Wildcards in Permissions Policy Origins

[arichiv]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: Wildcards in Permissions Policy Origins
• Specification or proposal URL: Client Hint delegation to multiple subdomains w3c/webappsec-permissions-policy#479
• WebKit Request for Position: Wildcards in Permissions Policy Origins WebKit/standards-positions#51
• Chromoium Intent to Ship: https://groups.google.com/a/chromium.org/g/blink-dev/c/biH6g79KclA
• Chromium Feature: https://chromestatus.com/guide/edit/5170361717489664
• Chromium Issue: https://bugs.chromium.org/p/chromium/issues/detail?id=1345994
• Tag Review: Wildcards in Permissions Policy Origins w3ctag/design-reviews#765

Other information

Design Doc

This feature will add support for wildcard in permissions policy structured like SCHEME://*.HOST:PORT (e.g., https://*.foo.com/) where a valid Origin could be constructed from SCHEME://HOST:PORT (e.g., https://foo.com/). This requires that HOST is at least eTLD+1 (a registrable domain). This means that https://*.bar.foo.com/ works but https://*.com/ won’t (if you want to allow all domains to use the feature, you should just delegate to *). Wildcards in the scheme and port section will be unsupported and https://*.foo.com/ does not delegate to https://foo.com/.

Before, a permissions policy might need to look like:
permissions-policy: ch-ua-platform-version=(self "https://foo.com/" "https://cdn1.foo.com/" "https://cdn2.foo.com/" "https://foo.cdn2.foo.com/")

With this feature, it could look like:
permissions-policy: ch-ua-platform-version=(self "https://foo.com/" "https://*.foo.com")

[martinthomson]

Did your comment lose the "*" character in a few places?

Looking at the proposal, I think that you need to sort out whether matching follows CSP (where "*" matches any number of labels) or certificates (where "*" matches a single label). In general, it is better to have these fundamental details sorted out before asking our opinion. However, once that is worked out, I don't see any problem with this.

cc @dveditz

[arichiv]

Thanks for the catch re *, I forgot it meant italics in markdown.

As for your question, I added an example to clarify that "https://foo.cdn2.foo.com/" would match "https://*.foo.com/"

[bgrins]

Confirmed with @dveditz this is fine, thanks for the clarification and update