Specify the behavior of `COEP: credentialless`, #1229

ArthurSonzogni · 2021-05-03T16:46:24Z

Originally described in: https://github.com/mikewest/credentiallessness

credentialless and require-corp are similar. One or the other is a requirements for the window.crossOriginIsolated capability.
They differ mostly in the fetch specification. require-corp requires a CORP header for cross-origin no-cors responses. credentialless doesn't, but omits credentials (Cookies, clients certificates, etc...) in the request.

HTML (Add credentialless value to COEP (HTML spec) html#6638)
- Define how to parse the credentialless value.
- From the HTML spec point of view, credentialless and require-corp are equivalent. They have been grouped into compatible with cross-origin isolation and the HTML spec rewritten to use this concept.
Fetch: (Specify the behavior of COEP: credentialless, #1229)
- Define Cross-Origin-Embedder-Policy allows credentials algorithm. It omit credentials for no-cors, cross-origin, COEP:credentialless requests.
- Define response's request-include-credentials flag.
- In the Cross-Origin-Resource-Policy check, if embedderPolicy is credentialless, require CORP for navigational responses, and opaque responses with request-include-credentials.

See: whatwg/html#6637

At least two implementers are interested (and none opposed):
- Chrome: https://chromestatus.com/feature/4918234241302528#details
- Firefox: COEP: credentialless mozilla/standards-positions#539 (worth prototyping)
- Safari: https://lists.webkit.org/pipermail/webkit-dev/2021-June/031898.html (pending)
Tests are written and can be reviewed and commented upon at:
- https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless
Implementation bugs are filed:
- Chrome: https://crbug.com/1175099
- Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1731778
- Safari: https://bugs.webkit.org/show_bug.cgi?id=230550

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

ArthurSonzogni · 2021-05-03T16:55:39Z

This is still work in progress.
I still need write PR for ServiceWorker. Happy to get early feedback if you have nevertheless.

@whatwg/cross-origin-isolation @antosart @iVanlIsh

ArthurSonzogni · 2021-06-07T13:31:18Z

I wrote page gathering the two PR in a single page if you want to have a broader view:
https://htmlpreview.github.io/?https://github.com/mikewest/credentiallessness/blob/master/index.html

Would you have some suggestion?

The warning I have:

LINK ERROR: No 'dfn' refs found for 'credentialless'.
&lt;a data-link-for="embedder policy value" data-link-type="dfn" data-lt="credentialless">credentialless&lt;/a>

will be resolved when landing the HTML PR.

fetch.bs

yutakahirano · 2021-06-09T12:27:01Z

Don't you want to compare request's current URL's origin and request's origin, rather than request's origin and request's client's origin?

ArthurSonzogni · 2021-06-09T14:07:02Z

Don't you want to compare request's current URL's origin and request's origin, rather than request's origin and request's client's origin?

Yes, this should be the current URL instead of the URL. Fixed in "Address Yutaka comment #2"
However the second origin should continue to be the client's origin. For instance, in the base case of a cross-origin no-cors request with no redirects, credentials must not be included. So the comparison is in between the client's origin and the request's current URL.

yutakahirano · 2021-06-10T10:05:54Z

However the second origin should continue to be the client's origin. For instance, in the base case of a cross-origin no-cors request with no redirects, credentials must not be included. So the comparison is in between the client's origin and the request's current URL.

Sorry, can you give me an example? request's origin and request's client's origin are usually the same, but other checks such as CORS use request's origin, so I want to understand why in this case we need to use the client's origin.

ArthurSonzogni · 2021-06-10T13:49:54Z

What is the main difference in between request's origin and request's client's origin?

Do you foresee a case where the difference matter for COEP:credentialless?

yutakahirano · 2021-06-10T15:05:54Z

What is the main difference in between request's origin and request's client's origin?

For example, process a nativate fetch manually sets request's origin (step 4.1).

Do you foresee a case where the difference matter for COEP:credentialless?

Regarding this algorithm, no. For requests with mode: "no-cors", I believe they match. In any case, request's origin is the source of truth for other checks, so using it here is better for consistency.

ArthurSonzogni · 2021-06-14T13:57:52Z

Regarding this algorithm, no. For requests with mode: "no-cors", I believe they match. In any case, request's origin is the source of truth for other checks, so using it here is better for consistency.

Thanks! I addressed this in 9f0be6a.

fetch.bs

ArthurSonzogni

Thanks Yutaka,
I addressed your 3 comments in the latest commit.

fetch.bs

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug:1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2

annevk · 2021-09-21T10:07:18Z

From CI it seems like this needs rebasing or at least some modernizing as embedder policy is now part of policy container.

(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637

ArthurSonzogni · 2021-09-21T12:34:47Z

I rebased over PolicyContainer. See the latest patchset for the difference.
As a result, this error disapeared:

LINK ERROR: No 'dfn' refs found for 'embedder policy' with for='['environment settings object']'.

However, this would still require the HTML specification to land, in order to understand the credentialless value:

LINK ERROR: No 'dfn' refs found for 'credentialless'.

(I double checked there was no other LINK error beside this one, by replacing credentialless occurence with require-corp and checking this was correctly linking)

annevk

Modulo nits this looks okay to me.

fetch.bs

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <[email protected]> Commit-Queue: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#923884}

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <[email protected]> Commit-Queue: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#923884}

…r., a=testonly Automatic update from web-platform-tests [credentialless] Update redirect behavior. In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <[email protected]> Commit-Queue: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#923884} -- wpt-commits: 2d6d77b3054e9b7f35bdd2b3e7de9b53ecfed7d5 wpt-pr: 30871

Define COEP:credentialless Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in the request. * HTML (whatwg#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with cross-origin isolation` and the HTML spec rewritten to use this concept. * Fetch: (whatwg/fetch#1229) * Define `Cross-Origin-Embedder-Policy allows credentials` algorithm. It omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Define `response's` `request-include-credentials` flag. * In the `Cross-Origin-Resource-Policy check`, if `embedderPolicy` is `credentialless`, require CORP for navigational responses, and opaque responses with `request-include-credentials`. See: whatwg#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: mozilla/standards-positions#539 (worth prototyping) * Safari: https://lists.webkit.org/pipermail/webkit-dev/2021-June/031898.html (pending) - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless - [X] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1731778 * Safari: https://bugs.webkit.org/show_bug.cgi?id=230550 (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.)

fetch.bs

ArthurSonzogni

Thanks! @domenic, I addressed your last comments.

fetch.bs

This defines Cross-Origin-Embedder-Policy: credentialless. The credentialless and require-corp values are similar. One or the other is a requirements for the cross-origin isolated capability. They differ mostly in terms of fetching. require-corp requires a Cross-Origin-Resource-Policy header for cross-origin opaque responses. credentialless doesn't, but omits credentials (cookies, client certificates, etc.) in cross-origin "no-cors" requests. See https://github.com/WICG/credentiallessness for additional context. Fetch PR: whatwg/fetch#1229. Tests: WPT html/cross-origin-embedder-policy/credentialless. Closes #6637.

annevk · 2021-11-02T13:26:30Z

This can land tomorrow once HTML has been indexed by Shepherd. Note that I made a couple last minute changes, but they are all editorial.

annevk · 2021-11-03T07:56:08Z

It seems Shepherd has not run. (At least, as far as I can tell HTML was updated and the new term followed an existing pattern that does work and having checked all those things again I cannot find any errors.) @tabatkins @plinss, is that known?

plinss · 2021-11-03T16:05:56Z

Shepherd has been blocked for the last 18 hours or so, it just ran. The last version of fetch it scanned was published on 2021-11-01 01:32:23 PDT

annevk · 2021-11-03T16:28:05Z

Thanks @plinss!

annevk · 2021-11-03T16:28:49Z

And thanks @ArthurSonzogni for the work on the PR, of course! And @domenic and @yutakahirano for the reviews! 😊

ArthurSonzogni · 2021-11-03T22:41:29Z

Awesome! 🚀
Thanks @annevk, @domenic, @yutakahirano for the reviews!
I learnt a lot from you.

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <[email protected]> Commit-Queue: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#923884}

This defines Cross-Origin-Embedder-Policy: credentialless. The credentialless and require-corp values are similar. One or the other is a requirements for the cross-origin isolated capability. They differ mostly in terms of fetching. require-corp requires a Cross-Origin-Resource-Policy header for cross-origin opaque responses. credentialless doesn't, but omits credentials (cookies, client certificates, etc.) in cross-origin "no-cors" requests. See https://github.com/WICG/credentiallessness for additional context. Fetch PR: whatwg/fetch#1229. Tests: WPT html/cross-origin-embedder-policy/credentialless. Closes whatwg#6637.

In the Fetch specification PR, we changed our mind and decided to omit credentials as soon as there at least one cross-origin request. Previously, only the current URL was taken into account. See: whatwg/fetch#1229 (comment) Bug: 1175099 Change-Id: I308281bdab95be264ca7a2ef990341bddd0e9bc2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168346 Reviewed-by: Yutaka Hirano <[email protected]> Commit-Queue: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#923884} NOKEYCHECK=True GitOrigin-RevId: 640ff1a8149d911069c5b77ca9c0883abba2e9d3

ArthurSonzogni force-pushed the coep-credentialless branch from f60b8b4 to 43d078a Compare May 4, 2021 09:09

ArthurSonzogni mentioned this pull request May 4, 2021

Add credentialless value to COEP (HTML spec) whatwg/html#6638

Merged

3 tasks

ArthurSonzogni force-pushed the coep-credentialless branch from 43d078a to 40674cd Compare May 4, 2021 11:14

ArthurSonzogni mentioned this pull request May 15, 2021

CacheStorage & COEP:credentialless w3c/ServiceWorker#1592

Closed

ArthurSonzogni force-pushed the coep-credentialless branch 2 times, most recently from 2b03205 to 6b301ae Compare May 30, 2021 16:15

yutakahirano reviewed Jun 9, 2021

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

yutakahirano reviewed Jun 15, 2021

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

ArthurSonzogni commented Jun 17, 2021

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

yutakahirano approved these changes Jun 17, 2021

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

annevk reviewed Sep 14, 2021

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

chromium-wpt-export-bot mentioned this pull request Sep 20, 2021

[credentialless] Update redirect behavior. web-platform-tests/wpt#30871

Merged

ArthurSonzogni added 8 commits September 21, 2021 14:19

Remove ambiguity in the switch.

c95a1e5

Fix the CORP check.

ab4c380

Address Yutaka comment (invert same-origin check)

55c97fa

Address Yutaka comment whatwg#2

4a1c72d

Address Yutaka comment.

5c90294

Verify & fix newlines.

4d8cb48

Address Yutaka comments whatwg#4.

a7b9b13

Rebase over PolicyContainter

3c48686

ArthurSonzogni force-pushed the coep-credentialless branch from 8a974e2 to 3c48686 Compare September 21, 2021 12:30

annevk reviewed Sep 22, 2021

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

Address annevk@ nits.

89aaca1

domenic reviewed Nov 1, 2021

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

Address domenic comments.

63cbf56

ArthurSonzogni commented Nov 1, 2021

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

alotta nits

3eb0723

one more nit

60a8cf1

annevk merged commit 0613515 into whatwg:main Nov 3, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Specify the behavior of `COEP: credentialless`, #1229

Specify the behavior of `COEP: credentialless`, #1229

ArthurSonzogni commented May 3, 2021 •

edited by pr-preview bot

Loading

ArthurSonzogni commented May 3, 2021

ArthurSonzogni commented Jun 7, 2021

yutakahirano commented Jun 9, 2021

ArthurSonzogni commented Jun 9, 2021

yutakahirano commented Jun 10, 2021

ArthurSonzogni commented Jun 10, 2021 •

edited

Loading

yutakahirano commented Jun 10, 2021

ArthurSonzogni commented Jun 14, 2021

ArthurSonzogni left a comment

annevk commented Sep 21, 2021

ArthurSonzogni commented Sep 21, 2021

annevk left a comment

ArthurSonzogni left a comment

annevk commented Nov 2, 2021 •

edited

Loading

annevk commented Nov 3, 2021

plinss commented Nov 3, 2021

annevk commented Nov 3, 2021

annevk commented Nov 3, 2021

ArthurSonzogni commented Nov 3, 2021

Specify the behavior of COEP: credentialless, #1229

Specify the behavior of COEP: credentialless, #1229

Conversation

ArthurSonzogni commented May 3, 2021 • edited by pr-preview bot Loading

ArthurSonzogni commented May 3, 2021

ArthurSonzogni commented Jun 7, 2021

yutakahirano commented Jun 9, 2021

ArthurSonzogni commented Jun 9, 2021

yutakahirano commented Jun 10, 2021

ArthurSonzogni commented Jun 10, 2021 • edited Loading

yutakahirano commented Jun 10, 2021

ArthurSonzogni commented Jun 14, 2021

ArthurSonzogni left a comment

Choose a reason for hiding this comment

annevk commented Sep 21, 2021

ArthurSonzogni commented Sep 21, 2021

annevk left a comment

Choose a reason for hiding this comment

ArthurSonzogni left a comment

Choose a reason for hiding this comment

annevk commented Nov 2, 2021 • edited Loading

annevk commented Nov 3, 2021

plinss commented Nov 3, 2021

annevk commented Nov 3, 2021

annevk commented Nov 3, 2021

ArthurSonzogni commented Nov 3, 2021

Specify the behavior of `COEP: credentialless`, #1229

Specify the behavior of `COEP: credentialless`, #1229

ArthurSonzogni commented May 3, 2021 •

edited by pr-preview bot

Loading

ArthurSonzogni commented Jun 10, 2021 •

edited

Loading

annevk commented Nov 2, 2021 •

edited

Loading