Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make cross-origin-isolation an implementation-defined consequence of COOP + COEP? #6060

Closed
ArthurSonzogni opened this issue Oct 14, 2020 · 2 comments
Closed

Make cross-origin-isolation an implementation-defined consequence of COOP + COEP? #6060

ArthurSonzogni opened this issue Oct 14, 2020 · 2 comments
Labels
topic: cross-origin-embedder-policy Issues and ideas around the new "require CORP for subresource requests and frames and etc" proposal. topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header.

Comments

@ArthurSonzogni
Copy link
Member

ArthurSonzogni commented Oct 14, 2020 •
edited
Loading

The specification requires COOP + COEP to give access to crossOriginIsolated capabilities like SharedArrayBuffer.

Some platforms can't easily support multiple processes (like Android Webview). Therefore, they can't really support crossOriginIsolated. However the are no strong reasons for them not to enforce COEP (and maybe COOP) when their associated headers are present.

We would like to enforce COEP (and maybe COOP) on all platforms, despite the lack of crossOriginIsolated capabilities.

Should we make the specification to allow (instead of requiring) platform to set the crossOriginIsolated flag when COOP+COEP are used?

This would make crossOriginIsolated to be platform dependent. In exchange, we could enforce COEP (and COOP) in a non platform dependent way, without conflicting with the specification about crossOriginIsolated.

FYI: @whatwg/cross-origin-isolation @annevk @domenic @mikewest @camillelamy @hemeryar
@annevk annevk added topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header. topic: cross-origin-embedder-policy Issues and ideas around the new "require CORP for subresource requests and frames and etc" proposal. labels Oct 14, 2020
@annevk
Copy link
Member

annevk commented Oct 14, 2020

I think that's reasonable. It definitely seems preferable to not supporting COOP/COEP. I wonder if as part of this we should spell it out a bit more that an agent cluster with its cross-origin isolated flag set cannot share a process with an agent cluster that does not have that set (or is from a different site), but that's all rather architecture specific. Hmm.

@ArthurSonzogni
Copy link
Member Author

Thanks for your reply!

I think I will try updating the specifications myself and see what feedback I will get.
This will be my first time trying to edit the spec, so it might take some days. It's good starting with something simple like this.

@yutakahirano yutakahirano mentioned this issue Oct 16, 2020
Open
ArthurSonzogni added a commit to ArthurSonzogni/html that referenced this issue Oct 23, 2020
@ArthurSonzogni
Make COOP+COEP do not imply crossOriginIsolated.
03ce597 
The [specification] requires [COOP] + [COEP] to give access to
crossOriginIsolated capabilities like SharedArrayBuffer.

Some platforms can't easily support multiple processes (like Android
Webview). Therefore, they can't really support crossOriginIsolated.
However the are no strong reasons for them not to enforce COEP (and
maybe COOP) when their associated headers are present.

We would like to enforce COEP (and maybe COOP) on all platforms, despite
the lack of crossOriginIsolated capabilities.

This makes the specification to allow (instead of requiring) platform to
set the crossOriginIsolated flag when COOP+COEP are used?

This makes crossOriginIsolated to be platform dependent. In exchange, we
could enforce COEP (and COOP) in a non platform dependent way, without
conflicting with the specification about crossOriginIsolated.

[Bug]:
whatwg#6060

[specification]:
https://html.spec.whatwg.org/#cross-origin-opener-policies

[COOP]:
https://html.spec.whatwg.org/#cross-origin-opener-policy

[COEP]:
https://html.spec.whatwg.org/#coep
ArthurSonzogni added a commit to ArthurSonzogni/html that referenced this issue Oct 23, 2020
@ArthurSonzogni
Make COOP+COEP do not imply crossOriginIsolated.
8881db2 
The [specification] requires [COOP] + [COEP] to give access to
crossOriginIsolated capabilities like SharedArrayBuffer.

Some platforms can't easily support multiple processes (like Android
Webview). Therefore, they can't really support crossOriginIsolated.
However the are no strong reasons for them not to enforce COEP (and
maybe COOP) when their associated headers are present.

We would like to enforce COEP (and maybe COOP) on all platforms, despite
the lack of crossOriginIsolated capabilities.

This makes the specification to allow (instead of requiring) platform to
set the crossOriginIsolated flag when COOP+COEP are used.

CrossOriginIsolated becomes platform dependent. In exchange, we can
enforce COEP (and COOP) in a non platform dependent way, without
conflicting with the specification about crossOriginIsolated.

[Bug]: whatwg#6060

[specification]:
https://html.spec.whatwg.org/#cross-origin-opener-policies

[COOP]:
https://html.spec.whatwg.org/#cross-origin-opener-policy

[COEP]:
https://html.spec.whatwg.org/#coep
ArthurSonzogni added a commit to ArthurSonzogni/html that referenced this issue Oct 23, 2020
@ArthurSonzogni
Make COOP+COEP do not imply crossOriginIsolated.
590a022 
The [specification] currently requires [COOP] + [COEP] to give access to
crossOriginIsolated capabilities like SharedArrayBuffer.

Some platforms can't easily support multiple processes (like Android
Webview). Therefore, they can't really support crossOriginIsolated.
However the are no strong reasons for them not to enforce COEP (and
maybe COOP) when their associated headers are present.

It would be great enforcing COEP (and maybe COOP) on all platforms,
desptie the lack of crossOriginIsolated capabilities.

This patch makes the specification to allow (instead of requiring)
platform to set the crossOriginIsolated flag when both COOP and COEP are
used.

Setting crossOriginIsolated becomes platform dependent. In exchange, we
can enforce COEP (and COOP) in a non platform dependent way, without
conflicting with the specification about crossOriginIsolated.

[Bug]: whatwg#6060

[specification]:
https://html.spec.whatwg.org/#cross-origin-opener-policies

[COOP]:
https://html.spec.whatwg.org/#cross-origin-opener-policy

[COEP]:
https://html.spec.whatwg.org/#coep
blueboxd pushed a commit to blueboxd/chromium-legacy that referenced this issue Oct 23, 2020
@ArthurSonzogni
[COEP] Enable on all platforms (e.g. add Android WebView)
3e6c18c 
There are no real reasons for COEP not to be enforced on Android
WebView.

See also:

[PSA-COEP-expanded-to-webview]:
https://groups.google.com/a/chromium.org/g/blink-dev/c/Wc_uYYkcviw

[Updated chrome-status entry]:
https://chromestatus.com/features/5642721685405696

[original-intent-to-ship-coep]:
https://groups.google.com/a/chromium.org/g/blink-dev/c/XBKAGb2_7uA/m/ajpc6_9zAAAJ

[crossOriginIsolated spec to be updated]:
whatwg/html#6060

Bug: 1140432
Change-Id: I9a7c44671846f20bd0ac2a06b181ed584ad606eb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2485507
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Richard Coles <torne@chromium.org>
Reviewed-by: Domenic Denicola <domenic@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#820311}
ArthurSonzogni added a commit to ArthurSonzogni/html that referenced this issue Nov 18, 2020
@ArthurSonzogni
Make COOP+COEP do not imply crossOriginIsolated.
c79e8f3 
The [specification] currently requires [COOP] + [COEP] to give access to
crossOriginIsolated capabilities like SharedArrayBuffer.

Some platforms can't easily support multiple processes (like Android
Webview). Therefore, they can't really support crossOriginIsolated.
However the are no strong reasons for them not to enforce COEP (and
maybe COOP) when their associated headers are present.

It would be great enforcing COEP (and maybe COOP) on all platforms,
desptie the lack of crossOriginIsolated capabilities.

This patch makes the specification to allow (instead of requiring)
platform to set the crossOriginIsolated flag when both COOP and COEP are
used.

Setting crossOriginIsolated becomes platform dependent. In exchange, we
can enforce COEP (and COOP) in a non platform dependent way, without
conflicting with the specification about crossOriginIsolated.

[Bug]: whatwg#6060

[specification]:
https://html.spec.whatwg.org/#cross-origin-opener-policies

[COOP]:
https://html.spec.whatwg.org/#cross-origin-opener-policy

[COEP]:
https://html.spec.whatwg.org/#coep
ArthurSonzogni added a commit to ArthurSonzogni/html that referenced this issue Dec 15, 2020
@ArthurSonzogni
Make COOP+COEP do not imply crossOriginIsolated.
68d940c 
The [specification] currently requires [COOP] + [COEP] to give access to
crossOriginIsolated capabilities like SharedArrayBuffer.

Some platforms can't easily support multiple processes (like Android
Webview). Therefore, they can't really support crossOriginIsolated.
However the are no strong reasons for them not to enforce COEP (and
maybe COOP) when their associated headers are present.

It would be great enforcing COEP (and maybe COOP) on all platforms,
desptie the lack of crossOriginIsolated capabilities.

This patch makes the specification to allow (instead of requiring)
platform to set the crossOriginIsolated flag when both COOP and COEP are
used.

Setting crossOriginIsolated becomes platform dependent. In exchange, we
can enforce COEP (and COOP) in a non platform dependent way, without
conflicting with the specification about crossOriginIsolated.

[Bug]: whatwg#6060

[specification]:
https://html.spec.whatwg.org/#cross-origin-opener-policies

[COOP]:
https://html.spec.whatwg.org/#cross-origin-opener-policy

[COEP]:
https://html.spec.whatwg.org/#coep
ArthurSonzogni added a commit to ArthurSonzogni/html that referenced this issue Dec 15, 2020
@ArthurSonzogni
Make COOP+COEP do not imply crossOriginIsolated.
9c0351e 
The [specification] currently requires [COOP] + [COEP] to give access to
crossOriginIsolated capabilities like SharedArrayBuffer.

Some platforms can't easily support multiple processes (like Android
Webview). Therefore, they can't really support crossOriginIsolated.
However the are no strong reasons for them not to enforce COEP (and
maybe COOP) when their associated headers are present.

It would be great enforcing COEP (and maybe COOP) on all platforms,
desptie the lack of crossOriginIsolated capabilities.

This patch makes the specification to allow (instead of requiring)
platform to set the crossOriginIsolated flag when both COOP and COEP are
used.

Setting crossOriginIsolated becomes platform dependent. In exchange, we
can enforce COEP (and COOP) in a non platform dependent way, without
conflicting with the specification about crossOriginIsolated.

[Bug]: whatwg#6060

[specification]:
https://html.spec.whatwg.org/#cross-origin-opener-policies

[COOP]:
https://html.spec.whatwg.org/#cross-origin-opener-policy

[COEP]:
https://html.spec.whatwg.org/#coep
domenic pushed a commit to ArthurSonzogni/html that referenced this issue Dec 17, 2020
@ArthurSonzogni @domenic
Make COOP+COEP do not imply crossOriginIsolated.
7480ee1 
The [specification] currently requires [COOP] + [COEP] to give access to
crossOriginIsolated capabilities like SharedArrayBuffer.

Some platforms can't easily support multiple processes (like Android
Webview). Therefore, they can't really support crossOriginIsolated.
However the are no strong reasons for them not to enforce COEP (and
maybe COOP) when their associated headers are present.

It would be great enforcing COEP (and maybe COOP) on all platforms,
desptie the lack of crossOriginIsolated capabilities.

This patch makes the specification to allow (instead of requiring)
platform to set the crossOriginIsolated flag when both COOP and COEP are
used.

Setting crossOriginIsolated becomes platform dependent. In exchange, we
can enforce COEP (and COOP) in a non platform dependent way, without
conflicting with the specification about crossOriginIsolated.

[Bug]: whatwg#6060

[specification]:
https://html.spec.whatwg.org/#cross-origin-opener-policies

[COOP]:
https://html.spec.whatwg.org/#cross-origin-opener-policy

[COEP]:
https://html.spec.whatwg.org/#coep
@annevk annevk closed this as completed in cbcf6ac Jan 6, 2021
@ArthurSonzogni ArthurSonzogni mentioned this issue Aug 18, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
topic: cross-origin-embedder-policy Issues and ideas around the new "require CORP for subresource requests and frames and etc" proposal. topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header.
Milestone
No milestone
Development

No branches or pull requests
2 participants
@annevk @ArthurSonzogni