1750654 - Add extension support for coep/coop (cross_origin_embedder_policy/cross_origin_opener_policy)

Status: NEW

(WebExtensions :: Untriaged, enhancement, P3)

Description

[Justin Mayfield]

Steps to reproduce:

Firefox Extensions do not support a technique for setting the cross-origin-isolation "headers" as defined here:
https://developer.chrome.com/docs/extensions/mv2/cross-origin-isolation/

Without this mechanism an extension is unable to activate SharedArrayBuffer and other APIs that require safe browser contexts.

Actual results:

Attempting to use these manifest key/values results in an errors such as:
"Reading manifest: Warning processing cross_origin_embedder_policy: An unexpected property was found in the WebExtension manifest."

Expected results:

Content scripts and background pages of the extension should have enabled the safer semantics of coep/coop to enable use of SharedArrayBuffer, Atomic, etc.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Justin Mayfield]

s/Atomic/Atomics/

Comment 3

[Tomislav Jovanovic :zombie]

I need to think this more thoroughly.

Comment 5

[qfoiqnwrgoiwejfoq]

When will this be fixed?

Comment 6

[qfoiqnwrgoiwejfoq]

Is there a workaround?

Comment 12

[Sasha Shkolnik]

Hello team,
I am from Adobe and we are moving to support COEP headers for one of our flagship product.
COEP = credentialless is the route we are going for as it is less restrictive, easier to bring onboard embedded 3rd party services.
[Origin-trial|https://bugzilla.mozilla.org/show_bug.cgi?id=1829942] token helps in several use cases, but key services expressed a strong preference to move to COEP support, only when Firefox makes COEP a standard. Because of that, we currently cannot enable COEP with origin-trial token for Firefox.
What is the roadmap and plan for Firefox to make COEP a standard? Any timelines?

Thanks,
Sasha Shkolnik

Comment 13

[Emilio Cobos Álvarez [:emilio]]

Sean do you know what's the status of flipping credentialless? See above

Comment 14

[Sean Feng [:sefeng211]]

We'll enable COEP after we shipped ORB and ORB is targeting 118 (2023-09-26).

I am hoping we get COEP in 118 as well, if not then it'll be in 119 (2023-10-24).

Comment 15

[Sasha Shkolnik]

@Sean - thank you for the info! We will keep an eye on it and test it once the update it out.
Thanks,
Sasha

Comment 16

[Sean Feng [:sefeng211]]

Sasha, can you confirm that you would like to have credentialless on both Desktop and Andriod, or Desktop only is sufficient? Thanks!

Comment 17

[Rob Wu [:robwu]]

If the discussion is expected to take many more comments or requires a follow-up, could it be taken to a different bug? This bug has nothing to do with credentialless COEP.

If there are dedicated bugs about credentialless, please mention them here for future readers who stumble on this bug.

Comment 18

[Sasha Shkolnik]

@Sean - both Desktop and Android.
@Rob - please let me know which bug to track.
When I was looking through Mozilla bugs/initiatives for COEP support, this was the closest that I found.
Happy to move to another thread.

Thanks,
Sasha

Comment 19

[Sean Feng [:sefeng211]]

Sorry about spamming this bug. Leaving my last comment...

Credentailless on desktop will be tracked in bug 1851467 and will be tracked in bug 1852710 for Android.

Right now we can only enable it for desktop and I don't have concrete timeline for Android (Just to be clear, it's not like we are not going to do it, it's just that we need to do some works.). I might have provided unrealistic expectation. Sorry!