Intent to Prototype: Frame Ancestor Headers

[Sam LeDoux]

Contact emails

sle...@chromium.org

Explainer

https://github.com/explainers-by-googlers/frame-ancestor-headers

Specification

None

Summary

Frame Ancestor Headers would expose information about the relationship between a request's ancestor frames and that request's target by adding two new HTTP request headers, `Sec-Fetch-Frame-Top` and `Sec-Fetch-Frame-Ancestors`. This should support developers' understanding of the circumstances in which they may have access to unpartitioned cookies, and the ways in which their resources may be partitioned.

Blink component

Blink>SecurityFeature>FetchMetadata

Motivation

Currently, there is no signal on the web platform that comprehensively indicates the relationship between a request's destination and its ancestor frames. This information is important for sites to understand how cookies may be partitioned on a request and why a request may be autogranted storage access permissions. This feature offers two new headers as signals, `Sec-Fetch-Frame-Top` and `Sec-Fetch-Frame-Ancestors`, whose values will indicate whether a request's destination is `same-origin`, `same-site`, or `cross-site` to its top frame and all of its ancestor frames respectively.

Initial public proposal

https://github.com/w3c/webappsec-fetch-metadata/issues/56

TAG review

None

TAG review status

Pending

Risks

Interoperability and Compatibility

None

While we have not filed formal browser positions yet, a constructive discussion with both Mozilla and Apple is happening at https://github.com/w3c/webappsec-fetch-metadata/pull/89.

Gecko: No signal

WebKit: No signal

Web developers: No signals

Other signals:

WebView application risks

None

Debuggability

None

Is this feature fully tested by web-platform-tests?

No

Flag name on about://flags

None

Finch feature name

None

Non-finch justification

None

Requires code in //chrome?

False

Tracking bug

https://g-issues.chromium.org/issues/398224102

Launch bug

https://launch.corp.google.com/launch/4347302

Estimated milestones

No milestones specified

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5070061747044352?gate=5172594226233344

This intent message was generated by Chrome Platform Status.