-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cross-Origin-Embedder-Policy: credentialless #6637
Comments
Why would Also, I still stand by w3ctag/design-reviews#582 (comment). |
Also had a question about how this works for navigations. It seems to me that if the parent document has cors-or-credentialless, the child can have either that or require-corp. But if the parent has require-corp, the child shouldn't be allowed to have cors-or-credentialless perhaps as that's weaker? (Especially once most things cross-origin are without credentials anyway.) |
Thanks @annevk!
Either the request is sent via CORS with credentials, and you must get explicit opt-in from the cross-origin server. Or it is sent in no-cors mode without credentials =>
The main issues we had was:
For now, the HTML spec PR and tentative test puts |
I think |
I understand this argument.
@camillelamy will soon release an explainer for a potential solution to the deployment of <iframe> you don't control. The way it is built make it independent of |
Specify the behavior of `Cross-Origin-Embedder-Policy: cors-or-credentialless`, Originally described in: https://github.com/mikewest/credentiallessness `cors-or-credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `cors-or-credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `cors-or-credentialless` value. * From the HTML spec point of view, `cors-or-credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/cors-or-credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
Specify the behavior of `Cross-Origin-Embedder-Policy: cors-or-credentialless`, Originally described in: https://github.com/mikewest/credentiallessness `cors-or-credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `cors-or-credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `cors-or-credentialless` value. * From the HTML spec point of view, `cors-or-credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/cors-or-credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
Specify the behavior of `Cross-Origin-Embedder-Policy: cors-or-credentialless`, Originally described in: https://github.com/mikewest/credentiallessness `cors-or-credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `cors-or-credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `cors-or-credentialless` value. * From the HTML spec point of view, `cors-or-credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/cors-or-credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug:1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583
This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug:1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583
This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug:1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583
This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug:1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583
So for iframes, we propose a separate solution via an iframe attribute. I have put together an explainer detailing the solution. This is separate from |
This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug: 1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2867588 Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Reviewed-by: Camille Lamy <clamy@chromium.org> Reviewed-by: Kinuko Yasuda <kinuko@chromium.org> Owners-Override: Kinuko Yasuda <kinuko@chromium.org> Cr-Commit-Position: refs/heads/master@{#880359}
This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug: 1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2867588 Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Reviewed-by: Camille Lamy <clamy@chromium.org> Reviewed-by: Kinuko Yasuda <kinuko@chromium.org> Owners-Override: Kinuko Yasuda <kinuko@chromium.org> Cr-Commit-Position: refs/heads/master@{#880359}
This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug: 1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2867588 Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Reviewed-by: Camille Lamy <clamy@chromium.org> Reviewed-by: Kinuko Yasuda <kinuko@chromium.org> Owners-Override: Kinuko Yasuda <kinuko@chromium.org> Cr-Commit-Position: refs/heads/master@{#880359}
…redentialless}, a=testonly Automatic update from web-platform-tests Rename COEP:{cors-or-credentialless => credentialless} This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug: 1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2867588 Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Reviewed-by: Camille Lamy <clamy@chromium.org> Reviewed-by: Kinuko Yasuda <kinuko@chromium.org> Owners-Override: Kinuko Yasuda <kinuko@chromium.org> Cr-Commit-Position: refs/heads/master@{#880359} -- wpt-commits: 27ac2ec45f72f4785951cf3e2b9302b740f6372e wpt-pr: 28838
(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
(Draft) Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in no-cors cross-origin requests. * HTML (whatwg/html#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with crossOriginIsolation` and the HTML spec rewritten to use this concept. * Fetch: (This PR) * Define "Cross-Origin-Embedder-Policy allows credentials". * Omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Check CORP for navigational COEP:credentialless response. * ServiceWorker: XXX * Integration with `Cache.matchAll `algorithm. * XXX See: whatwg/html#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: XXX * Safari: XXX - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/credentialless - [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: XXX * Safari: XXX (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.) ---- See: whatwg/html#6637
Define COEP:credentialless Originally described in: https://github.com/mikewest/credentiallessness `credentialless` and `require-corp` are similar. One or the other is a requirements for the `window.crossOriginIsolated` capability. They differ mostly in the fetch specification. `require-corp` requires a CORP header for cross-origin no-cors responses. `credentialless` doesn't, but omits credentials (Cookies, clients certificates, etc...) in the request. * HTML (whatwg#6638) * Define how to parse the `credentialless` value. * From the HTML spec point of view, `credentialless` and `require-corp` are equivalent. They have been grouped into `compatible with cross-origin isolation` and the HTML spec rewritten to use this concept. * Fetch: (whatwg/fetch#1229) * Define `Cross-Origin-Embedder-Policy allows credentials` algorithm. It omit credentials for no-cors, cross-origin, COEP:credentialless requests. * Define `response's` `request-include-credentials` flag. * In the `Cross-Origin-Resource-Policy check`, if `embedderPolicy` is `credentialless`, require CORP for navigational responses, and opaque responses with `request-include-credentials`. See: whatwg#6637 ---- - [ ] At least two implementers are interested (and none opposed): * Chrome: https://chromestatus.com/feature/4918234241302528#details * Firefox: mozilla/standards-positions#539 (worth prototyping) * Safari: https://lists.webkit.org/pipermail/webkit-dev/2021-June/031898.html (pending) - [X] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at: * https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless - [X] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed: * Chrome: https://crbug.com/1175099 * Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1731778 * Safari: https://bugs.webkit.org/show_bug.cgi?id=230550 (See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.)
This defines Cross-Origin-Embedder-Policy: credentialless. The credentialless and require-corp values are similar. One or the other is a requirements for the cross-origin isolated capability. They differ mostly in terms of fetching. require-corp requires a Cross-Origin-Resource-Policy header for cross-origin opaque responses. credentialless doesn't, but omits credentials (cookies, client certificates, etc.) in cross-origin "no-cors" requests. See https://github.com/WICG/credentiallessness for additional context. Fetch PR: whatwg/fetch#1229. Tests: WPT html/cross-origin-embedder-policy/credentialless. Closes whatwg#6637.
This defines Cross-Origin-Embedder-Policy: credentialless. The credentialless and require-corp values are similar. One or the other is a requirements for the cross-origin isolated capability. They differ mostly in terms of fetching. require-corp requires a Cross-Origin-Resource-Policy header for cross-origin opaque responses. credentialless doesn't, but omits credentials (cookies, client certificates, etc.) in cross-origin "no-cors" requests. See https://github.com/WICG/credentiallessness for additional context. Fetch PR: whatwg/fetch#1229. Tests: WPT html/cross-origin-embedder-policy/credentialless. Closes whatwg#6637.
This was discussed here: whatwg/html#6637 (comment) This patch renames "cors-or-credentialless" into "credentialless". The WPT test directory: - html/cross-origin-embedder-policy/credentialless/cors-or-credentialess/ - html/cross-origin-embedder-policy/credentialless/full-credentialless/ are renamed: - html/cross-origin-embedder-policy/cors-or-credentialess/ - html/cross-origin-embedder-policy/anonymous-iframe/ Bug: 1175099 Change-Id: Iba052a2b3fbf4b45607c48807622d5ced202d583 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2867588 Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Reviewed-by: Camille Lamy <clamy@chromium.org> Reviewed-by: Kinuko Yasuda <kinuko@chromium.org> Owners-Override: Kinuko Yasuda <kinuko@chromium.org> Cr-Commit-Position: refs/heads/master@{#880359} NOKEYCHECK=True GitOrigin-RevId: 69edb0b007920f77a4e9f57c20b9520438c7a4a6
Specify the behavior of
Cross-Origin-Embedder-Policy: cors-or-credentialless
,Originally described in: https://github.com/mikewest/credentiallessness
cors-or-credentialless
andrequire-corp
are similar. One or the other is a requirements for thewindow.crossOriginIsolated
capability. They both share the same set of checks.They differ mostly in the fetch specification.
require-corp
requires a CORP header for cross-origin no-cors responses.cors-or-credentialless
doesn't, but omits credentials (Cookies, clients certificates, etc...) in exchange.I am opening this bug to reference several PR against the HTML, Fetch and ServiceWorker spec. So they can be discussed more widely.
Some tentative tests have been written into the wpt repository:
https://wpt.fyi/results/html/cross-origin-embedder-policy/credentialless/cors-or-credentialless?label=master&label=experimental&aligned&q=cors-or-credentialless
The text was updated successfully, but these errors were encountered: