2076776 - iframe auto inherits the permissions policy from the HTTP header

Status: RESOLVED DUPLICATE of bug 2081658

(Core :: DOM: Security, defect, P3)

Description

[ayoub]

Summary

iframe shouldn't auto inherit from the HTTP header, but currently it does!
if an HTTP headers allows https://a.test.local to use fullscreen, but a child iframe with src="https://a.test.local" doesn't contain an allow="fullscreen" in the attributes, the iframe shouldn't not be able to use fullscreen

POC

luckily there is already a WPT for that

./mach wpt testing/web-platform/tests/permissions-policy/permissions-policy-frame-policy-allowed-for-all.https.sub.html

Targeted subtest
FAIL - Test frame policy on cross origin iframe does not inherit from header policy.

---

the header is not enabled by default, so if you want to test this without the WPT, enable the pref in about:config > permissionsPolicy :)

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:freddy, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[ayoub]

Attachment: Bug 2076776 - Deny the permissionsPolicy feature when the iframe doesn't have it in its allowList and updated WPTs exceptions. r=simonf

A permissive parent header must not replace implicit same-origin delegation.

Comment 3

[ayoub]

The issue was fixed in Bug 2081658