1506839 - Implement document-domain featurePolicy

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement)

Description

[Andrea Marchesini [:baku]]

See https://github.com/whatwg/html/pull/4170

Comment 1

[Andrea Marchesini [:baku]]

Attachment: document-domain.patch

I don't want to write a WPT because it's already implemented here:

https://chromium-review.googlesource.com/c/chromium/src/+/1329791

Let me know if we want to send an intent-to-implement/ship email.

Comment 2

[Anne (:annevk)]

Comment on attachment 9024780 [details] [diff] [review]
document-domain.patch

Nit: in the standard this check is after the sandbox check. It doesn't matter now since it's the same exception, but if that ever changes it'd be observable. Doing this without intent to ship seems acceptable given how small and easy to remove it is if there are concerns.

Comment 3

[Christoph Kerschbaumer [:ckerschb}]

Comment on attachment 9024780 [details] [diff] [review]
document-domain.patch

Review of attachment 9024780 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, looks feasible to me - thanks!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3e8db852399a
Implement document-domain feature policy, r=annevk, r=ckerschb

Comment 5

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/3e8db852399a

Comment 6

[Chris Mills [:cmills]]

Note to MDN writer's team:

IIRC, Feature-Policy is not enabled by default in any version of Firefox yet, so I'm not adding a note to the Fx65 rel notes about this. It could do with adding to the main Feature-Policy documentation however, if it is not there already.

Comment 7

[Andrea Marchesini [:baku]]

> IIRC, Feature-Policy is not enabled by default in any version of Firefox

It's enabled in nightly. But yes, I agree about not adding a note to the Fx65 rel.

Comment 8

[Florian Scholz (Open Web Docs)]

document-domain reference docs exist already
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy#Directives
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy/document-domain

As you said, not shipping in Firefox, so compat table shows unsupported for now.