1565199 - Ensure opaque response bodies cannot enter a COEP process

Status: RESOLVED MOVED

(Core :: DOM: Service Workers, defect, P1)

Description

[Anne (:annevk)]

Initially only windows and dedicated workers will be able to create COEP processes. We should ensure that when you get a reference to an opaque response via the Cache API in such a process we don't serialize the body of that response in that process. So the API remains identical, but what can be observed via sidechannel attacks changes.

This is also discussed at https://github.com/whatwg/html/issues/4764.

(A more difficult setup is probably required once we support COEP service worker processes as then you can get an opaque response and hand it to a non-COEP window via respondWith(). That will require more involved changes.)

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a task, but please change it back in case of error.

Comment 2

[Andrew Sutherland [:asuth] (he/him)]

There's 2 aspects to this bug.

1. Make sure we never send opaque responses in an unsanitized form into a COEP process.
2. What this means for the Cache.match() and Cache.matchAll() API surfaces.

I've spun off the latter to be bug 1603168. I think it makes sense for this bug to be about creating diagnostic assertions or similar safeguards at the IPC serialization boundary so that we get very obvious failures if any codebase changes start trying to do this.

Comment 3

[Anne (:annevk)]

Perry, perhaps 1 of comment 2 could be done after shipping, but it seems safer to cover it ahead of time.

Comment 4

[Anne (:annevk)]

(To be clear, this still blocks resab, just no longer directly.)

Comment 5

[Anne (:annevk)]

It seems this is being addressed in bug 1642531.

Comment 6

[Anne (:annevk)]

Andrew, could you maybe double check that the logic we're adding for that bug addresses both aspects you mention in comment 2? That we have the relevant asserts in place to prevent opaque responses leaking in such a manner.

Comment 7

[Eden Chuang[:edenchuang]]

Attachment: Bug 1565199 - Reject the opaque responses for cache.match()/cache.matchAll() in COEP process

Comment 8

[Eden Chuang[:edenchuang]]

Attachment: Bug 1565199 - Cancel the opaque responses from ServiceWorker when target process is COEP process

Comment 9

[Eden Chuang[:edenchuang]]

The implementation of this bug is separated into Bug 1642531 and Bug 1603168.