1665474 - Implement the Origin-Agent-Cluster header

Status: ASSIGNED

(Core :: DOM: Navigation, enhancement, P3)

Description

[Domenic Denicola]

• Explainer: https://github.com/WICG/origin-isolation

• Spec PR: https://github.com/whatwg/html/pull/5545 + https://github.com/whatwg/html/pull/6214

• Tests: https://github.com/web-platform-tests/wpt/tree/master/origin-isolation (still being updated to the new name)

• Spec entrypoint: https://html.spec.whatwg.org/multipage/origin.html#origin-isolation

Comment 1

[Anne (:annevk)]

This is worth prototyping per https://mozilla.github.io/standards-positions/#domenic-origin-isolation.

Comment 2

[steve]

Please see how this lack-of-support impacts functionality in related projects. It would be a shame if the only browser that is able to perform is Meta.

https://github.com/Igalia/wolvic/issues/46

Comment 3

[Jens Stutte [:jstutte]]

(In reply to steve from comment #2)

Please see how this lack-of-support impacts functionality in related projects. It would be a shame if the only browser that is able to perform is Meta.

https://github.com/Igalia/wolvic/issues/46

IIUC this kind of implies that we would want to use this mainly for performance improvements, not only for enhanced security. In fact the spec says about consequences:

In terms of observable effects, this means that attempting to relax the same-origin restriction using document.domain will instead do nothing, and it will not be possible to send WebAssembly.Module objects to cross-origin Documents (even if they are same site).

And then:

Behind the scenes, this isolation can allow user agents to allocate implementation-specific resources corresponding to agent clusters, such as processes or threads, more efficiently.

So supporting this for the mandatory part might be relatively easy (to be fair, I ignore what it really takes), but having also the resource benefits might be harder. Would it be worth doing one without the other?

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Moving this to DOM: Navigation, though this is really cross-module thing. But I think most of the changes would be around document channel and how it selects the right process etc.

Comment 5

[Simon Pieters [:zcorpan]]

Tests: https://wpt.fyi/results/html/browsers/origin/origin-keyed-agent-clusters?label=master&label=experimental&aligned