diff --git a/fetch.bs b/fetch.bs index 016dc95cc..6dd75f6a7 100644 --- a/fetch.bs +++ b/fetch.bs @@ -1751,14 +1751,17 @@ source of security bugs. Please seek security review for features that deal with
-

To serialize a request URL for reporting, given a request -request, run these steps: +

To serialize a response URL for reporting, given a response +response, run these steps:

    +

  1. Assert: response's URL list is not empty. +

  2. -

    Let url be a copy of request's URL. +

    Let url be a copy of response's URL list's first + element. -

    This is not request's current URL in order to avoid +

    This is not response's URL in order to avoid leaking information about redirect targets (see similar considerations for CSP reporting too). [[CSP]] @@ -3147,23 +3150,56 @@ response header can be used to require checking a request< Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-origin" ; case-sensitive -

    To perform a cross-origin resource policy check, given a request and -response, run these steps:

    +

    To perform a cross-origin resource policy check, given an origin +origin, an environment settings object settingsObject, a +response response, and an optional boolean forNavigation, run +these steps:

      -

    1. If request's mode is not "no-cors", then return - allowed. +

    2. Set forNavigation to false if it is not given. + +

    3. Let embedderPolicy be settingsObject's + embedder policy.

    4. -

      If request's origin is same origin with - request's current URL's origin, then return - allowed. +

      If the cross-origin resource policy internal check with origin, + "unsafe-none", response, and + forNavigation returns blocked, then return blocked. -

      While redirects that carry a - `Cross-Origin-Resource-Policy` header are checked, redirects - without such a header resulting in response do not affect the outcome as the default is - allowed. - +

      This step is needed because we don't want to report violations not related to + Cross-Origin Embedder Policy below. + +

    5. If the cross-origin resource policy internal check with origin, + embedderPolicy's report only value, response, + and forNavigation returns blocked, then + queue a cross-origin embedder policy CORP violation report with response, + settingsObject, and true. + +

    6. If the cross-origin resource policy internal check with origin, + embedderPolicy's value, response, and + forNavigation returns allowed, then return allowed. + +

    7. Queue a cross-origin embedder policy CORP violation report with response, + settingsObject, and false. + +

    8. Return blocked. +

    + +

    Only HTML's navigate algorithm uses this check with +forNavigation set to true, and it's always for nested navigations. Otherwise, +response is either the internal response of an +opaque filtered response or a response which will be the +internal response of an +opaque filtered response. [[HTML]] + +

    To perform a cross-origin resource policy internal check, given an +origin origin, an embedder policy value +embedderPolicyValue, a response response, and a boolean +forNavigation, run these steps: + +

      +

    1. If forNavigation is true and embedderPolicyValue is + "unsafe-none", then return allowed.

    2. Let policy be the result of getting @@ -3171,31 +3207,93 @@ Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-or header list.

      This means that `Cross-Origin-Resource-Policy: same-site, same-origin` - ends up as allowed below as it will never match anything. Two or more - `Cross-Origin-Resource-Policy` headers will have the same effect. + ends up as allowed below as it will never match anything, as long as + embedderPolicyValue is "unsafe-none". + Two or more `Cross-Origin-Resource-Policy` headers will have the + same effect. + +

    3. If policy is neither `same-origin`, `same-site`, nor + `cross-origin`, then set policy to null. -

    4. If policy is `same-origin`, then return blocked. +

    5. If policy is null and embedderPolicyValue is + "require-corp", then set policy to + `same-origin`.

    6. -

      If the following are true +

      Switch on policy: -

      +
      +
      null +
      `cross-origin` +

      Return allowed. -

      then return allowed. +

      `same-origin` +
      +

      If origin is same origin with response's URL's + origin, then return allowed. -

      This prevents HTTPS responses with - `Cross-Origin-Resource-Policy: same-site` from being accessed without secure - transport. +

      Otherwise, return blocked. -

    7. If policy is `same-site`, then return blocked. +

      `same-site` +
      +

      If the following are true -

    8. Return allowed. +

      + +

      then return allowed. + +

      Otherwise, return blocked. + +

      `Cross-Origin-Resource-Policy: same-site` does not consider a + response delivered via a secure transport to match a non-secure requesting origin, + even if their hosts are otherwise same site. Securely-transported responses will only + match a securely-transported initiator. +

      9. +
    + +

    To queue a cross-origin embedder policy CORP violation report, given a +response response, an environment settings object +settingsObject, and a boolean reportOnly, run these steps: + +

      +

    1. Let endpoint be settingsObject's + embedder policy's + report only reporting endpoint if reportOnly is true and + settingsObject's embedder policy's + reporting endpoint otherwise. + +

    2. Let serialized url be the result of + serializing a response URL for reporting with + response. + +

    3. +

      Let body be a new object containing the following properties: + + + + + + + + + + +
      key + value +
      "type" + "corp" +
      "blocked-url" + serialized url +
      + +

    4. Queue body as the "coep" report type for + endpoint on settingsObject. [[!REPORTING]]

    @@ -3589,9 +3687,8 @@ optionally with a recursive flag, run these steps:

    If internalResponse's URL list is empty, then set it to a clone of request's URL list. -

    A response's URL list will typically be empty at - this point, unless it came from a service worker, in which case it will only be empty if it was - created through new Response(). +

    A response's URL list can be empty (for example, + when the response represents an about URL). @@ -3961,6 +4058,18 @@ optional CORS-preflight flag, run these steps: then set request's timing allow failed flag.

+
  • +

    If either request's response tainting or response's + type is "opaque", and the + cross-origin resource policy check with request's origin, + request's client, and actualResponse returns + blocked, then return a network error. + +

    The cross-origin resource policy check runs for responses coming from the + network and responses coming from the service worker. This is different from the + CORS check, as request's client and the service worker can + have different embedder policies. +

  • If actualResponse's status is a redirect status, then: @@ -4513,13 +4622,12 @@ Range Requests. [[HTTP-RANGE]] However, this is not widely supported by b +

  • Set response's URL list to a clone of + httpRequest's URL list. +

  • If httpRequest's header list contains `Range`, then set response's range-requested flag. -

  • If httpRequest's response tainting is not "cors" - and the cross-origin resource policy check with request and response - returns blocked, then return a network error. -

  • If response's status is 401, httpRequest's response tainting is not "cors", the