1459357 - (corb) Cross-Origin Read Blocking (CORB)

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, enhancement, P3)

Description

[lukasza]

Cross-origin read blocking, better known as CORB, is an algorithm by which dubious cross-origin resource fetches are identified and blocked before they reach a web page. CORB reduces the risk of leaking sensitive data by keeping it further from cross-origin web pages.  In most browsers, it keeps such data out of untrusted script execution contexts. In browsers with Site Isolation, it can keep such data out of untrusted renderer processes entirely, helping even against side channel attacks.

More info:
- Explainer: https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md
- WhatWG issue: https://github.com/whatwg/fetch/issues/681
- PR for Fetch spec changes: https://github.com/whatwg/fetch/pull/686
- Initial public support from Firefox: https://groups.google.com/a/chromium.org/forum/#!msg/site-isolation-dev/pp5C8XKz7AI/2zNOn-S_BgAJ

Comment 1

[Anne (:annevk)]

FYI: I'm about to land the Fetch PR. It standardizes all the bits of CORB that can be implemented without sniffing the response. Tests can be found in fetch/corb in web-platform-tests.

Comment 2

[Anne (:annevk)]

I'm no longer convinced we should do this. Bug 1532642 is a much more secure approach that seems doable.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

We're doing bug 1532642 , not this one.