Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Have CORP check rely on request's response tainting rather than request's mode #985

Closed
yutakahirano opened this issue Dec 18, 2019 · 5 comments
Closed

Have CORP check rely on request's response tainting rather than request's mode #985

yutakahirano opened this issue Dec 18, 2019 · 5 comments

Comments

@yutakahirano
Copy link
Member

Brought up at https://chromium-review.googlesource.com/c/chromium/src/+/1971810, related with w3c/ServiceWorker#1490.

We would like to run the CORP check in CacheStorage for COEP (w3c/ServiceWorker#1490), but currently the CORP check relies on the request mode which is not directly accessible there. request's response tainting is stored as response type and we can use it. What do you think about changing the first item as follows?

If request's response tainting is not "opaque", then return allowed.

In the CacheStorage spec, we will restore a request for the CORP check as follows:

  • Let request be a new request.
  • Set request's URL to the given URL.
  • Set request's origin to the current realm's origin
  • Set request's response tainting to
    • "basic" if response's type is "basic", "default" or "opaqueredirect"
    • "opaque" if response's type is "opaque"
    • "cors" if response's type is "cors"

@ArthurSonzogni @wanderview @annevk
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 18, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
9a7b88c 
[PROTOTYPE] => DO NOT COMMIT.

Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug:1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
Merged
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 18, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
efc29e6 
[PROTOTYPE] => DO NOT COMMIT.

Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug:1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 18, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
94a890c 
[PROTOTYPE] => DO NOT COMMIT.

Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug:1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 19, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
c762eee 
[PROTOTYPE] => DO NOT COMMIT.

Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug:1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 19, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
615aa2a 
Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug:1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 19, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
94f3ce5 
Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug:1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 19, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
285214d 
Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug:1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 20, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
1c20170 
Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug:1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
@annevk
Copy link
Member

annevk commented Dec 20, 2019

Given the check the only caller does today is

If httpRequest’s response tainting is not "cors"

per https://fetch.spec.whatwg.org/#ref-for-cross-origin-resource-policy-check perhaps that initial step

If request’s mode is not "no-cors", then return allowed.

is even redundant?

I think we should investigate how this should change together with the change to enforce this for a service worker response.

chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 20, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
0089506 
Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug: 1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1973913
Auto-Submit: Arthur Sonzogni <[email protected]>
Reviewed-by: Camille Lamy <[email protected]>
Reviewed-by: Ben Kelly <[email protected]>
Reviewed-by: Mike West <[email protected]>
Commit-Queue: Arthur Sonzogni <[email protected]>
Cr-Commit-Position: refs/heads/master@{#726782}
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Dec 20, 2019
@ArthurSonzogni @chromium-wpt-export-bot
COEP: Enforce CORP in cache.match()
236e6db 
Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug: 1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1973913
Auto-Submit: Arthur Sonzogni <[email protected]>
Reviewed-by: Camille Lamy <[email protected]>
Reviewed-by: Ben Kelly <[email protected]>
Reviewed-by: Mike West <[email protected]>
Commit-Queue: Arthur Sonzogni <[email protected]>
Cr-Commit-Position: refs/heads/master@{#726782}
@yutakahirano
Copy link
Member Author

Yes, that is a possible approach. Do you think it's better?

Regarding the service worker response, it is now part of https://github.com/mikewest/corpp.

@annevk
Copy link
Member

annevk commented Jan 3, 2020

I think I would prefer putting all the checks in Fetch, if possible (Fetch gets the response from the service worker and can do it, after all), rather than putting security checks in Service Workers for this.

moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this issue Jan 3, 2020
@ArthurSonzogni @moz-wptsync-bot
Bug 1604809 [wpt PR 20840] - COEP: Enforce CORP in cache.match(), a=t…
321c836 
…estonly

Automatic update from web-platform-tests
COEP: Enforce CORP in cache.match()

Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug: 1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1973913
Auto-Submit: Arthur Sonzogni <[email protected]>
Reviewed-by: Camille Lamy <[email protected]>
Reviewed-by: Ben Kelly <[email protected]>
Reviewed-by: Mike West <[email protected]>
Commit-Queue: Arthur Sonzogni <[email protected]>
Cr-Commit-Position: refs/heads/master@{#726782}

--

wpt-commits: 236e6dbc70e128ab5ff5bad6ab98888281df8ffd
wpt-pr: 20840
xeonchen pushed a commit to xeonchen/gecko that referenced this issue Jan 3, 2020
@ArthurSonzogni @moz-wptsync-bot
Bug 1604809 [wpt PR 20840] - COEP: Enforce CORP in cache.match(), a=t…
504bc4f 
…estonly

Automatic update from web-platform-tests
COEP: Enforce CORP in cache.match()

Document using:
"Cross-Origin-Embedder-Policy: require-corp"
must not access cross-origin response that do not have the header:
"Cross-Origin-Resource-Policy: cross-site"

This is about only no-cors requests. CORS requests are checked against the
CORS headers instead.

See:
 - whatwg/fetch#985
 - w3c/ServiceWorker#1490

Bug: 1031542
Change-Id: I94a2cb9435fcf3e76f57a8f3d3344c87fa23f9a9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1973913
Auto-Submit: Arthur Sonzogni <[email protected]>
Reviewed-by: Camille Lamy <[email protected]>
Reviewed-by: Ben Kelly <[email protected]>
Reviewed-by: Mike West <[email protected]>
Commit-Queue: Arthur Sonzogni <[email protected]>
Cr-Commit-Position: refs/heads/master@{#726782}

--

wpt-commits: 236e6dbc70e128ab5ff5bad6ab98888281df8ffd
wpt-pr: 20840
@yutakahirano
Copy link
Member Author

I prefer running a CORP check in cache.match(w3c/ServiceWorker#1490), which means calling it from the SW spec.

@annevk
Copy link
Member

annevk commented Jan 10, 2020

Fair, I guess that would be the exception, but I don't think we need it for respondWith().

This was referenced Jun 2, 2020
Merged
Merged
@yutakahirano yutakahirano mentioned this issue Jun 15, 2020
Merged
3 tasks
mfreed7 pushed a commit to mfreed7/html that referenced this issue Sep 11, 2020
@yutakahirano @mfreed7
Add cross-origin embedder policy
add7b6e 
Merges https://github.com/WICG/cross-origin-embedder-policy into HTML.

Associated PRs:

* whatwg/fetch#1030
* w3c/ServiceWorker#1516
* w3c/css-houdini-drafts#992

Fixes whatwg#5368, fixes whatwg#5634, fixes
whatwg/fetch#985, and fixes
w3c/ServiceWorker#1490.

Follow-up: whatwg#4916, whatwg#4919, whatwg#4930 whatwg#5223, and whatwg#5391. (As well as defining
cross-origin isolated, per whatwg#4732.)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@annevk @yutakahirano