Intent to prototype: Connection Allowlists

[Tom Schuster]

Summary:
The Connection-Allowlist header allows web developers to limit the servers a website can communicate with. This can be used to prevent data exfiltration attacks.

Bug: Bug 2062159

Specification: https://wicg.github.io/connection-allowlists/

Standards Body:
This specification is supposed to be adopted by the W3C Web Application Security Working Group.

Platform Coverage: All

Preference: security.connection_allowlists.enabled

DevTools Bug: None (The header would automatically show up)

Extensions Bug: n/a

Use Counter: tbd (Bug 2073432)

Standards-Positions Discussion: positive

Other Browsers:
- Blink: shipped (since 152)
- WebKit: no signal (https://github.com/WebKit/standards-positions/issues/583)

web-platform-tests: https://wpt.fyi/results/connection-allowlist

[Nicolas Chevobbe]

I filed some DevTools bugs for this:

- Bug 2073466 - Check that blocked requests because of Connection-Allowlists header are properly displayed in Netmonitor
- Bug 2073448 - Add MDN link for Connection-Allowlist header