Skip to content

Commit c64d811

Browse files
ArthurSonzogniArthurSonzogni
committed
Anonymous iframe
Explainer: https://github.com/camillelamy/explainers/blob/main/anonymous_iframes.md Chrome status: https://chromestatus.com/feature/5729461725036544 Summary: - Define the anonymous flag for iframe and Window. - Inheritance is defined similarly to sandbox. However it do not propage toward popups. - Popup opened from anonymous Window use 'noopener'. - Navigation in anonymous iframe are allowed, even if the embedder has COEP:require-corp|credentialless and the response do not. - Define the `page anonymous nonce`, it is used for anonymous Window as an additional keys in: - network-partition-keys, - storage-partition-keys, - cookie-partition-keys This ensures the document is loaded within a new and ephemeral context. This prevents a cross-origin-isolated parent from stealing important data from its child, via a Spectre Attack. - Password autofill must be disabled inside anonymous Window. XXX: implement the corresponding parts on top of: - Fetch => network-partition-keys - StoragePartitioning => storage-partition-keys - CookieHavingIndependantState => cookie-partition-key - Worker.
1 parent de7370b commit c64d811

File tree

1 file changed

+131
-26
lines changed

1 file changed

+131
-26
lines changed

‎source‎

Lines changed: 131 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2495,6 +2495,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
24952495
<li><dfn data-x="body safely extract" data-x-href="https://fetch.spec.whatwg.org/#bodyinit-safely-extract">safely extracting a body</dfn></li>
24962496
<li><dfn data-x-href="https://fetch.spec.whatwg.org/#process-response-end-of-body">processResponseConsumeBody</dfn></li>
24972497
<li><dfn data-x-href="https://fetch.spec.whatwg.org/#fetch-processresponseendofbody">processResponseEndOfBody</dfn></li>
2498+
<li><dfn data-x-href="https://fetch.spec.whatwg.org/#network-partition-keys">network-partition-keys</dfn></li>
24982499
<li>
24992500
<dfn data-x="concept-response"
25002501
data-x-href="https://fetch.spec.whatwg.org/#concept-response">response</dfn> and its
@@ -30891,6 +30892,7 @@ href="?audio">audio&lt;/a> test instead.)&lt;/p></code></pre>
3089130892
<dd><code data-x="attr-dim-height">height</code></dd>
3089230893
<dd><code data-x="attr-iframe-referrerpolicy">referrerpolicy</code></dd>
3089330894
<dd><code data-x="attr-iframe-loading">loading</code></dd>
30895+
<dd><code data-x="attr-iframe-anonymous">anonymous</code></dd>
3089430896
<dt><span
3089530897
data-x="concept-element-accessibility-considerations">Accessibility considerations</span>:</dt>
3089630898
<dd><a href="https://w3c.github.io/html-aria/#el-iframe">For authors</a>.</dd>
@@ -31601,6 +31603,12 @@ interface <dfn interface>HTMLIFrameElement</dfn> : <span>HTMLElement</span> {
3160131603
<li><p>Invoke <var>resumptionSteps</var>.</p></li>
3160231604
</ol>
3160331605

31606+
<hr> <!-- ANONYMOUS ATTRIBUTE -->
31607+
31608+
<p>The <dfn element-attr for="iframe"><code data-x="attr-iframe-anonymous">anonymous</code></dfn>
31609+
attribute, enables loading documents hosted by the <code>iframe</code> with a new and ephemeral
31610+
storage partition. It is a boolean value. The default is false.</p>
31611+
3160431612
<hr> <!-- FALLBACK -->
3160531613

3160631614
<p>Descendants of <code>iframe</code> elements represent nothing. (In legacy user agents that do
@@ -80362,6 +80370,10 @@ popup4.close();</code></pre></div>
8036280370
<li><p>Let <var>sandboxFlags</var> be the result of <span>determining the creation sandboxing
8036380371
flags</span> given <var>browsingContext</var> and <var>embedder</var>.</p></li>
8036480372

80373+
<li><p>Let <var>anonymous</var> be the result of determining the <span
80374+
data-x="initial-window-anonymous">initial window anonymous</span> flag, given
80375+
<var>browsingContext</var>.</p></li>
80376+
8036580377
<!--
8036680378
This step does not need to use |embedder|, because determining the origin only consults the
8036780379
container when the url argument is about:srcdoc. However, here we always pass about:blank.
@@ -80386,7 +80398,8 @@ popup4.close();</code></pre></div>
8038680398
realm</span> given <var>agent</var> and the following customizations:</p>
8038780399

8038880400
<ul>
80389-
<li><p>For the global object, create a new <code>Window</code> object.</p></li>
80401+
<li><p>For the global object, create a new <code>Window</code> object, with <code
80402+
data-x="attr-iframe-anonymous">anonymous</code> set to <var>anonymous</var>.</p></li>
8039080403

8039180404
<li><p>For the global <b>this</b> binding, use <var>browsingContext</var>'s
8039280405
<code>WindowProxy</code> object.</li>
@@ -81761,6 +81774,7 @@ interface <dfn interface>Window</dfn> : <span>EventTarget</span> {
8176181774
attribute DOMString <span data-x="dom-window-status">status</span>;
8176281775
undefined <span data-x="dom-window-close">close</span>();
8176381776
readonly attribute boolean <span data-x="dom-window-closed">closed</span>;
81777+
readonly attribute boolean <span data-x="dom-window-anonymous">anonymous</span>;
8176481778
undefined <span data-x="dom-window-stop">stop</span>();
8176581779
undefined <span data-x="dom-window-focus">focus</span>();
8176681780
undefined <span data-x="dom-window-blur">blur</span>();
@@ -81960,6 +81974,9 @@ dictionary <dfn dictionary>WindowPostMessageOptions</dfn> : <span>StructuredSeri
8196081974

8196181975
<li><p>If <var>noreferrer</var> is true, then set <var>noopener</var> to true.</p></li>
8196281976

81977+
<li><p>If <span>entry global object</span>'s <span data-x="dom-window-anonymous">anonymous</span>
81978+
flag is true, then set <var>noopener</var> to true.</p></li>
81979+
8196381980
<li>
8196481981
<p>Let <var>target browsing context</var> and <var>windowType</var> be the result of applying
8196581982
<span>the rules for choosing a browsing context</span> given <var>target</var>, <var>source
@@ -84110,6 +84127,70 @@ interface <dfn interface>BarProp</dfn> {
8411084127

8411184128

8411284129

84130+
<h3>Anonymous iframe</h3>
84131+
84132+
<p>Each <code>iframe</code> element has a mutable <code
84133+
data-x="attr-iframe-anonymous">anonymous</code> flag attribute.</p>
84134+
84135+
<p>Each <code>Window</code> has a constant <dfn attribute for="Window"
84136+
data-x="dom-window-anonymous"><code>anonymous</code></dfn> flag.</p>
84137+
84138+
<p>An <dfn>anonymous Window</dfn> is a <code>Window</code>, whose <code
84139+
data-x="dom-window-anonymous">anonymous</code> flag is true.</p>
84140+
84141+
<p>To compute the <dfn data-x="initial-window-anonymous">initial window anonymous flag</dfn>,
84142+
given a new <span data-x="concept-document-bc">browsing context</span> <var>browsing
84143+
context</var>:</p>
84144+
<ol class="brief">
84145+
<li><p>Set <var>embedder</var> be <var>browsing context</var>'s <span
84146+
data-x="bc-container">container</span>.</p>
84147+
<li><p>If <var>embedder</var> is not an element, return false.</p></li>
84148+
<li><p>Otherwise, set <var>parentWindow</var> be the <var>embedder</var>'s <span>node
84149+
document</span>'s <span>relevant global object</span>.</p></li>
84150+
<li><p>Return the union of:</p>
84151+
<ul class="brief">
84152+
<li><p><var>parentWindow</var>'s <code attribute for="Window"
84153+
data-x="dom-window-anonymous">anonymous</code></p></li>
84154+
<li><p><var>embedder</var>'s <span><code>iframe</code></span>'s <code
84155+
data-x="attr-iframe-anonymous">anonymous</code></p></li>
84156+
</ul>
84157+
</li>
84158+
</ol>
84159+
84160+
<p>To compute the <dfn data-x="navigation-anonymous">navigation's anonymous flag</dfn>,
84161+
given <span data-x="concept-document-bc">browsing context</span> <var>browsing
84162+
context</var>, follows the same steps as in the <span
84163+
data-x="initial-window-anonymous">initial window anonymous flag</span> algorithm.</p>
84164+
84165+
<p class="note">New <code>Window</code>'s <code data-x="dom-window-anonymous">anonymous</code>
84166+
flag is computed either from the <span data-x="initial-window-anonymous">initial window anonymous
84167+
flag</span> algorithm for new <span data-x="concept-document-bc">browsing context</span>, or from
84168+
the <span data-x="navigation-anonymous">navigation's anonymous flag</span> algorithm, executed
84169+
when the navigation started, for navigations inside pre-existing <span
84170+
data-x="concept-document-bc">browsing context</span>.</p>
84171+
84172+
<p class="note">Popup opened from <span>anonymous Window</span> are always with 'noopener' set</p>
84173+
84174+
<p class="note">Top-level <span>anonymous Window</span> do not exist.</p>
84175+
84176+
<p>Each top-level <span>Window</span> has an associated <dfn export>page anonymous nonce</dfn>. It
84177+
is an immutable nonce ("number used once").</p>
84178+
84179+
<p class="XXX">The <span>page anonymous nonce</span> is meant to be used for <span>anonymous
84180+
Window</span> as a key in <span>network-partition-keys</span>, storage-partition-keys, and
84181+
cookie-partition-keys for <span>anonymous Window</span>. See <a
84182+
href="https://github.com/whatwg/fetch/issues/904">Network state partitionning</a>, <a
84183+
href="https://privacycg.github.io/storage-partitioning/">Client-Side Storage Partitioning</a>, and
84184+
<a href="https://github.com/WICG/CHIPS">CHIPS (Cookies Having Independant Partitioned
84185+
State</a>.</p>
84186+
84187+
<p><dfn>Autofill and anonymous iframe</dfn>: User agents sometimes have features for helping users
84188+
fill forms in: for example prefilling the user's address, password, or payment informations. User
84189+
agents must disable those features when the data is both specific to the user and to the website.
84190+
</p>
84191+
84192+
84193+
8411384194
<h3>Cross-origin opener policies</h3>
8411484195

8411584196
<p>A <dfn>cross-origin opener policy value</dfn> allows a document which is navigated to in a
@@ -85482,7 +85563,8 @@ interface <dfn interface>BarProp</dfn> {
8548285563

8548385564
<p>To <dfn>check a navigation response's adherence to its embedder policy</dfn> given a <span
8548485565
data-x="concept-response">response</span> <var>response</var>, a <span>browsing context</span>
85485-
<var>target</var>, and an <span>embedder policy</span> <var>responsePolicy</var>:</p>
85566+
<var>target</var>, an <span>embedder policy</span> <var>responsePolicy</var>, and a boolean
85567+
<var>anonymous</var>:</p>
8548685568

8548785569
<ol>
8548885570
<li><p>If <var>target</var> is not a <span>child browsing context</span>, then return
@@ -85495,18 +85577,18 @@ interface <dfn interface>BarProp</dfn> {
8549585577

8549685578
<li><p>If <var>parentPolicy</var>'s <span data-x="embedder-policy-report-only-value">report-only
8549785579
value</span> is <span>compatible with cross-origin isolation</span> and
85498-
<var>responsePolicy</var>'s <span data-x="embedder-policy-value">value</span> is not, then
85499-
<span>queue a cross-origin embedder policy inheritance violation</span> with <var>response</var>,
85500-
"<code data-x="">navigation</code>", <var>parentPolicy</var>'s <span
85501-
data-x="embedder-policy-report-only-reporting-endpoint">report only reporting endpoint</span>,
85502-
"<code data-x="">reporting</code>", and <var>target</var>'s <span
85580+
<var>responsePolicy</var>'s <span data-x="embedder-policy-value">value</span> is not, and
85581+
<var>anonymous</var> is false, then <span>queue a cross-origin embedder policy inheritance
85582+
violation</span> with <var>response</var>, "<code data-x="">navigation</code>",
85583+
<var>parentPolicy</var>'s <span data-x="embedder-policy-report-only-reporting-endpoint">report
85584+
only reporting endpoint</span>, "<code data-x="">reporting</code>", and <var>target</var>'s <span
8550385585
data-x="bc-container-document">container document</span>'s <span>relevant settings
8550485586
object</span>.</p></li>
8550585587

8550685588
<li><p>If <var>parentPolicy</var>'s <span data-x="embedder-policy-value">value</span> is not
8550785589
<span>compatible with cross-origin isolation</span> or <var>responsePolicy</var>'s <span
8550885590
data-x="embedder-policy-value">value</span> is <span>compatible with cross-origin
85509-
isolation</span>, then return true.</p></li>
85591+
isolation</span>, or <var>anonymous</var> is true, then return true.</p></li>
8551085592

8551185593
<li><p><span>Queue a cross-origin embedder policy inheritance violation</span> with
8551285594
<var>response</var>, "<code data-x="">navigation</code>", <var>parentPolicy</var>'s <span
@@ -87631,6 +87713,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8763187713
<dt><dfn data-x="navigation-params-sandboxing">final sandboxing flag set</dfn></dt>
8763287714
<dd>a <span>sandboxing flag set</span> to impose on the new <code>Document</code></dd>
8763387715

87716+
<dt><dfn data-x="navigation-params-anonymous">anonymous</dfn></dt>
87717+
<dd>The anonymous flag to impose on the new <code>Window</code></dd>
87718+
8763487719
<dt><dfn data-x="navigation-params-coop">cross-origin opener policy</dfn></dt>
8763587720
<dd>a <span>cross-origin opener policy</span> to use for the new <code>Document</code></dd>
8763687721

@@ -87883,6 +87968,10 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8788387968
flags</span> given <var>browsingContext</var> and <var>browsingContext</var>'s <span
8788487969
data-x="bc-container">container</span>.</p></li>
8788587970

87971+
<li><p>Let <var>anonymous</var> be the result of computing the <span
87972+
data-x="navigation-anonymous">navigation's anonymous flag</span>, given
87973+
<var>browsingContext.</var></p></li>
87974+
8788687975
<li><p>Let <var>allowedToDownload</var> be the result of running the <span>allowed to
8788787976
download</span> algorithm given the <span>source browsing context</span> and
8788887977
<var>browsingContext</var>.</p></li>
@@ -87953,8 +88042,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8795388042
data-x="navigation-params-policy-container">policy container</span> is
8795488043
<var>policyContainer</var>, <span data-x="navigation-params-sandboxing">final sandboxing
8795588044
flag set</span> is <var>finalSandboxFlags</var>, <span
87956-
data-x="navigation-params-coop">cross-origin opener policy</span> is <var>coop</var>, <span
87957-
data-x="navigation-params-coop-enforcement-result">COOP enforcement result</span> is
88045+
data-x="navigation-params-anonymous">anonymous</span> is <var>anonymous</var>, <span
88046+
data-x="navigation-params-coop">cross-origin opener policy</span> is <var>coop</var>,
88047+
<span data-x="navigation-params-coop-enforcement-result">COOP enforcement result</span> is
8795888048
<var>coopEnforcementResult</var>, <span
8795988049
data-x="navigation-params-reserved-environment">reserved environment</span> is null, <span
8796088050
data-x="navigation-params-browsing-context">browsing context</span> is
@@ -88010,8 +88100,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8801088100
data-x="navigation-params-policy-container">policy container</span> is
8801188101
<var>browsingContext</var>'s <span>active document</span>'s <span>policy container</span>,
8801288102
<span data-x="navigation-params-sandboxing">final sandboxing flag set</span> is
88013-
<var>finalSandboxFlags</var>, <span data-x="navigation-params-coop">cross-origin opener
88014-
policy</span> is <var>browsingContext</var>'s <span>active document</span>'s <span
88103+
<var>finalSandboxFlags</var>, <span data-x="navigation-params-anonymous">anonymous</span> is
88104+
<var>anonymous</var>, <span data-x="navigation-params-coop">cross-origin opener policy</span>
88105+
is <var>browsingContext</var>'s <span>active document</span>'s <span
8801588106
data-x="concept-document-coop">cross-origin opener policy</span>, <span
8801688107
data-x="navigation-params-coop-enforcement-result">COOP enforcement result</span> is
8801788108
<var>coopEnforcementResult</var>, <span
@@ -88046,10 +88137,11 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8804688137

8804788138
<dd><p>Run <span>process a navigate fetch</span> given <var>navigationId</var>,
8804888139
<var>resource</var>, the <span>source browsing context</span>, <var>browsingContext</var>,
88049-
<var>navigationType</var>, <var>sandboxFlags</var>, <var>historyPolicyContainer</var>,
88050-
<var>initiatorPolicyContainer</var>, <var>allowedToDownload</var>,
88051-
<var>hasTransientActivation</var>, <var>incumbentNavigationOrigin</var>,
88052-
<var>historyHandling</var>, and <var>unsafeNavigationStartTime</var>.</p></dd>
88140+
<var>navigationType</var>, <var>sandboxFlags</var>, <var>anonymous</var>,
88141+
<var>historyPolicyContainer</var>, <var>initiatorPolicyContainer</var>,
88142+
<var>allowedToDownload</var>, <var>hasTransientActivation</var>,
88143+
<var>incumbentNavigationOrigin</var>, <var>historyHandling</var>, and
88144+
<var>unsafeNavigationStartTime</var>.</p></dd>
8805388145

8805488146
<dt>Otherwise, <var>resource</var> is a <span data-x="concept-request">request</span> whose
8805588147
<span data-x="concept-request-url">URL</span>'s <span data-x="concept-url-scheme">scheme</span>
@@ -88066,12 +88158,12 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8806688158
data-x="navigation-id">navigation id</span> <var>navigationId</var>, <span
8806788159
data-x="concept-request">request</span> <var>request</var>, two <span data-x="browsing
8806888160
context">browsing contexts</span> <var>sourceBrowsingContext</var> and <var>browsingContext</var>,
88069-
a string <var>navigationType</var>, a <span>sandboxing flag set</span> <var>sandboxFlags</var>,
88070-
two <span data-x="policy container">policy containers</span> <var>historyPolicyContainer</var> and
88071-
<var>initiatorPolicyContainer</var>, a boolean <var>allowedToDownload</var>, a boolean
88072-
<var>hasTransientActivation</var>, an <span>origin</span> <var>incumbentNavigationOrigin</var>,
88073-
a <span>history handling behavior</span> <var>historyHandling</var>, and a number
88074-
<var>unsafeNavigationStartTime</var>:</p>
88161+
a string <var>navigationType</var>, a <span>sandboxing flag set</span> <var>sandboxFlags</var>, a
88162+
boolean <var>anonymous</var>, two <span data-x="policy container">policy containers</span>
88163+
<var>historyPolicyContainer</var> and <var>initiatorPolicyContainer</var>, a boolean
88164+
<var>allowedToDownload</var>, a boolean <var>hasTransientActivation</var>, an <span>origin</span>
88165+
<var>incumbentNavigationOrigin</var>, a <span>history handling behavior</span>
88166+
<var>historyHandling</var>, and a number <var>unsafeNavigationStartTime</var>:</p>
8807588167

8807688168
<ol>
8807788169
<li><p>Let <var>response</var> be null.</p></li>
@@ -88350,6 +88442,7 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8835088442
data-x="navigation-params-policy-container">policy container</span> is
8835188443
<var>resultPolicyContainer</var>, <span data-x="navigation-params-sandboxing">final sandboxing
8835288444
flag set</span> is <var>finalSandboxFlags</var>, <span
88445+
data-x="navigation-params-anonymous">anonymous</span> is <var>anonymous</var>, <span
8835388446
data-x="navigation-params-coop">cross-origin opener policy</span> is <var>responseCOOP</var>,
8835488447
<span data-x="navigation-params-coop-enforcement-result">COOP enforcement result</span> is
8835588448
<var>coopEnforcementResult</var>, <span data-x="navigation-params-reserved-environment">reserved
@@ -88399,8 +88492,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8839988492
embedder policy">checking a navigation response's adherence to its embedder policy</span> given
8840088493
<var>response</var>, <var>browsingContext</var>, and <var>navigationParams</var>'s <span
8840188494
data-x="navigation-params-policy-container">policy container</span>'s <span
88402-
data-x="policy-container-embedder-policy">embedder policy</span> is false, then set
88403-
<var>failure</var> to true.</p>
88495+
data-x="policy-container-embedder-policy">embedder policy</span> and
88496+
<var>navigationparams</var>'s <span data-x="navigation-params-anonymous">anonymous</span> flag
88497+
is false, then set <var>failure</var> to true.</p>
8840488498

8840588499
<p>Otherwise, if the result of <span data-x="check a navigation response's adherence to
8840688500
`X-Frame-Options`">checking a navigation response's adherence to
@@ -88765,7 +88859,10 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8876588859
data-x="hh-replace">replace</code>", and <var>browsingContext</var>'s <span>active
8876688860
document</span>'s <span data-x="concept-document-origin">origin</span> is <span>same
8876788861
origin-domain</span> with <var>navigationParams</var>'s <span
88768-
data-x="navigation-params-origin">origin</span>, then do nothing.</p>
88862+
data-x="navigation-params-origin">origin</span>, and <var>browsingContext</var>'s <span>active
88863+
window</span>'s <span data-x="dom-window-anonymous">anonymous</span> flag matches
88864+
<var>navigationParams</var>'s <span data-x="navigation-params-anonymous">anonymous</span> flag,
88865+
then do nothing.</p>
8876988866

8877088867
<p class="note">This means that both the <span data-x="is initial about:blank">initial
8877188868
<code>about:blank</code></span> <code>Document</code>, and the new <code>Document</code> that is
@@ -88799,7 +88896,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8879988896
realm</span> given <var>agent</var> and the following customizations:</p>
8880088897

8880188898
<ul>
88802-
<li><p>For the global object, create a new <code>Window</code> object.</p></li>
88899+
<li><p>For the global object, create a new <code>Window</code> object, with <code
88900+
data-x="attr-iframe-anonymous">anonymous</code> to <var>navigationParams</var>'s <span
88901+
data-x="navigation-params-anonymous">anonymous</span>.</p></li>
8880388902

8880488903
<li><p>For the global <b>this</b> binding, use <var>browsingContext</var>'s
8880588904
<code>WindowProxy</code> object.</p></li>
@@ -123905,6 +124004,12 @@ interface <dfn interface>External</dfn> {
123905124004
<code data-x="attr-input-alt">input</code>
123906124005
<td> Replacement text for use when images are not available
123907124006
<td> <a href="#attribute-text">Text</a>*
124007+
<tr>
124008+
<th> <code data-x="">anonymous</code>
124009+
<td> <code data-x="attr-iframe-anonymous">iframe</code>
124010+
<td> Whether the <code>iframe</code>'s contents to be loaded using a new ephemeral storage
124011+
partition.
124012+
<td> <span>Boolean attribute</span>
123908124013
<tr>
123909124014
<th> <code data-x="">as</code>
123910124015
<td> <code data-x="attr-link-as">link</code>

0 commit comments

Comments
 (0)