isolation @antosart @iVanlIsh

ArthurSonzogni · 2021-06-07T13:31:18Z

I wrote page gathering the two PR in a single page if you want to have a broader view:
https://htmlpreview.github.io/?https://github.com/mikewest/credentiallessness/blob/master/index.html

Would you have some suggestion?

The warning I have:

LINK ERROR: No 'dfn' refs found for 'credentialless'.
&lt;a data-link-for="embedder policy value" data-link-type="dfn" data-lt="credentialless">credentialless&lt;/a>

will be resolved when landing the HTML PR.

yutakahirano · 2021-06-09T12:27:01Z

Don't you want to compare request's current URL's origin and request's origin, rather than request's origin and request's client's origin?

ArthurSonzogni · 2021-06-09T14:07:02Z

Don't you want to compare request's current URL's origin and request's origin, rather than request's origin and request's client's origin?

Yes, this should be the current URL instead of the URL. Fixed in "Address Yutaka comment #2"
However the second origin should continue to be the client's origin. For instance, in the base case of a cross-origin no-cors request with no redirects, credentials must not be included. So the comparison is in between the client's origin and the request's current URL.

yutakahirano · 2021-06-10T10:05:54Z

However the second origin should continue to be the client's origin. For instance, in the base case of a cross-origin no-cors request with no redirects, credentials must not be included. So the comparison is in between the client's origin and the request's current URL.

Sorry, can you give me an example? request's origin and request's client's origin are usually the same, but other checks such as CORS use request's origin, so I want to understand why in this case we need to use the client's origin.

ArthurSonzogni · 2021-06-10T13:49:54Z

What is the main difference in between request's origin and request's client's origin?

Do you foresee a case where the difference matter for COEP:credentialless?

yutakahirano · 2021-06-10T15:05:54Z

What is the main difference in between request's origin and request's client's origin?

For example, process a nativate fetch manually sets request's origin (step 4.1).

Do you foresee a case where the difference matter for COEP:credentialless?

Regarding this algorithm, no. For requests with mode: "no-cors", I believe they match. In any case, request's origin is the source of truth for other checks, so using it here is better for consistency.

ArthurSonzogni · 2021-06-14T13:57:52Z

Regarding this algorithm, no. For requests with mode: "no-cors", I believe they match. In any case, request's origin is the source of truth for other checks, so using it here is better for consistency.

Thanks! I addressed this in 9f0be6a.

ArthurSonzogni

Thanks Yutaka,
I addressed your 3 comments in the latest commit.

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug:1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2

annevk · 2021-09-21T10:07:18Z

From CI it seems like this needs rebasing or at least some modernizing as embedder policy is now part of policy container.

(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637

annevk

Modulo nits this looks okay to me.

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Cr-Commit-Position: refs/heads/main@{#923884}

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Cr-Commit-Position: refs/heads/main@{#923884}

…r., a=testonly Automatic update from web-platform-tests [credentialless] Update redirect behavior. In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Cr-Commit-Position: refs/heads/main@{#923884} -- wpt-commits: 2d6d77b3054e9b7f35bdd2b3e7de9b53ecfed7d5 wpt-pr: 30871

Define COEP:credentialless Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in the request. * HTML (whatwg#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with cross-origin isolation` and the HTML spec rewritten to use this concept. * Fetch: (whatwg/fetch#1229) * Define `Cross-Origin-Embedder-Policy allows credentials` algorithm. It omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Define `response's` `request-include-credentials` flag. * In the `Cross-Origin-Resource-Policy check`, if `embedderPolicy` is `credentialless`, require CORP for navigational responses, and opaque responses with `request-include-credentials`. See: whatwg#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: mozilla/standards-positions#539 (worth prototyping) * Safari: https://lists.webkit.org/pipermail/webkit-dev/2021-June/031898.html (pending) - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless - [X] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1731778 * Safari: https://bugs.webkit.org/show_bug.cgi?id=230550 (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.)

ArthurSonzogni

Thanks! @domenic, I addressed your last comments.

This defines Cross-Origin-Embedder-Policy: credentialless. The credentialless and require-corp values are similar. One or the other is a requirements for the cross-origin isolated capability. They differ mostly in terms of fetching. require-corp requires a Cross-Origin-Resource-Policy header for cross-origin opaque responses. credentialless doesn't, but omits credentials (cookies, client certificates, etc.) in cross-origin "no-cors" requests. See https://github.com/WICG/credentiallessness for additional context. Fetch PR: whatwg/fetch#1229. Tests: WPT html/cross-origin-embedder-policy/credentialless. Closes #6637.

annevk · 2021-11-02T13:26:30Z

This can land tomorrow once HTML has been indexed by Shepherd. Note that I made a couple last minute changes, but they are all editorial.

annevk · 2021-11-03T07:56:08Z

It seems Shepherd has not run. (At least, as far as I can tell HTML was updated and the new term followed an existing pattern that does work and having checked all those things again I cannot find any errors.) @tabatkins @plinss, is that known?

plinss · 2021-11-03T16:05:56Z

Shepherd has been blocked for the last 18 hours or so, it just ran. The last version of fetch it scanned was published on 2021-11-01 01:32:23 PDT

annevk · 2021-11-03T16:28:05Z

Thanks @plinss!

annevk · 2021-11-03T16:28:49Z

And thanks @ArthurSonzogni for the work on the PR, of course! And @domenic and @yutakahirano for the reviews! 😊

ArthurSonzogni · 2021-11-03T22:41:29Z

Awesome! 🚀
Thanks @annevk, @domenic, @yutakahirano for the reviews!
I learnt a lot from you.

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Cr-Commit-Position: refs/heads/main@{#923884}

This defines Cross-Origin-Embedder-Policy: credentialless. The credentialless and require-corp values are similar. One or the other is a requirements for the cross-origin isolated capability. They differ mostly in terms of fetching. require-corp requires a Cross-Origin-Resource-Policy header for cross-origin opaque responses. credentialless doesn't, but omits credentials (cookies, client certificates, etc.) in cross-origin "no-cors" requests. See https://github.com/WICG/credentiallessness for additional context. Fetch PR: whatwg/fetch#1229. Tests: WPT html/cross-origin-embedder-policy/credentialless. Closes whatwg#6637.

…r., a=testonly Automatic update from web-platform-tests [credentialless] Update redirect behavior. In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Cr-Commit-Position: refs/heads/main@{#923884} -- wpt-commits: 2d6d77b3054e9b7f35bdd2b3e7de9b53ecfed7d5 wpt-pr: 30871

ArthurSonzogni force-pushed the coep-credentialless branch from f60b8b4 to 43d078a Compare May 4, 2021 09:09

ArthurSonzogni mentioned this pull request May 4, 2021

Add credentialless value to COEP (HTML spec) whatwg/html#6638

Merged

2 of 3 tasks

ArthurSonzogni force-pushed the coep-credentialless branch from 43d078a to 40674cd Compare May 4, 2021 11:14

ArthurSonzogni mentioned this pull request May 15, 2021

CacheStorage & COEP:credentialless w3c/ServiceWorker#1592

Closed

ArthurSonzogni force-pushed the coep-credentialless branch 2 times, most recently from 2b03205 to 6b301ae Compare May 30, 2021 16:15

yutakahirano reviewed Jun 9, 2021

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

yutakahirano reviewed Jun 15, 2021

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

ArthurSonzogni commented Jun 17, 2021

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

yutakahirano approved these changes Jun 17, 2021

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

annevk reviewed Sep 14, 2021

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

chromium-wpt-export-bot mentioned this pull request Sep 20, 2021

[credentialless] Update redirect behavior. web-platform-tests/wpt#30871

Merged

ArthurSonzogni added 8 commits September 21, 2021 14:19

Remove ambiguity in the switch.

c95a1e5

Fix the CORP check.

ab4c380

Address Yutaka comment (invert same-origin check)

55c97fa

Address Yutaka comment whatwg#2

4a1c72d

Address Yutaka comment.

5c90294

Verify & fix newlines.

4d8cb48

Address Yutaka comments whatwg#4.

a7b9b13

annevk reviewed Sep 22, 2021

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Address annevk@ nits.

89aaca1

domenic reviewed Nov 1, 2021

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Address domenic comments.

63cbf56

ArthurSonzogni commented Nov 1, 2021

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

alotta nits

3eb0723

one more nit

60a8cf1

annevk merged commit 0613515 into whatwg:main Nov 3, 2021

koal44 mentioned this pull request Sep 19, 2026

COEP credentials/taint #1958

Closed

adamsilverstein mentioned this pull request Sep 28, 2026

Upstream Document-Isolation-Policy to HTML and Fetch WICG/document-isolation-policy#8

Open

Conversation

ArthurSonzogni commented May 3, 2021 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ArthurSonzogni commented May 3, 2021

Uh oh!

ArthurSonzogni commented Jun 7, 2021

Uh oh!

Uh oh!

Uh oh!

yutakahirano commented Jun 9, 2021

Uh oh!

ArthurSonzogni commented Jun 9, 2021

Uh oh!

yutakahirano commented Jun 10, 2021

Uh oh!

ArthurSonzogni commented Jun 10, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yutakahirano commented Jun 10, 2021

Uh oh!

ArthurSonzogni commented Jun 14, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ArthurSonzogni left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

annevk commented Sep 21, 2021

Uh oh!

annevk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ArthurSonzogni left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

annevk commented Nov 2, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

annevk commented Nov 3, 2021

Uh oh!

plinss commented Nov 3, 2021

Uh oh!

annevk commented Nov 3, 2021

Uh oh!

annevk commented Nov 3, 2021

Uh oh!

ArthurSonzogni commented Nov 3, 2021

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

ArthurSonzogni commented May 3, 2021 •

edited by pr-preview Bot

Loading

ArthurSonzogni commented Jun 10, 2021 •

edited

Loading

annevk commented Nov 2, 2021 •

edited

Loading