From d67695029560dd9d635495f973c4c369a39301ee Mon Sep 17 00:00:00 2001 From: Mike West Date: Fri, 16 Oct 2015 09:22:12 +0200 Subject: [PATCH] Defining secure global objects. --- index.html | 7 ++++--- index.src.html | 7 +++++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/index.html b/index.html index c7d452f..20a92c8 100644 --- a/index.html +++ b/index.html @@ -1020,7 +1020,7 @@

Secure Contexts

-

Editor’s Draft,

+

Editor’s Draft,

This version: @@ -1443,6 +1443,7 @@

2.

A settings object is considered a secure context if the algorithm in §3.1 Is settings object a secure context? returns "Secure". The settings object is otherwise non-secure.

+

Likewise, a global object is considered a secure context if its relevant settings object is a secure context.

2.1. Modifications to HTML

2.1.1. Shared Workers

The SharedWorker() constructor will throw a SecurtyError exception if @@ -1508,7 +1509,7 @@

If ancestor settings object’s HTTPS state is - "modern", skip to the next ancestor settings.

+ "modern", skip to the next ancestor settings object.

  • Let origin be ancestor settings object’s origin.

  • @@ -1756,7 +1757,7 @@

    Modify the specification to include checks against secure context before executing the algorithms for getCurrentPosition() and watchPosition().

    If the incumbent settings object is not a secure context, - then the algorithm should be aborted, and the errorCallback invoked with a code of PERMISSION_DENIED.

    + then the algorithm should be aborted, and the errorCallback invoked with a code of PERMISSION_DENIED.

  • The user agent should announce clear intentions to disable the API for non-secure contexts on a specific date, and warn developers accordingly diff --git a/index.src.html b/index.src.html index fb0c93c..7d165f7 100644 --- a/index.src.html +++ b/index.src.html @@ -504,6 +504,9 @@

    Framework

    the algorithm in [[#settings-object]] returns "`Secure`". The settings object is otherwise non-secure. + Likewise, a global object is considered a secure context if its + relevant settings object is a secure context. +

    Modifications to HTML

    Shared Workers

    @@ -580,7 +583,7 @@

    4. For each ancestor settings object in ancestors: 1. If ancestor settings object's HTTPS state is - "`modern`", skip to the next ancestor settings. + "`modern`", skip to the next ancestor settings object. 2. Let origin be ancestor settings object's origin. @@ -911,7 +914,7 @@

    Example: Geolocation

    {{getCurrentPosition()}} and {{watchPosition()}}. If the incumbent settings object is not a secure context, - then the algorithm should be aborted, and the errorCallback + then the algorithm should be aborted, and the `errorCallback` invoked with a `code` of `PERMISSION_DENIED`. 2. The user agent should announce clear intentions to disable the API for