Support Cross Origin Resource Policy (CORP) (Previously From-Origin)
Categories
(Core :: DOM: Core & HTML, enhancement, P2)
Tracking
()
People
(Reporter: tjr, Assigned: valentin)
References
(Depends on 1 open bug, Blocks 2 open bugs)
Details
(Keywords: dev-doc-complete, parity-chrome, parity-safari)
Attachments
(1 file)
Alongside, CORB, From-Origin will mitigate cross-site resources from being loaded into a malicious content process. When a resource load (image, font, etc) is requested, the From_origin response header will be examined. If present and matching the requesting origin, it will be supplied to the content process and loaded. If non-matching, it will be rejected in some way and not loaded into the content process. https://github.com/whatwg/fetch/issues/687
|
||
Updated•6 years ago
|
|
||
Comment 1•6 years ago
|
||
web-platform-tests tests are in fetch/cross-origin-resource-policy.
|
Reporter | |
Updated•6 years ago
|
|
||
Updated•5 years ago
|
|
|
Reporter | |
Updated•5 years ago
|
|
||
Updated•5 years ago
|
|
||
Updated•5 years ago
|
|
||
Comment 3•5 years ago
|
||
dev-doc-needed
Some initial docs at https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP) - though compat. data will need updating when this ships, of course.
|
Assignee | |
Updated•5 years ago
|
|
|
||
Updated•5 years ago
|
|
|
Assignee | |
Comment 4•5 years ago
|
||
Pushed by valentin.gosu@gmail.com: https://hg.mozilla.org/integration/autoland/rev/75bf71e58f29 Support Cross Origin Resource Policy (CORP) r=mayhemer
|
||
Comment 6•5 years ago
|
||
| bugherder | ||
|
|
||
Comment 7•5 years ago
|
||
Is this behind a flag for the minute (browser.tabs.remote.useCORP)? Is it off by default?
|
|
Reporter | |
Comment 8•5 years ago
|
||
(In reply to lol768 from comment #7)
Is this behind a flag for the minute (browser.tabs.remote.useCORP)? Is it off by default?
Yes, it is currently behind that pref, disabled by default.
|
|
||
Comment 9•5 years ago
|
||
This got documented already, thank you Adam!
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy
The compat tables still claims this is in 69 without pref, but I've opened https://github.com/mdn/browser-compat-data/pull/4572 to fix that.
Review appreciated as always.
|
||
Updated•5 years ago
|
Description
•