diff --git a/source b/source index 97abc1f8269..62a4771dff2 100644 --- a/source +++ b/source @@ -9136,8 +9136,7 @@ partial interface Document { which is a module map, initially empty.

The Document has a cross-origin opener - policy, which is a cross-origin opener policy, initially "unsafe-none".

+ policy, which is a cross-origin opener policy.

The DocumentOrShadowRoot interface

@@ -77316,6 +77315,17 @@ popup4.close(); data-x="navigation-hh">historyHandling set to "replace".

+

A browsing context has a virtual + browsing context group ID integer. It is initially 0. This is used by cross-origin opener policy reporting, to keep track + of the browsing context group switches that would have happened if the report-only policy had been + enforced.

+ +

A browsing context has an initial + URL, which is a URL or null. It is initially null.

+ +

A browsing context has an opener origin at + creation, which is an origin or null. It is initially null.

Creating browsing contexts

@@ -77395,9 +77405,12 @@ popup4.close();

  • If creator is non-null, then set browsingContext's creator origin to return creator's origin, browsingContext's creator URL to return - creator's URL, and + creator's URL, browsingContext's creator base URL to return creator's base URL.

    • + data-x="document base URL">base URL, and browsingContext's virtual browsing context group ID to + creator's top-level browsing context's virtual browsing context group ID.

  • Let sandboxFlags be the result of determining the creation sandboxing flags given browsingContext and embedder.

    • @@ -77446,7 +77459,7 @@ popup4.close(); settings object">setting up a window environment settings object with realm execution context, null, topLevelCreationURL, and topLevelOrigin.

    -

  • Let coop be "unsafe-none".

    • +

  • Let coop be a new cross-origin opener policy.

  • If creator is non-null and creator's origin is same origin with creator's relevant settings object's @@ -77522,6 +77535,15 @@ popup4.close();

  • Set browsingContext's opener browsing context to opener.

    • +

  • Set browsingContext's virtual + browsing context group ID to opener's top-level browsing context's + virtual browsing context group + ID.

    • + +

  • Set browsingContext's opener origin at + creation to opener's active document's + origin.

    • +

  • Legacy-clone a browsing session storage shed with opener's browsing session and browsingContext's browsing session.

    If current's top-level browsing context's active - document's cross-origin opener policy is - "same-origin" or "same-origin-plus-COEP", then:

    + document's cross-origin opener policy's + value is "same-origin" or "same-origin-plus-COEP", then:

    1. Let currentDocument be current's active @@ -78488,8 +78511,16 @@ console.assert(iframeWindow.frameElement === null); { [[Property]]: "postMessage" } ยป.

    -

    Indexed properties do not need to be safelisted as they are handled directly by - the WindowProxy object.

    +

    Indexed properties do not need to be safelisted in this algorithm, as they are + handled directly by the WindowProxy object.

    + +

    A JavaScript property name P is a cross-origin accessible window property + name if it is "window", "self", "location", "close", "closed", + "focus", "blur", "frames", + "length", "top", "opener", + "parent", "postMessage", or an array index + property name.

    CrossOriginPropertyFallback ( P )
    @@ -79899,6 +79930,12 @@ interface BarProp { [[Window]] internal slot of this.

    • +

  • Check if an access between two browsing contexts + should be reported, given the current global object's + browsing context, W's browsing context, P, and the current settings + object.

    • +

  • If ! IsPlatformObjectSameOrigin(W) is true, then return ? OrdinaryGet(this, P, Receiver).

    • @@ -79917,6 +79954,11 @@ interface BarProp { [[Window]] internal slot of this.

    +

  • Check if an access between two browsing contexts + should be reported, given the current global object's browsing + context, W's browsing context, P, + and the current settings object.

    • +

  • If ! IsPlatformObjectSameOrigin(W) is true, then return ? OrdinarySet(this, P, V, Receiver).

    • @@ -80883,10 +80925,10 @@ interface BarProp {

    Cross-origin opener policies

    -

    A cross-origin opener policy allows a document which is navigated to in a +

    A cross-origin opener policy value allows a document which is navigated to in a top-level browsing context to force the creation of a new top-level browsing - context, and a corresponding group. It has one of the - following values:

    + context, and a corresponding group. The possible values + are:

    "unsafe-none"
    @@ -80923,10 +80965,28 @@ interface BarProp {
    -

    To match cross-origin opener policies, given a - cross-origin opener policy A, an origin originA, a - cross-origin opener policy B, and an origin - originB:

    +

    A cross-origin opener policy consists of:

    + + + +

    To match cross-origin opener policy values, given a + cross-origin opener policy value A, an origin + originA, a cross-origin opener policy value B, and an + origin originB:

    1. If A is "unsafe-none" and B @@ -80941,19 +81001,21 @@ interface BarProp {

    2. Return false.

    -

    The `Cross-Origin-Opener-Policy` - header

    +

    The headers

    A Document's cross-origin opener policy is derived from the `Cross-Origin-Opener-Policy` HTTP response header. - This header is a structured header whose value must - be a token.

    - -

    The valid token values are "unsafe-none", "same-origin-allow-popups", and "same-origin".

    + data-x="http-cross-origin-opener-policy">Cross-Origin-Opener-Policy` and the `Cross-Origin-Opener-Policy-Report-Only` + HTTP response headers. These headers are structured + headers whose value must be a token. +

    + +

    The valid token values are the opener policy values. The token may also have + attached parameters; of these, the "report-to" parameter can have a valid URL + string identifying an appropriate reporting endpoint.

    Per the processing model described below, user agents will ignore this header if it contains an invalid value. Likewise, user agents will ignore this header if the value cannot be @@ -80966,66 +81028,216 @@ interface BarProp { reservedEnvironment:

      +

    1. Let policy be a new cross-origin opener policy.

      2. +

    2. If reservedEnvironment is a non-secure context, then return - "unsafe-none".

      3. + policy.

    3. Let value be the result of getting a structured field value given `Cross-Origin-Opener-Policy` and "item" from response's header list.

      4. -

    4. If value is null, then return "unsafe-none".

      5. +
    5. +

      If parsedItem is not null, then:

      -

    6. If value[0] is not "same-origin" or - "same-origin-allow-popups", then return - "unsafe-none".

      7. +
        +
      1. +

        If parsedItem[0] is "same-origin", then:

        + +
          +

        1. Let coep be the result of obtaining a cross-origin embedder policy from response.

          2. + +

        2. If coep's value is "require-corp", then set policy's value to "same-origin-plus-COEP".

          3. + +

        3. Otherwise, set policy's value to "same-origin".

          4. +
        +
        2. + +

      2. If parsedItem[0] is "same-origin-allow-popups", then set + policy's value to "same-origin-allow-popups".

        3. + +

      3. If parsedItem[1]["report-to"] exists and it is a string, then set policy's reporting endpoint to + parsedItem[1]["report-to"].

        4. +
      + + +

    7. Set parsedItem to the result of getting a structured field value + given `Cross-Origin-Opener-Policy-Report-Only` and + "item" from response's header list.

    8. -

      If value[0] is "same-origin", then:

      +

      If parsedItem is not null, then:

        -

      1. Let coep be the result of obtaining - an embedder policy from response.

        2. +
      2. +

        If parsedItem[0] is "same-origin", then:

        -

      3. If coep's value is - "require-corp", then return "same-origin-plus-COEP".

        4. +
          +

        1. Let coep be the result of obtaining a cross-origin embedder policy from response.

          2. + +
        2. +

          If coep's value is "require-corp" or coep's report-only value is "require-corp", then set policy's report-only value to "same-origin-plus-COEP".

          + +

          Report only COOP also considers report-only COEP to assign the special + "same-origin-plus-COEP" value. This allows + developers more freedom in the order of deployment of COOP and COEP.

          +
          3. + +

        3. Otherwise, set policy's report-only value to "same-origin".

          4. +
        + + +

      4. If parsedItem[0] is "same-origin-allow-popups", then set + policy's report-only value to + "same-origin-allow-popups".

        5. + +

      5. If parsedItem[1]["report-to"] exists and it is a string, then set policy's report-only reporting endpoint to + parsedItem[1]["report-to"].

      9. -

    9. Return value[0].

      10. +

    10. Return policy.

    +

    Browsing context group switches due to cross-origin opener policy

    +

    To check if COOP values require + a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin, + activeDocumentNavigationOrigin, and two cross-origin + opener policy values responseCOOPValue and activeDocumentCOOPValue:

    + +
      +

    1. If the result of matching + activeDocumentCOOPValue, activeDocumentNavigationOrigin, + responseCOOPValue, and responseOrigin is true, return + false.

      2. + +
    2. +

      If all of the following are true:

      + +
        +

      • isInitialAboutBlank,

        • + +

      • activeDocumentCOOPValue's value is + "same-origin-allow-popups".

        • + +

      • responseCOOPValue is "unsafe-none",

        • +
      + +

      then return false.

      +
      3. + +

    3. Return true.

      +
    + +

    To check if enforcing report-only COOP + would require a browsing context group switch, given a boolean + isInitialAboutBlank, two origins + responseOrigin, activeDocumentNavigationOrigin, and two cross-origin opener policies responseCOOP + and activeDocumentCOOP:

    + +
      +
    1. +

      If the result of checking if + COOP values require a browsing context group switch given isInitialAboutBlank, + sandboxFlags, responseOrigin, activeDocumentNavigationOrigin, + responseCOOP's report-only value + and activeDocumentCOOPReportOnly's report-only value is false, then return false.

      + +

      Matching report-only policies allows a website to specify the same report-only + cross-origin opener policy on all its pages and not receive violation reports for navigations + between these pages.

      +
      2. + +

    2. If the result of checking if + COOP values require a browsing context group switch given isInitialAboutBlank, + sandboxFlags, responseOrigin, activeDocumentNavigationOrigin, + responseCOOP's value and + activeDocumentCOOPReportOnly's report-only value is true, then return true.

      3. + +

    3. If the result of checking if + COOP values require a browsing context group switch given isInitialAboutBlank, + sandboxFlags, responseOrigin, activeDocumentNavigationOrigin, + responseCOOP's report-only value + and activeDocumentCOOPReportOnly's value is + true, then return true.

      4. + +

    4. Return false.

      5. +
    +

    A cross-origin opener policy enforcement result is a struct with the following items:

    To enforce a response's cross-origin opener policy, given a - browsing context browsingContext, an origin - responseOrigin, a cross-origin opener policy responseCOOP, and - a cross-origin opener policy enforcement result - currentCOOPEnforcementResult:

    + browsing context browsingContext, a URL + responseURL, an origin responseOrigin, a cross-origin + opener policy responseCOOP, a cross-origin + opener policy enforcement result currentCOOPEnforcementResult, and a referrer referrer:

    1. Let newCOOPEnforcementResult be a new cross-origin opener policy enforcement result whose needs a browsing context group switch is currentCOOPEnforcementResult's needs a - browsing context group switch, origin is - responseOrigin, and cross-origin opener - policy is responseCOOP.

      2. + browsing context group switch, would need a browsing context group switch due + to report-only is currentCOOPEnforcementResult's would need a browsing context group switch due + to report-only, url is responseURL, + origin is responseOrigin, + coop is responseCOOP, and + current context is navigation source is + true.

    2. Let isInitialAboutBlank be false.

      3. @@ -81034,49 +81246,121 @@ interface BarProp { created, then set isInitialAboutBlank to true.

      -

    3. If the result of matching - currentCOOPEnforcementResult's cross-origin opener policy, - currentCOOPEnforcementResult's origin, - responseCOOP, and responseOrigin is true, then return - newCOOPEnforcementResult.

      4. +

    4. If isInitialAboutBlank is true and browsingContext's initial URL is null, set + browsingContext's initial URL to + responseURL.

    5. -

      If all of the following are true:

      - -
        -

      • isInitialAboutBlank

        • +

        If the result of checking if + COOP values require a browsing context group switch given isInitialAboutBlank, + currentCOOPEnforcementResult's cross-origin + opener policy's value, + currentCOOPEnforcementResult's origin, + responseCOOP's value, and + responseOrigin is true, then:

        -

      • currentCOOPEnforcementResult's cross-origin opener policy is "same-origin-allow-popups"

        • +
          +

        1. Set newCOOPEnforcementResult's needs a browsing context group switch to + true.

          2. -

        2. responseCOOP is "unsafe-none"

          3. -
      +
    6. +

      If browsingContext's group's browsing + context set's size is greater than 1, then:

      -

      then return newCOOPEnforcementResult.

      +
        +

      1. Queue a violation report for browsing + context group switch when navigating to a COOP response with responseCOOP, + "enforce", responseURL, + currentCOOPEnforcementResult's url, + currentCOOPEnforcementResult's origin, responseOrigin, and + referrer.

        2. + +

      2. Queue a violation report for browsing + context group switch when navigating away from a COOP response with + activeDocumentCOOP, "enforce", + currentCOOPEnforcementResult's url, + responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and + currentCOOPEnforcementResult's current + context is navigation source.

        3. +
      +
      7. +
    -

  • Set newCOOPEnforcementResult's needs - a browsing context group switch to true.

    • +
  • +

    If the result of checking if + enforcing report-only COOP would require a browsing context group switch given + isInitialAboutBlank, responseOrigin, + currentCOOPEnforcementResult's origin, + responseCOOP, and currentCOOPEnforcementResult's cross-origin opener policy, is true, then:

    + +
      +

    1. Set result's would + need a browsing context group switch due to report-only to true.

      2. + +
    2. +

      If browsingContext's group's browsing + context set's size is greater than 1, then:

      + +
        +

      1. Queue a violation report for browsing context group switch + when navigating to a COOP response with responseCOOP, "reporting", responseURL, + currentCOOPEnforcementResult's url, + currentCOOPEnforcementResult's origin, + responseOrigin,and referrer.

        2. + +

      2. Queue a violation report for browsing + context group switch when navigating away from a COOP response with + activeDocumentCOOP, "reporting", + currentCOOPEnforcementResult's url, + responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and + currentCOOPEnforcementResult's current + context is navigation source.

        3. +
      +
      3. +
    +

  • Return newCOOPEnforcementResult.

    • To obtain a browsing context to use for a - navigation response, given a browsing context - browsingContext, a sandboxing flag set sandboxFlags, and a - cross-origin opener policy navigationCOOP:

    + navigation response, given a browsing contexts + browsingContext, a sandboxing flag set sandboxFlags, a + cross-origin opener policy navigationCOOP, and a cross-origin opener policy enforcement result + coopEnforcementResult:

    1. Assert: browsingContext is a top-level browsing context.

      2. +
    2. +

      If coopEnforcementResult's needs a + browsing context group switch is false, then:

      + +
        +

      1. If coopEnforcementResult's would need a browsing context group switch due + to report-only is true, set browsing context's virtual browsing context group ID to a new + unique identifier.

        2. + +

      2. Return browsingContext.

        3. +
      +
      3. +

    3. Let newBrowsingContext be the result of creating a new top-level browsing context.

      4. -

    4. If navigationCOOP is "

      If navigationCOOP's value is "same-origin-plus-COEP", then set newBrowsingContext's group's cross-origin isolated to true.

      5. @@ -81084,8 +81368,8 @@ interface BarProp {

    5. If sandboxFlags is not empty, then:

        -

      1. Assert: navigationCOOP is "unsafe-none".

        2. +

      2. Assert navigationCOOP's value is + "unsafe-none".

      3. Assert: newBrowsingContext's popup sandboxing flag set is empty.

        4. @@ -81112,6 +81396,700 @@ interface BarProp { fully defined. It is currently under discussion in issue #5350.

        +

        Reporting

        + +

        An accessor-accessed relationship is an enum that describes the relationship between + two browsing contexts between which an access happened. It + can take the following values:

        + +
        +
        accessor is opener
        +

        The accessor browsing context or one of its ancestors is the opener browsing context of the accessed + browsing context's top-level browsing context.

        + +
        accessor is openee
        +

        The accessed browsing context or one of its ancestors is the opener browsing context of the accessor + browsing context's top-level browsing context.

        + +
        none
        +

        There is no opener relationship between the accessor browsing context, the + accessor browsing context, or any of their ancestors.

        +
        + +

        To check if an access between two browsing contexts + should be reported, given two browsing contexts + accessor and accessed, a JavaScript property name + P, and an environment settings object environment:

        + +
          +

        1. If P is not a cross-origin accessible window property name, then + return.

          2. + +
        2. +

          If accessor's active document's origin or any of its + ancestors' active document's origins are not same origin with ancestor's + top-level browsing context's active document's origin, or + if accessed's active document's origin or any of its ancestors' active document's origins are not same origin with accessed's + top-level browsing context's active document's origin, + then return.

          + +

          This avoids leaking information about cross-origin iframes to a top level frame + with cross-origin opener policy reporting

          +
          3. + +

        3. If accessor's top-level browsing context's virtual browsing context group ID is + accessed's top-level browsing context's virtual browsing context group ID, then + return.

          4. + +

        4. Let accessorAccessedRelationship be a new accessor-accessed + relationship with value none.

          5. + +

        5. If accessed's top-level browsing context's opener browsing + context is accessor or an ancestor of accessor, then set accessorAccessedRelationship to + accessor is opener.

          6. + +

        6. If accessor's top-level browsing context's opener browsing + context is accessed or an ancestor of accessed, then set accessorAccessedRelationship to + accessor is openee.

          7. + +

        7. Queue violation reports for accesses, given + accessorAccessedRelationship, accessor's top-level browsing + context's active document's cross-origin + opener policy, accessed's top-level browsing context's active + document's cross-origin opener policy, + accessor's active document's URL, + accessed's active document's URL, + accessor's top-level browsing context's initial URL, accessed's top-level + browsing context's initial URL, + accessor's active document's origin, accessed's + active document's origin, accessor's top-level browsing + context's opener origin at creation, + accessed's top-level browsing context's opener origin at creation, accessor's + top-level browsing context's active document's referrer, accessed's top-level browsing + context's active document's referrer, P, and + environment.

          8. + +
        + +

        To sanitize a URL to send in a report given a + URL url:

        + +
          +

        1. Let sanitizedURL be a copy of url.

          2. + +

        2. Set the username given sanitizedURL and + the empty string. + +

        3. Set the password given sanitizedURL and + the empty string. + +

        4. Return the serialization of + sanitizedURL with the exclude fragment flag set.

          5. +
        + +

        To queue a violation report for browsing context group + switch when navigating to a COOP response given a cross-origin opener policy coop, a string disposition, a + URL coopURL, a URL previousResponseURL, two origins coopOrigin and previousResponseOrigin, and a + referrer referrer:

        + +
          +

        1. If coop's reporting endpoint + is null, return.

          2. + +

        2. Let coopValue be coop's value.

          3. + +

        3. If disposition is "reporting", then set + coopValue to coop's report-only value.

          4. + +

        4. Let serializedReferrer be an empty string

          5. + +

        5. If referrer is a URL, set serializedReferrer to the + serialization of referrer. + +

        6. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          dispositiondisposition
          effectivePolicycoopValue
          previousResponseURLIf coopOrigin and previousResponseOrigin are same + origin this is the sanitization of + previousResponseURL, null otherwise.
          referrerserializedReferrer
          type"navigation-to-response"
          +
          7. + +

        7. Queue body as "coop" + for coop's reporting endpoint with + coopURL.

          8. +
        + +

        To queue a violation report for browsing context group + switch when navigating away from a COOP response given a cross-origin opener policy coop, a string disposition, a + URL coopURL, a URL nextResponseURL, two origins coopOrigin and nextResponseOrigin, and a boolean + isCOOPResponseNavigationSource:

        + +
          +

        1. If coop's reporting endpoint + is null, return.

          2. + +

        2. Let coopValue be coop's value.

          3. + +

        3. If disposition is "reporting", then set + coopValue to coop's report-only value.

          4. + +
        4. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          dispositiondisposition
          effectivePolicycoopValue
          nextResponseURLIf coopOrigin and nextResponseOrigin are same origin + or isCOOPResponseNavigationSource is true, this is the sanitization of previousResponseURL, null + otherwise.
          type"navigation-to-response"
          +
          5. + +

        5. Queue body as "coop" + for coop's reporting endpoint with + coopURL.

          6. +
        + +

        To queue violation reports for accesses, given an + accessor-accessed relationship accessorAccessedRelationship, two + cross-origin opener policies + accessorCOOP and accessedCOOP, four URLs + accessorURL, accessedURL, accessorInitialURL, + accessedInitialURL, four origins + accessorOrigin, accessedOrigin, accessorCreatorOrigin and + accessedCreatorOrigin, two referrers + accessorReferrer and accessedReferrer, a string propertyName, and + an environment settings object environment:

        + +
          +

        1. If coop's reporting endpoint + is null, return.

          2. + +

        2. Let coopValue be coop's value.

          3. + +

        3. If disposition is "reporting", then set + coopValue to coop's report-only value.

          4. + +
        4. +

          If accessorAccessedRelationship is accessor is opener:

          + +
            +

          1. Queue a violation report + for access to an opened window, given accessorCOOP, accessorURL, + accessedURL, accessedInitialURL, accessorOrigin, + accessedOrigin, accessedCreatorOrigin, propertyName, + and environment.

            2. + +

          2. Queue a violation report for access + from the opener, given accessedCOOP, accessedURL, + accessorURL, accessedOrigin, accessorOrigin, + propertyName, and accessedReferrer.

            3. +
          +
          5. + +
        5. +

          Otherwise, if accessorAccessedRelationship is accessor is openee:

          + +
            +

          1. Queue a violation report for access to + the opener, given accessorCOOP, accessorURL, + accessedURL, accessorOrigin, accessedOrigin, + propertyName, accessorReferrer, and environment.

            2. + +

          2. Queue a violation report for access + from an opened window, given accessedCOOP, accessedURL, + accessorURL, accessorInitialURL, accessedOrigin, + accessorOrigin, accessorCreatorOrigin, and + propertyName.

            3. +
          +
          6. + +
        6. +

          Otherwise:

          + +
            +

          1. Queue a violation report for + access to another window, given accessorCOOP, accessorURL, + accessedURL, accessorOrigin, accessedOrigin, + propertyName, and environment

            2. + +

          2. Queue a violation report for + access from another window, given accessedCOOP, accessedURL, + accessorURL, accessedOrigin, accessorOrigin, and + propertyName.

            3. +
          +
          7. +
        + +

        To queue a violation report for access to the + opener, given a cross-origin opener + policy coop, two URLs coopURL and + openerURL, two origins coopOrigin and + openerOrigin, a string propertyName, a referrer referrer, and an environment + settings object environment:

        + +
          +

        1. Let sourceFile, lineNumber and columnNumber be the + relevant script URL and problematic position which triggered this report.

          2. + +

        2. Let serializedReferrer be an empty string

          3. + +

        3. If referrer is a URL, set serializedReferrer to the + serialization of referrer. + +

        4. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoop's report-only + value
          propertypropertyName
          openerURLIf coopOrigin and openerOrigin are same origin, this + is the sanitization of openerURL, null + otherwise.
          referrerserializedReferrer
          sourceFilesourceFile
          lineNumberlineNumber
          columnNumbercolumnNumber
          type"access-to-opener"
          +
          5. + +

        5. Queue body as "coop" + for coop's reporting endpoint with + coopURL and environment.

          6. +
        + +

        To queue a violation report for access to an + opened window, given a cross-origin opener + policy coop, three URLs coopURL, + openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and + openerInitialOrigin,a string propertyName, and an environment settings + object environment:

        + +
          +

        1. Let sourceFile, lineNumber and columnNumber be the + relevant script URL and problematic position which triggered this report.

          2. + +
        2. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoop's report-only + value
          propertypropertyName
          openedWindowURLIf coopOrigin and openedWindowOrigin are same origin, this + is the sanitization of openedWindowURL, + null otherwise.
          openedWindowInitialURLIf coopOrigin and openerInitialOrigin are same origin, + this is the sanitization of + initialWindowURL, null otherwise.
          sourceFilesourceFile
          lineNumberlineNumber
          columnNumbercolumnNumber
          type"access-to-opener"
          +
          3. + +

        3. Queue body as "coop" + for coop's reporting endpoint with + coopURL and environment.

          4. +
        + + +

        To queue a violation report for access to another + window, given a cross-origin opener policy + coop, two URLs coopURL and + otherURL, two origins coopOrigin and + otherOrigin, a string propertyName, and an environment settings + object environment:

        + +
          +

        1. Let sourceFile, lineNumber and columnNumber be the + relevant script URL and problematic position which triggered this report.

          2. + +
        2. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoop's report-only + value
          propertypropertyName
          otherURLIf coopOrigin and otherOrigin are same origin, this + is the sanitization of otherURL, null + otherwise.
          sourceFilesourceFile
          lineNumberlineNumber
          columnNumbercolumnNumber
          type"access-to-opener"
          +
          3. + +

        3. Queue body as "coop" + for coop's reporting endpoint with + coopURL and environment.

          4. +
        + +

        To queue a violation report for access from the + opener, given a cross-origin opener policy + coop, two URLs coopURL and + openerURL, two origins coopOrigin and + openerOrigin, a string propertyName, and a referrer referrer:

        + +
          +

        1. If coop's reporting endpoint + is null, return.

          2. + +

        2. Let serializedReferrer be an empty string

          3. + +

        3. If referrer is a URL, set serializedReferrer to the + serialization of referrer. + +

        4. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoop's report-only + value
          propertypropertyName
          openerURLIf coopOrigin and openerOrigin are same origin, this + is the sanitization of openerURL, null + otherwise.
          referrerserializedReferrer
          type"access-to-opener"
          +
          5. + +

        5. Queue body as "coop" + for coop's reporting endpoint with + coopURL.

          6. +
        + +

        To queue a violation report for access from an + opened window, given a cross-origin opener + policy coop, three URLs coopURL, + openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and + openerInitialOrigin, and a string propertyName:

        + +
          +

        1. If coop's reporting endpoint + is null, return.

          2. + +
        2. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoopValue
          propertycoop's report-only + value
          openedWindowURLIf coopOrigin and openedWindowOrigin are same origin, this + is the sanitization of openedWindowURL, + null otherwise.
          openedWindowInitialURLIf coopOrigin and openerInitialOrigin are same origin, + this is the sanitization of + initialWindowURL, null otherwise.
          type"access-to-opener"
          +
          3. + +

        3. Queue body as "coop" + for coop's reporting endpoint with + coopURL.

          4. +
        + + +

        To queue a violation report for access from another + window, given a cross-origin opener policy + coop, two URLs coopURL and otherURL, two + origins coopOrigin and otherOrigin, and a string + propertyName:

        + +
          +

        1. If coop's reporting endpoint + is null, return.

          2. + +
        2. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoop's report-only + value
          propertypropertyName
          otherURLIf coopOrigin and otherOrigin are same origin, this + is the sanitization of otherURL, null + otherwise.
          typeaccess-to-opener
          +
          3. + +

        3. Queue body as "coop" + for coop's reporting endpoint with + coopURL.

          4. +

        Cross-origin embedder policies

        @@ -81257,12 +82235,12 @@ interface BarProp { data-x="">require-corp        ":

          -

        1. Set policy's report only +

        2. Set policy's report-only value to "require-corp".

          3. .

        3. If parsedItem[1]["report-to"] exists, then set policy's report only reporting endpoint + data-x="embedder-policy-report-only-reporting-endpoint">report-only reporting endpoint to parsedItem[1]["report-to"].

        @@ -81287,7 +82265,7 @@ interface BarProp { data-x="bc-container-document">container document's embedder policy.

        -

      4. If parentPolicy's report only +

      5. If parentPolicy's report-only value is "require-corp" and responsePolicy's value is "unsafe-none", then queue a cross-origin embedder policy @@ -81326,7 +82304,7 @@ interface BarProp {

      6. Let ownerPolicy be owner's embedder policy. -

      7. If ownerPolicy's report only +

      8. If ownerPolicy's report-only value is "require-corp" and policy's value is "unsafe-none", then queue a cross-origin embedder policy @@ -83156,16 +84134,19 @@ interface Location { // but see also cross-origin opener policy

        a cross-origin opener policy to use for the new Document
        +
        COOP enforcement result
        +
        a cross-origin opener policy enforcement + result, used for reporting and potentially for causing a browsing context + group switch
        +
        reserved environment
        null or an environment reserved for the new Document
        browsing context
        -
        the browsing context to be navigated (but see below)
        - -
        browsing context switch needed
        -
        a boolean indicating whether or not the navigation should conclude by discarding the given browsing context and creating a new one
        +
        the browsing context to be navigated (or discarded, if a browsing context group + switch occurs)
        history handling
        a history handling behavior
        @@ -83353,17 +84334,32 @@ interface Location { // but see also url, finalSandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin.

        9. +

      9. Let coop be a new cross-origin opener policy.

        10. + +

      10. Let coopEnforcementResult be a new cross-origin opener policy enforcement result whose + needs a browsing context group switch is + false, would need a browsing context + group switch due to report-only is false, url is resource's url, origin + is responseOrigin, cross-origin opener policy is coop, and + current context is navigation source is + false.

        11. +

      11. Let navigationParams be a new navigation params whose request is null, response is resource, origin is responseOrigin, final sandboxing flag set is finalSandboxFlags, cross-origin opener - policy is "unsafe-none", is coop, COOP enforcement result is + coopEnforcementResult, reserved environment is null, browsing context is - browsingContext, browsing - context switch needed is false, and history + browsingContext, and history handling is historyHandling.

      12. Run process a navigate response with navigationType, the @@ -83388,6 +84384,20 @@ interface Location { // but see also sandboxing flags and response's forced sandboxing flag set.

        13. +

      13. Let coopEnforcementResult be a new cross-origin opener policy enforcement result whose + needs a browsing context group switch is + false, would need a browsing context + group switch due to report-only is false, url is resource's url, origin + is activeDocumentNavigationOrigin, cross-origin opener policy is + browsingContext's active document's cross-origin opener policy, and current context is navigation source is + false.

        14. +

      14. Let navigationParams be a new navigation params whose request is resource, response is response, Location { // but see also cross-origin opener policy is browsingContext's active document's cross-origin opener policy, COOP enforcement result is + coopEnforcementResult, reserved environment is null, browsing context is - browsingContext, browsing - context switch needed is false, and history + browsingContext, and history handling is historyHandling.

      15. Run process a navigate response with navigationType, the @@ -83502,20 +84513,25 @@ interface Location { // but see also cross-origin opener policy enforcement result whose needs a browsing context group switch is false, origin is browsingContext's - active document's origin, and cross-origin opener policy is browsingContext's - active document's cross-origin opener - policy.

        16. + data-x="coop-enforcement-bcg-switch-report-only">would need a browsing context group switch due + to report-only is false,url is + browsingContext's active document's url, origin is browsingContext's active + document's origin, cross-origin opener + policy is browsingContext's active document's cross-origin opener policy, and current context is navigation source is + currentContextIsSource.

      16. Let finalSandboxFlags be an empty sandboxing flag set.

        17. -

      17. Let responseCOOP be "unsafe-none".

        18. -

      18. While true:

        @@ -83619,7 +84635,8 @@ interface Location { // but see also         If sandboxFlags is not empty and responseCOOP's value is not "unsafe-none", then set response to an appropriate network error and break.

        @@ -83630,8 +84647,10 @@ interface Location { // but see also         enforcing the response's cross-origin opener policy given - browsingContext, responseOrigin, responseCOOP, and - coopEnforcementResult.

        19. + browsingContext, request's url, responseOrigin, + responseCOOP, coopEnforcementResult and request's referrer.

      6. @@ -83751,7 +84770,6 @@ interface Location { // but see also request is request, response is response, Location { // but see also final sandboxing flag set is finalSandboxFlags, cross-origin opener policy is responseCOOP, COOP enforcement result is + coopEnforcementResult, reserved environment is reservedEnvironment, browsing - context is browsingContext, browsing context switch needed is - coopEnforcementResult's needs a browsing - context group switch, and history + context is browsingContext, and history handling is historyHandling.

    6. Run process a navigate response with navigationType, the @@ -84061,17 +85078,14 @@ interface Location { // but see also browsing context.

      7. - -

    7. If navigationParams's browsing context switch needed is true, then - set browsingContext to the result of the obtain a browsing context to use for a navigation - response algorithm, given browsingContext, navigationParams's final sandboxing flag set, and - navigationParams's cross-origin opener - policy.

      8. +

    8. Let browsingContext be the result of the obtaining a browsing context to use for a navigation + response given navigationParams's browsing context, + navigationParams's final sandboxing flag + set, navigationParams's cross-origin + opener policy, and navigationParams's COOP enforcement result.

    9. Let permissionsPolicy be the result of creating a permissions policy from a @@ -84705,12 +85719,13 @@ new PaymentRequest(…); // Allowed to use data-x="navigation-params-origin">origin is a new opaque origin, final sandboxing flag set is an empty set, cross-origin opener policy is "unsafe-none", reserved environment is null, cross-origin opener policy is a new cross-origin + opener policy, COOP enforcement + result is a new cross-origin opener policy + enforcement result, reserved environment is null, and browsing context is - browsingContext, and browsing - context switch needed is false.

      + browsingContext.

      The algorithm called in the next step is not prepared to deal with a null response. Probably we should synthesize one @@ -119230,6 +120245,30 @@ interface External { +

      `Cross-Origin-Opener-Policy-Report-Only`

      + +

      This section describes a header for registration in the Permanent Message Header Field + Registry.

      + +
      +
      Header field name:
      +
      Cross-Origin-Opener-Policy-Report-Only
      +
      Applicable protocol:
      +
      http
      +
      Status:
      +
      standard
      +
      Author/Change controller:
      +
      WHATWG
      +
      Specification document(s):
      +
      + This document is the relevant specification. +
      +
      Related information:
      +
      None.
      +
      + +

      `Origin-Isolation`

      This section describes a header for registration in the Permanent Message Header Field