Intent to Prototype: "credentialless" embedder policy.

64 views
Skip to first unread message

Arthur Sonzogni

unread,
Feb 11, 2021, 11:11:22 AM2/11/21
to blin...@chromium.org

Contact emails

arthurs...@chromium.org, cl...@chromium.org, mk...@chromium.org

Explainer


https://github.com/mikewest/credentiallessness

Specification

None

Summary

Introduce Cross-Origin-Embedder-Policy: credentialless. This causes cross-origin no-cors requests to omit credentials (cookies, client certificates, etc). Similarly to COEP:require-corp, it can enable cross-origin isolation.



Blink component

Blink>SecurityFeature

Motivation

Sites that wish to continue using SharedArrayBuffer must opt-into cross-origin isolation. Today, COEP: require-corp exists, and is used to enable cross-origin isolation. It is functional and solid, but turns out to be difficult to deploy at scale, as it requires all subresources to explicitly opt-in. This is fine for some sites, but creates dependency problems for sites that gather content from users (Google Earth, social media generally, forums, etc). With COEP: credentialless, we want to find a robust-enough protection against accidental cross-process leakage, without requiring an explicit opt-in from every subresource.



Initial public proposal

https://github.com/w3ctag/design-reviews/issues/582

Search tags

coep, credentialless, coop, crossoriginisolation, crossOriginisolated

TAG review

https://github.com/w3ctag/design-reviews/issues/582

TAG review status

Pending

Risks



Interoperability and Compatibility



Gecko: No signal

WebKit: No signal

Web developers: No signals


Is this feature fully tested by web-platform-tests?

No

Tracking bug

https://crbug.com/1175099

Link to entry on the Chrome Platform Status

https://www.chromestatus.com/feature/4918234241302528

This intent message was generated by Chrome Platform Status.

Reply all
Reply to author
Forward
0 new messages