Bug 1459357 (corb)

Cross-Origin Read Blocking (CORB)

NEW
Unassigned

Status

()

enhancement
P3
normal
Last year
5 months ago

People

(Reporter: lukasza, Unassigned)

Tracking

(Blocks 2 bugs)

unspecified
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Fission Milestone:Future)

Details

Cross-origin read blocking, better known as CORB, is an algorithm by which dubious cross-origin resource fetches are identified and blocked before they reach a web page. CORB reduces the risk of leaking sensitive data by keeping it further from cross-origin web pages.  In most browsers, it keeps such data out of untrusted script execution contexts. In browsers with Site Isolation, it can keep such data out of untrusted renderer processes entirely, helping even against side channel attacks.

More info:
- Explainer: https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md
- WhatWG issue: https://github.com/whatwg/fetch/issues/681
- PR for Fetch spec changes: https://github.com/whatwg/fetch/pull/686
- Initial public support from Firefox: https://groups.google.com/a/chromium.org/forum/#!msg/site-isolation-dev/pp5C8XKz7AI/2zNOn-S_BgAJ
Mentor: annevk
Blocks: fission
Alias: corb
See Also: → corp
FYI: I'm about to land the Fetch PR. It standardizes all the bits of CORB that can be implemented without sniffing the response. Tests can be found in fetch/corb in web-platform-tests.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Blocks: fetch
See Also: → 1486822
See Also: → cowp
Component: Security → DOM
Fission Milestone: --- → Future

I'm no longer convinced we should do this. Bug 1532642 is a much more secure approach that seems doable.

Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.