From c64d81110fa7bf2cccaf8d9382ec16a7da7b336d Mon Sep 17 00:00:00 2001 From: Arthur Sonzogni Date: Wed, 9 Mar 2022 18:32:11 +0100 Subject: [PATCH 1/9] Anonymous iframe Explainer: https://github.com/camillelamy/explainers/blob/main/anonymous_iframes.md Chrome status: https://chromestatus.com/feature/5729461725036544 Summary: - Define the anonymous flag for iframe and Window. - Inheritance is defined similarly to sandbox. However it do not propage toward popups. - Popup opened from anonymous Window use 'noopener'. - Navigation in anonymous iframe are allowed, even if the embedder has COEP:require-corp|credentialless and the response do not. - Define the `page anonymous nonce`, it is used for anonymous Window as an additional keys in: - network-partition-keys, - storage-partition-keys, - cookie-partition-keys This ensures the document is loaded within a new and ephemeral context. This prevents a cross-origin-isolated parent from stealing important data from its child, via a Spectre Attack. - Password autofill must be disabled inside anonymous Window. XXX: implement the corresponding parts on top of: - Fetch => network-partition-keys - StoragePartitioning => storage-partition-keys - CookieHavingIndependantState => cookie-partition-key - Worker. --- source | 157 +++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 131 insertions(+), 26 deletions(-) diff --git a/source b/source index 12c5dfaef0a..3304ea48ac0 100644 --- a/source +++ b/source @@ -2495,6 +2495,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • safely extracting a body
  • processResponseConsumeBody
  • processResponseEndOfBody
    • +
  • network-partition-keys
  • response and its @@ -30891,6 +30892,7 @@ href="?audio">audio</a> test instead.)</p>
    height
    referrerpolicy
    loading
    +
    anonymous
    Accessibility considerations:
    For authors.
    @@ -31601,6 +31603,12 @@ interface HTMLIFrameElement : HTMLElement {

  • Invoke resumptionSteps.

    • +
    + +

    The anonymous + attribute, enables loading documents hosted by the iframe with a new and ephemeral + storage partition. It is a boolean value. The default is false.

    +

    Descendants of iframe elements represent nothing. (In legacy user agents that do @@ -80362,6 +80370,10 @@ popup4.close();

  • Let sandboxFlags be the result of determining the creation sandboxing flags given browsingContext and embedder.

    • +

  • Let anonymous be the result of determining the initial window anonymous flag, given + browsingContext.

    • + +
    -

    The anonymous +

    The credentialless attribute, enables loading documents hosted by the iframe with a new and ephemeral storage partition. It is a boolean value. The default is false.

    @@ -31630,8 +31631,8 @@ interface HTMLIFrameElement : HTMLElement { data-x="dom-iframe-name">name, sandbox, allow , and anonymous , must reflect the respective - content attributes of the same name.

    + data-x="dom-iframe-credentialless">credentialless , must reflect the + respective content attributes of the same name.

    The supported tokens for sandbox's DOMTokenList are the allowed @@ -80372,8 +80373,8 @@ popup4.close();

  • Let sandboxFlags be the result of determining the creation sandboxing flags given browsingContext and embedder.

    • -

  • Let anonymous be the result of determining the initial window anonymous flag, given +

  • Let credentialless be the result of determining the initial window credentialless flag, given browsingContext.