Intent to Deprecate and Remove: Same-origin blanket enforcement in CSPEE
Jun Kokatsu
Explainer
None
Specification
https://github.com/w3c/webappsec-cspee/pull/28/files
Summary
Removes a special treatment for same-origin iframes from CSP Embedded Enforcement. This aligns the behavior of enforcing CSP Embedded Enforcement for cross-origin iframes and same-origin iframes.
Blink component
Blink>SecurityFeature>ContentSecurityPolicy
Motivation
The same-origin blanket enforcement logic specific to same-origin iframes exposes a new way to block certain resources from loading in the iframe. This allowed an attack which was not possible before (example).
Additionally, this caused a bug where CSP nonce value enforced by CSPEE from a top frame had to exactly match nonce value served in grand-child frame, if the top frame and child frame are cross-origin, but child frame and grand-child frame are same-origin.
Given this part of blanket enforcement is rarely used (~0.000017%), let's remove this logic.
Initial public proposal
None
TAG review
None
TAG review status
Not applicable
Risks
Interoperability and Compatibility
None
Gecko: Positive
WebKit: No signal
Web developers: No signals
Other signals:
WebView application risks
Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?
None
Debuggability
None
Is this feature fully tested by web-platform-tests?
Flag name on chrome://flags
None
Finch feature name
None
Non-finch justification
None
Requires code in //chrome?
False
Tracking bug
https://bugs.chromium.org/p/chromium/issues/detail?id=1263288
Estimated milestones
M120
Link to entry on the Chrome Platform Status
https://chromestatus.com/feature/5098158594195456
Yoav Weiss
Mike Taylor
LGTM2
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/d968fa5a-7c9f-4c2e-9a42-8dd3e468fa63n%40chromium.org.
Mike Taylor
Also, please request cross-functional review bits in the
chromestatus entries.
chrishtr via Chromestatus
Mike Taylor
LGTM2
LGTM
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/000000000000514b9c06079c71ba%40google.com.