Closed Bug 1459357 (corb) Opened 6 years ago Closed 2 years ago

Cross-Origin Read Blocking (CORB)

Categories

(Core :: DOM: Core & HTML, enhancement, P3)

enhancement

Tracking

()

RESOLVED WONTFIX
Fission Milestone Future

People

(Reporter: lukasza, Unassigned)

References

(Blocks 3 open bugs)

Details

(Whiteboard: [sp3])

Cross-origin read blocking, better known as CORB, is an algorithm by which dubious cross-origin resource fetches are identified and blocked before they reach a web page. CORB reduces the risk of leaking sensitive data by keeping it further from cross-origin web pages.  In most browsers, it keeps such data out of untrusted script execution contexts. In browsers with Site Isolation, it can keep such data out of untrusted renderer processes entirely, helping even against side channel attacks.

More info:
- Explainer: https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md
- WhatWG issue: https://github.com/whatwg/fetch/issues/681
- PR for Fetch spec changes: https://github.com/whatwg/fetch/pull/686
- Initial public support from Firefox: https://groups.google.com/a/chromium.org/forum/#!msg/site-isolation-dev/pp5C8XKz7AI/2zNOn-S_BgAJ
Mentor: annevk
FYI: I'm about to land the Fetch PR. It standardizes all the bits of CORB that can be implemented without sniffing the response. Tests can be found in fetch/corb in web-platform-tests.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Blocks: fetch
Component: Security → DOM
Priority: -- → P3
Fission Milestone: --- → Future

I'm no longer convinced we should do this. Bug 1532642 is a much more secure approach that seems doable.

Component: DOM → DOM: Core & HTML
Severity: normal → S3

We're doing bug 1532642 , not this one.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX
Whiteboard: [sp3]
You need to log in before you can comment on or make changes to this bug.