From 061351538ccc373da775bab255fb30bf3cf4aa98 Mon Sep 17 00:00:00 2001 From: Arthur Sonzogni Date: Wed, 3 Nov 2021 17:27:02 +0100 Subject: [PATCH] Specify the behavior of COEP: credentialless This complements this HTML PR: https://github.com/whatwg/html/pull/6638. --- fetch.bs | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 54 insertions(+), 6 deletions(-) diff --git a/fetch.bs b/fetch.bs index c2a713c82..fdc6445c3 100644 --- a/fetch.bs +++ b/fetch.bs @@ -1937,6 +1937,27 @@ source of security bugs. Please seek security review for features that deal with exclude fragment set to true. +

To check if Cross-Origin-Embedder-Policy allows credentials, given a +request request, run these steps: + +

    +

  1. If request's mode is not "no-cors", then return + true.

    + +

  2. If request's client is null, then return true.

    + +

  3. If request's client's + policy container's + embedder policy's value is not + "credentialless", then return true.

    + +

  4. If request's origin is same origin with + request's current URL's origin and + request's tainted origin flag is not set, then return true.

    + +

  5. Return false.

    +
+

Responses

@@ -2023,6 +2044,9 @@ initially unset. being provided to an API that didn't make a range request. See the flag's usage for a detailed description of the attack. +

A response has an associated request-includes-credentials +(a boolean), which is initially true. +

A response has an associated timing allow passed flag, which is initially unset. @@ -3524,7 +3548,7 @@ Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-or

  • If the cross-origin resource policy internal check with origin, - "unsafe-none", response, and + "unsafe-none", response, and forNavigation returns blocked, then return blocked.

    This step is needed because we don't want to report violations not related to @@ -3559,7 +3583,7 @@ Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-or

    1. If forNavigation is true and embedderPolicyValue is - "unsafe-none", then return allowed. + "unsafe-none", then return allowed.

    2. Let policy be the result of getting @@ -3568,16 +3592,33 @@ Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-or

      This means that `Cross-Origin-Resource-Policy: same-site, same-origin` ends up as allowed below as it will never match anything, as long as - embedderPolicyValue is "unsafe-none". + embedderPolicyValue is "unsafe-none". Two or more `Cross-Origin-Resource-Policy` headers will have the same effect.

    3. If policy is neither `same-origin`, `same-site`, nor `cross-origin`, then set policy to null. -

    4. If policy is null and embedderPolicyValue is - "require-corp", then set policy to - `same-origin`. +

    5. +

      If policy is null, then switch on embedderPolicyValue:

      + +
      +
      "unsafe-none" +

      Do nothing. + +

      "credentialless" +
      +

      Set policy to `same-origin` if: + +

      + +
      "require-corp" +

      Set policy to `same-origin`. +

      +

    6. Switch on policy: @@ -4729,6 +4770,9 @@ steps. They return a response.

      is true; otherwise false. +

    7. If Cross-Origin-Embedder-Policy allows credentials with request returns + false, then set includeCredentials to false. +

    8. Let contentLength be httpRequest's body's length, if httpRequest's body is non-null; otherwise null. @@ -5095,6 +5139,9 @@ steps. They return a response.

    9. If httpRequest's header list contains `Range`, then set response's range-requested flag. +

    10. Set response's request-includes-credentials to + includeCredentials. +

    11. If response's status is 401, httpRequest's response tainting is not "cors", includeCredentials is @@ -7959,6 +8006,7 @@ Arkadiusz Michalski, Arne Johannessen, Artem Skoretskiy, Arthur Barstow, +Arthur Sonzogni, Asanka Herath, Axel Rauschmayer, Ben Kelly,