Skip to content

Specify the behavior of COEP: credentialless, #1229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
annevk merged 16 commits into from
Nov 3, 2021
Merged

Specify the behavior of COEP: credentialless, #1229

Changes from 1 commit
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
8406e47
Specify the behavior of `COEP: credentialless`,
ArthurSonzogni May 3, 2021
c95a1e5
Remove ambiguity in the switch.
ArthurSonzogni May 31, 2021
ab4c380
Fix the CORP check.
ArthurSonzogni Jun 7, 2021
55c97fa
Address Yutaka comment (invert same-origin check)
ArthurSonzogni Jun 9, 2021
4a1c72d
Address Yutaka comment #2
ArthurSonzogni Jun 9, 2021
5c90294
Address Yutaka comment.
ArthurSonzogni Jun 14, 2021
4d8cb48
Verify & fix newlines.
ArthurSonzogni Jun 14, 2021
a7b9b13
Address Yutaka comments #4.
ArthurSonzogni Jun 17, 2021
7678aa6
Address Yutaka comments.
ArthurSonzogni Jul 6, 2021
2868bcd
Address annevk@ comments.
ArthurSonzogni Sep 14, 2021
541926e
Address annevk@ comment about redirects.
ArthurSonzogni Sep 20, 2021
3c48686
Rebase over PolicyContainter
ArthurSonzogni Sep 21, 2021
89aaca1
Address annevk@ nits.
ArthurSonzogni Sep 22, 2021
63cbf56
Address domenic comments.
ArthurSonzogni Nov 1, 2021
3eb0723
alotta nits
annevk Nov 2, 2021
60a8cf1
one more nit
annevk Nov 3, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Address annevk@ nits.
  • Loading branch information
@ArthurSonzogni
ArthurSonzogni committed Sep 22, 2021
commit 89aaca1fdd377c5b10133cceb56a100ca618fd27
22 changes: 12 additions & 10 deletions fetch.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1896,14 +1896,15 @@ source of security bugs. Please seek security review for features that deal with
<a for=/>request</a> <var>request</var>, run theses steps:
Comment thread
ArthurSonzogni marked this conversation as resolved.
Outdated

<ol>
<li><p>If <var>request</var>'s <a for=request>mode</a> is not <code>no-cors</code>", return
<li><p>If <var>request</var>'s <a for=request>mode</a> is not <code>no-cors</code>", then return
true.</p>

<li><p>If <var>request</var>'s <a for=request>client</a> is null, return true.</p>

<li><p>If <var>request</var>'s <a for=request>client</a>'s
<a for="environment settings object">policy container</a>'s
<a for="policy container">embedder policy</a> is not
<a for="policy container">embedder policy</a>'s
<a for="embedder policy">value</a> is not
"<code><a for="embedder policy value">credentialless</a></code>", return true.</p>

<li><p>If <var>request</var>'s <a for=request>origin</a> is <a>same origin</a> with
Expand Down Expand Up @@ -3535,17 +3536,18 @@ Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-or
<p>If <var>policy</var> is null, switch on <var>embedderPolicyValue</var>:</p>
<dl class=switch>
<dt>`<a for="embedder policy value">unsafe-none</a>`
Comment thread
annevk marked this conversation as resolved.
Outdated
<dd> Do nothing.
<dd><p>Do nothing.

<dt>`<a for="embedder policy value">credentialless</a>`
<dd> Set <var>policy</var> to `<code>same-origin</code>` if one of the following is true:
<ul>
<li><var>response</var>'s <a for="response">request-include-credentials</a> is true.
<li><var>forNavigation</var> is true.
</ul>
<dd>
<p>Set <var>policy</var> to `<code>same-origin</code>` if one of the following is true:
<ul>
<li><var>response</var>'s <a for="response">request-include-credentials</a> is true.
<li><var>forNavigation</var> is true.
</ul>

<dt>`<a for="embedder policy value">require-corp</a>`
<dd> Set <var>policy</var> to `<code>same-origin</code>`.
<dd><p>Set <var>policy</var> to `<code>same-origin</code>`.
</dl>
</li>

Expand Down Expand Up @@ -4707,7 +4709,7 @@ steps. They return a <a for=/>response</a>.
<p>is true; otherwise false.

<li><p>If <a>Cross-Origin-Embedder-Policy allows credentials</a> with <var>request</var> returns
false, set <var>includeCredentials</var> to false.</p>
false, then set <var>includeCredentials</var> to false.</p>
Comment thread
annevk marked this conversation as resolved.
Outdated

<li><p>Let <var>contentLength</var> be <var>httpRequest</var>'s <a for=request>body</a>'s
<a for=body>length</a>, if <var>httpRequest</var>'s <a for=request>body</a> is non-null;
Expand Down