Skip to content

Commit 149b30f

Browse files
ArthurSonzogniArthurSonzogni
committed
Anonymous iframe
Explainer: https://github.com/camillelamy/explainers/blob/main/anonymous_iframes.md Chrome status: https://chromestatus.com/feature/5729461725036544 Summary: - Define the anonymous flag for iframe and Window. - Inheritance is defined similarly to sandbox. However it do not propage toward popups. - Popup opened from anonymous Window use 'noopener'. - Navigation in anonymous iframe are allowed, even if the embedder has COEP:require-corp|credentialless and the response do not. - Define the `page anonymous nonce`, it is used for anonymous Window as an additional keys in: - network-partition-keys, - storage-partition-keys, - cookie-partition-keys This ensures the document is loaded within a new and ephemeral context. This prevents a cross-origin-isolated parent from stealing important data from its child, via a Spectre Attack. - Password autofill must be disabled inside anonymous Window. XXX: implement the corresponding parts on top of: - Fetch => network-partition-keys - StoragePartitioning => storage-partition-keys - CookieHavingIndependantState => cookie-partition-key - Worker.
1 parent deef8ba commit 149b30f

File tree

1 file changed

+131
-26
lines changed

1 file changed

+131
-26
lines changed

‎source‎

Lines changed: 131 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2494,6 +2494,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
24942494
<li><dfn data-x="body safely extract" data-x-href="https://fetch.spec.whatwg.org/#bodyinit-safely-extract">safely extracting a body</dfn></li>
24952495
<li><dfn data-x-href="https://fetch.spec.whatwg.org/#process-response-end-of-body">processResponseConsumeBody</dfn></li>
24962496
<li><dfn data-x-href="https://fetch.spec.whatwg.org/#fetch-processresponseendofbody">processResponseEndOfBody</dfn></li>
2497+
<li><dfn data-x-href="https://fetch.spec.whatwg.org/#network-partition-keys">network-partition-keys</dfn></li>
24972498
<li>
24982499
<dfn data-x="concept-response"
24992500
data-x-href="https://fetch.spec.whatwg.org/#concept-response">response</dfn> and its
@@ -30831,6 +30832,7 @@ href="?audio">audio&lt;/a> test instead.)&lt;/p></code></pre>
3083130832
<dd><code data-x="attr-dim-height">height</code></dd>
3083230833
<dd><code data-x="attr-iframe-referrerpolicy">referrerpolicy</code></dd>
3083330834
<dd><code data-x="attr-iframe-loading">loading</code></dd>
30835+
<dd><code data-x="attr-iframe-anonymous">anonymous</code></dd>
3083430836
<dt><span
3083530837
data-x="concept-element-accessibility-considerations">Accessibility considerations</span>:</dt>
3083630838
<dd><a href="https://w3c.github.io/html-aria/#el-iframe">For authors</a>.</dd>
@@ -31541,6 +31543,12 @@ interface <dfn interface>HTMLIFrameElement</dfn> : <span>HTMLElement</span> {
3154131543
<li><p>Invoke <var>resumptionSteps</var>.</p></li>
3154231544
</ol>
3154331545

31546+
<hr> <!-- ANONYMOUS ATTRIBUTE -->
31547+
31548+
<p>The <dfn element-attr for="iframe"><code data-x="attr-iframe-anonymous">anonymous</code></dfn>
31549+
attribute, enables loading documents hosted by the <code>iframe</code> with a new and ephemeral
31550+
storage partition. It is a boolean value. The default is false.</p>
31551+
3154431552
<hr> <!-- FALLBACK -->
3154531553

3154631554
<p>Descendants of <code>iframe</code> elements represent nothing. (In legacy user agents that do
@@ -80302,6 +80310,10 @@ popup4.close();</code></pre></div>
8030280310
<li><p>Let <var>sandboxFlags</var> be the result of <span>determining the creation sandboxing
8030380311
flags</span> given <var>browsingContext</var> and <var>embedder</var>.</p></li>
8030480312

80313+
<li><p>Let <var>anonymous</var> be the result of determining the <span
80314+
data-x="initial-window-anonymous">initial window anonymous</span> flag, given
80315+
<var>browsingContext</var>.</p></li>
80316+
8030580317
<!--
8030680318
This step does not need to use |embedder|, because determining the origin only consults the
8030780319
container when the url argument is about:srcdoc. However, here we always pass about:blank.
@@ -80326,7 +80338,8 @@ popup4.close();</code></pre></div>
8032680338
realm</span> given <var>agent</var> and the following customizations:</p>
8032780339

8032880340
<ul>
80329-
<li><p>For the global object, create a new <code>Window</code> object.</p></li>
80341+
<li><p>For the global object, create a new <code>Window</code> object, with <code
80342+
data-x="attr-iframe-anonymous">anonymous</code> set to <var>anonymous</var>.</p></li>
8033080343

8033180344
<li><p>For the global <b>this</b> binding, use <var>browsingContext</var>'s
8033280345
<code>WindowProxy</code> object.</li>
@@ -81701,6 +81714,7 @@ interface <dfn interface>Window</dfn> : <span>EventTarget</span> {
8170181714
attribute DOMString <span data-x="dom-window-status">status</span>;
8170281715
undefined <span data-x="dom-window-close">close</span>();
8170381716
readonly attribute boolean <span data-x="dom-window-closed">closed</span>;
81717+
readonly attribute boolean <span data-x="dom-window-anonymous">anonymous</span>;
8170481718
undefined <span data-x="dom-window-stop">stop</span>();
8170581719
undefined <span data-x="dom-window-focus">focus</span>();
8170681720
undefined <span data-x="dom-window-blur">blur</span>();
@@ -81900,6 +81914,9 @@ dictionary <dfn dictionary>WindowPostMessageOptions</dfn> : <span>StructuredSeri
8190081914

8190181915
<li><p>If <var>noreferrer</var> is true, then set <var>noopener</var> to true.</p></li>
8190281916

81917+
<li><p>If <span>entry global object</span>'s <span data-x="dom-window-anonymous">anonymous</span>
81918+
flag is true, then set <var>noopener</var> to true.</p></li>
81919+
8190381920
<li>
8190481921
<p>Let <var>target browsing context</var> and <var>windowType</var> be the result of applying
8190581922
<span>the rules for choosing a browsing context</span> given <var>target</var>, <var>source
@@ -84050,6 +84067,70 @@ interface <dfn interface>BarProp</dfn> {
8405084067

8405184068

8405284069

84070+
<h3>Anonymous iframe</h3>
84071+
84072+
<p>Each <code>iframe</code> element has a mutable <code
84073+
data-x="attr-iframe-anonymous">anonymous</code> flag attribute.</p>
84074+
84075+
<p>Each <code>Window</code> has a constant <dfn attribute for="Window"
84076+
data-x="dom-window-anonymous"><code>anonymous</code></dfn> flag.</p>
84077+
84078+
<p>An <dfn>anonymous Window</dfn> is a <code>Window</code>, whose <code
84079+
data-x="dom-window-anonymous">anonymous</code> flag is true.</p>
84080+
84081+
<p>To compute the <dfn data-x="initial-window-anonymous">initial window anonymous flag</dfn>,
84082+
given a new <span data-x="concept-document-bc">browsing context</span> <var>browsing
84083+
context</var>:</p>
84084+
<ol class="brief">
84085+
<li><p>Set <var>embedder</var> be <var>browsing context</var>'s <span
84086+
data-x="bc-container">container</span>.</p>
84087+
<li><p>If <var>embedder</var> is not an element, return false.</p></li>
84088+
<li><p>Otherwise, set <var>parentWindow</var> be the <var>embedder</var>'s <span>node
84089+
document</span>'s <span>relevant global object</span>.</p></li>
84090+
<li><p>Return the union of:</p>
84091+
<ul class="brief">
84092+
<li><p><var>parentWindow</var>'s <code attribute for="Window"
84093+
data-x="dom-window-anonymous">anonymous</code></p></li>
84094+
<li><p><var>embedder</var>'s <span><code>iframe</code></span>'s <code
84095+
data-x="attr-iframe-anonymous">anonymous</code></p></li>
84096+
</ul>
84097+
</li>
84098+
</ol>
84099+
84100+
<p>To compute the <dfn data-x="navigation-anonymous">navigation's anonymous flag</dfn>,
84101+
given <span data-x="concept-document-bc">browsing context</span> <var>browsing
84102+
context</var>, follows the same steps as in the <span
84103+
data-x="initial-window-anonymous">initial window anonymous flag</span> algorithm.</p>
84104+
84105+
<p class="note">New <code>Window</code>'s <code data-x="dom-window-anonymous">anonymous</code>
84106+
flag is computed either from the <span data-x="initial-window-anonymous">initial window anonymous
84107+
flag</span> algorithm for new <span data-x="concept-document-bc">browsing context</span>, or from
84108+
the <span data-x="navigation-anonymous">navigation's anonymous flag</span> algorithm, executed
84109+
when the navigation started, for navigations inside pre-existing <span
84110+
data-x="concept-document-bc">browsing context</span>.</p>
84111+
84112+
<p class="note">Popup opened from <span>anonymous Window</span> are always with 'noopener' set</p>
84113+
84114+
<p class="note">Top-level <span>anonymous Window</span> do not exist.</p>
84115+
84116+
<p>Each top-level <span>Window</span> has an associated <dfn export>page anonymous nonce</dfn>. It
84117+
is an immutable nonce ("number used once").</p>
84118+
84119+
<p class="XXX">The <span>page anonymous nonce</span> is meant to be used for <span>anonymous
84120+
Window</span> as a key in <span>network-partition-keys</span>, storage-partition-keys, and
84121+
cookie-partition-keys for <span>anonymous Window</span>. See <a
84122+
href="https://github.com/whatwg/fetch/issues/904">Network state partitionning</a>, <a
84123+
href="https://privacycg.github.io/storage-partitioning/">Client-Side Storage Partitioning</a>, and
84124+
<a href="https://github.com/WICG/CHIPS">CHIPS (Cookies Having Independant Partitioned
84125+
State</a>.</p>
84126+
84127+
<p><dfn>Autofill and anonymous iframe</dfn>: User agents sometimes have features for helping users
84128+
fill forms in: for example prefilling the user's address, password, or payment informations. User
84129+
agents must disable those features when the data is both specific to the user and to the website.
84130+
</p>
84131+
84132+
84133+
8405384134
<h3>Cross-origin opener policies</h3>
8405484135

8405584136
<p>A <dfn>cross-origin opener policy value</dfn> allows a document which is navigated to in a
@@ -85422,7 +85503,8 @@ interface <dfn interface>BarProp</dfn> {
8542285503

8542385504
<p>To <dfn>check a navigation response's adherence to its embedder policy</dfn> given a <span
8542485505
data-x="concept-response">response</span> <var>response</var>, a <span>browsing context</span>
85425-
<var>target</var>, and an <span>embedder policy</span> <var>responsePolicy</var>:</p>
85506+
<var>target</var>, an <span>embedder policy</span> <var>responsePolicy</var>, and a boolean
85507+
<var>anonymous</var>:</p>
8542685508

8542785509
<ol>
8542885510
<li><p>If <var>target</var> is not a <span>child browsing context</span>, then return
@@ -85435,18 +85517,18 @@ interface <dfn interface>BarProp</dfn> {
8543585517

8543685518
<li><p>If <var>parentPolicy</var>'s <span data-x="embedder-policy-report-only-value">report-only
8543785519
value</span> is <span>compatible with cross-origin isolation</span> and
85438-
<var>responsePolicy</var>'s <span data-x="embedder-policy-value">value</span> is not, then
85439-
<span>queue a cross-origin embedder policy inheritance violation</span> with <var>response</var>,
85440-
"<code data-x="">navigation</code>", <var>parentPolicy</var>'s <span
85441-
data-x="embedder-policy-report-only-reporting-endpoint">report only reporting endpoint</span>,
85442-
"<code data-x="">reporting</code>", and <var>target</var>'s <span
85520+
<var>responsePolicy</var>'s <span data-x="embedder-policy-value">value</span> is not, and
85521+
<var>anonymous</var> is false, then <span>queue a cross-origin embedder policy inheritance
85522+
violation</span> with <var>response</var>, "<code data-x="">navigation</code>",
85523+
<var>parentPolicy</var>'s <span data-x="embedder-policy-report-only-reporting-endpoint">report
85524+
only reporting endpoint</span>, "<code data-x="">reporting</code>", and <var>target</var>'s <span
8544385525
data-x="bc-container-document">container document</span>'s <span>relevant settings
8544485526
object</span>.</p></li>
8544585527

8544685528
<li><p>If <var>parentPolicy</var>'s <span data-x="embedder-policy-value">value</span> is not
8544785529
<span>compatible with cross-origin isolation</span> or <var>responsePolicy</var>'s <span
8544885530
data-x="embedder-policy-value">value</span> is <span>compatible with cross-origin
85449-
isolation</span>, then return true.</p></li>
85531+
isolation</span>, or <var>anonymous</var> is true, then return true.</p></li>
8545085532

8545185533
<li><p><span>Queue a cross-origin embedder policy inheritance violation</span> with
8545285534
<var>response</var>, "<code data-x="">navigation</code>", <var>parentPolicy</var>'s <span
@@ -87571,6 +87653,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8757187653
<dt><dfn data-x="navigation-params-sandboxing">final sandboxing flag set</dfn></dt>
8757287654
<dd>a <span>sandboxing flag set</span> to impose on the new <code>Document</code></dd>
8757387655

87656+
<dt><dfn data-x="navigation-params-anonymous">anonymous</dfn></dt>
87657+
<dd>The anonymous flag to impose on the new <code>Window</code></dd>
87658+
8757487659
<dt><dfn data-x="navigation-params-coop">cross-origin opener policy</dfn></dt>
8757587660
<dd>a <span>cross-origin opener policy</span> to use for the new <code>Document</code></dd>
8757687661

@@ -87823,6 +87908,10 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8782387908
flags</span> given <var>browsingContext</var> and <var>browsingContext</var>'s <span
8782487909
data-x="bc-container">container</span>.</p></li>
8782587910

87911+
<li><p>Let <var>anonymous</var> be the result of computing the <span
87912+
data-x="navigation-anonymous">navigation's anonymous flag</span>, given
87913+
<var>browsingContext.</var></p></li>
87914+
8782687915
<li><p>Let <var>allowedToDownload</var> be the result of running the <span>allowed to
8782787916
download</span> algorithm given the <span>source browsing context</span> and
8782887917
<var>browsingContext</var>.</p></li>
@@ -87893,8 +87982,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8789387982
data-x="navigation-params-policy-container">policy container</span> is
8789487983
<var>policyContainer</var>, <span data-x="navigation-params-sandboxing">final sandboxing
8789587984
flag set</span> is <var>finalSandboxFlags</var>, <span
87896-
data-x="navigation-params-coop">cross-origin opener policy</span> is <var>coop</var>, <span
87897-
data-x="navigation-params-coop-enforcement-result">COOP enforcement result</span> is
87985+
data-x="navigation-params-anonymous">anonymous</span> is <var>anonymous</var>, <span
87986+
data-x="navigation-params-coop">cross-origin opener policy</span> is <var>coop</var>,
87987+
<span data-x="navigation-params-coop-enforcement-result">COOP enforcement result</span> is
8789887988
<var>coopEnforcementResult</var>, <span
8789987989
data-x="navigation-params-reserved-environment">reserved environment</span> is null, <span
8790087990
data-x="navigation-params-browsing-context">browsing context</span> is
@@ -87950,8 +88040,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8795088040
data-x="navigation-params-policy-container">policy container</span> is
8795188041
<var>browsingContext</var>'s <span>active document</span>'s <span>policy container</span>,
8795288042
<span data-x="navigation-params-sandboxing">final sandboxing flag set</span> is
87953-
<var>finalSandboxFlags</var>, <span data-x="navigation-params-coop">cross-origin opener
87954-
policy</span> is <var>browsingContext</var>'s <span>active document</span>'s <span
88043+
<var>finalSandboxFlags</var>, <span data-x="navigation-params-anonymous">anonymous</span> is
88044+
<var>anonymous</var>, <span data-x="navigation-params-coop">cross-origin opener policy</span>
88045+
is <var>browsingContext</var>'s <span>active document</span>'s <span
8795588046
data-x="concept-document-coop">cross-origin opener policy</span>, <span
8795688047
data-x="navigation-params-coop-enforcement-result">COOP enforcement result</span> is
8795788048
<var>coopEnforcementResult</var>, <span
@@ -87986,10 +88077,11 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8798688077

8798788078
<dd><p>Run <span>process a navigate fetch</span> given <var>navigationId</var>,
8798888079
<var>resource</var>, the <span>source browsing context</span>, <var>browsingContext</var>,
87989-
<var>navigationType</var>, <var>sandboxFlags</var>, <var>historyPolicyContainer</var>,
87990-
<var>initiatorPolicyContainer</var>, <var>allowedToDownload</var>,
87991-
<var>hasTransientActivation</var>, <var>incumbentNavigationOrigin</var>,
87992-
<var>historyHandling</var>, and <var>unsafeNavigationStartTime</var>.</p></dd>
88080+
<var>navigationType</var>, <var>sandboxFlags</var>, <var>anonymous</var>,
88081+
<var>historyPolicyContainer</var>, <var>initiatorPolicyContainer</var>,
88082+
<var>allowedToDownload</var>, <var>hasTransientActivation</var>,
88083+
<var>incumbentNavigationOrigin</var>, <var>historyHandling</var>, and
88084+
<var>unsafeNavigationStartTime</var>.</p></dd>
8799388085

8799488086
<dt>Otherwise, <var>resource</var> is a <span data-x="concept-request">request</span> whose
8799588087
<span data-x="concept-request-url">URL</span>'s <span data-x="concept-url-scheme">scheme</span>
@@ -88006,12 +88098,12 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8800688098
data-x="navigation-id">navigation id</span> <var>navigationId</var>, <span
8800788099
data-x="concept-request">request</span> <var>request</var>, two <span data-x="browsing
8800888100
context">browsing contexts</span> <var>sourceBrowsingContext</var> and <var>browsingContext</var>,
88009-
a string <var>navigationType</var>, a <span>sandboxing flag set</span> <var>sandboxFlags</var>,
88010-
two <span data-x="policy container">policy containers</span> <var>historyPolicyContainer</var> and
88011-
<var>initiatorPolicyContainer</var>, a boolean <var>allowedToDownload</var>, a boolean
88012-
<var>hasTransientActivation</var>, an <span>origin</span> <var>incumbentNavigationOrigin</var>,
88013-
a <span>history handling behavior</span> <var>historyHandling</var>, and a number
88014-
<var>unsafeNavigationStartTime</var>:</p>
88101+
a string <var>navigationType</var>, a <span>sandboxing flag set</span> <var>sandboxFlags</var>, a
88102+
boolean <var>anonymous</var>, two <span data-x="policy container">policy containers</span>
88103+
<var>historyPolicyContainer</var> and <var>initiatorPolicyContainer</var>, a boolean
88104+
<var>allowedToDownload</var>, a boolean <var>hasTransientActivation</var>, an <span>origin</span>
88105+
<var>incumbentNavigationOrigin</var>, a <span>history handling behavior</span>
88106+
<var>historyHandling</var>, and a number <var>unsafeNavigationStartTime</var>:</p>
8801588107

8801688108
<ol>
8801788109
<li><p>Let <var>response</var> be null.</p></li>
@@ -88290,6 +88382,7 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8829088382
data-x="navigation-params-policy-container">policy container</span> is
8829188383
<var>resultPolicyContainer</var>, <span data-x="navigation-params-sandboxing">final sandboxing
8829288384
flag set</span> is <var>finalSandboxFlags</var>, <span
88385+
data-x="navigation-params-anonymous">anonymous</span> is <var>anonymous</var>, <span
8829388386
data-x="navigation-params-coop">cross-origin opener policy</span> is <var>responseCOOP</var>,
8829488387
<span data-x="navigation-params-coop-enforcement-result">COOP enforcement result</span> is
8829588388
<var>coopEnforcementResult</var>, <span data-x="navigation-params-reserved-environment">reserved
@@ -88339,8 +88432,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8833988432
embedder policy">checking a navigation response's adherence to its embedder policy</span> given
8834088433
<var>response</var>, <var>browsingContext</var>, and <var>navigationParams</var>'s <span
8834188434
data-x="navigation-params-policy-container">policy container</span>'s <span
88342-
data-x="policy-container-embedder-policy">embedder policy</span> is false, then set
88343-
<var>failure</var> to true.</p>
88435+
data-x="policy-container-embedder-policy">embedder policy</span> and
88436+
<var>navigationparams</var>'s <span data-x="navigation-params-anonymous">anonymous</span> flag
88437+
is false, then set <var>failure</var> to true.</p>
8834488438

8834588439
<p>Otherwise, if the result of <span data-x="check a navigation response's adherence to
8834688440
`X-Frame-Options`">checking a navigation response's adherence to
@@ -88705,7 +88799,10 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8870588799
data-x="hh-replace">replace</code>", and <var>browsingContext</var>'s <span>active
8870688800
document</span>'s <span data-x="concept-document-origin">origin</span> is <span>same
8870788801
origin-domain</span> with <var>navigationParams</var>'s <span
88708-
data-x="navigation-params-origin">origin</span>, then do nothing.</p>
88802+
data-x="navigation-params-origin">origin</span>, and <var>browsingContext</var>'s <span>active
88803+
window</span>'s <span data-x="dom-window-anonymous">anonymous</span> flag matches
88804+
<var>navigationParams</var>'s <span data-x="navigation-params-anonymous">anonymous</span> flag,
88805+
then do nothing.</p>
8870988806

8871088807
<p class="note">This means that both the <span data-x="is initial about:blank">initial
8871188808
<code>about:blank</code></span> <code>Document</code>, and the new <code>Document</code> that is
@@ -88739,7 +88836,9 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
8873988836
realm</span> given <var>agent</var> and the following customizations:</p>
8874088837

8874188838
<ul>
88742-
<li><p>For the global object, create a new <code>Window</code> object.</p></li>
88839+
<li><p>For the global object, create a new <code>Window</code> object, with <code
88840+
data-x="attr-iframe-anonymous">anonymous</code> to <var>navigationParams</var>'s <span
88841+
data-x="navigation-params-anonymous">anonymous</span>.</p></li>
8874388842

8874488843
<li><p>For the global <b>this</b> binding, use <var>browsingContext</var>'s
8874588844
<code>WindowProxy</code> object.</p></li>
@@ -123826,6 +123925,12 @@ interface <dfn interface>External</dfn> {
123826123925
<code data-x="attr-input-alt">input</code>
123827123926
<td> Replacement text for use when images are not available
123828123927
<td> <a href="#attribute-text">Text</a>*
123928+
<tr>
123929+
<th> <code data-x="">anonymous</code>
123930+
<td> <code data-x="attr-iframe-anonymous">iframe</code>
123931+
<td> Whether the <code>iframe</code>'s contents to be loaded using a new ephemeral storage
123932+
partition.
123933+
<td> <span>Boolean attribute</span>
123829123934
<tr>
123830123935
<th> <code data-x="">as</code>
123831123936
<td> <code data-x="attr-link-as">link</code>

0 commit comments

Comments
 (0)