Introduce request infrastructure for storage access
#214
Conversation
| 1. If |request|'s [=request/client=] is null, return "<code>[=storage access eligibility/unset=]</code>". | ||
| 1. If |request|'s [=request/client=]'s [=environment/ancestry=] is not "<code>cross-site</code>", return "<code>[=storage access eligibility/unset=]</code>" | ||
| 1. If |request|'s [=request/client=]'s [=environment/has storage access=] is false, return "<code>[=storage access eligibility/ineligible=]</code>". | ||
| 1. If |request|'s [=url/origin=] is not [=/same site=] with |request|'s [=request/url=]'s [=url/origin=], return "<code>[=storage access eligibility/ineligible=]</code>". |
There was a problem hiding this comment.
Hmm I'm not sure I understand what purpose this step serves now, would you mind elaborating it for my benefit? :)
There was a problem hiding this comment.
This checks that the request's initiator is same-site with the URL that we're considering sending cookies to. If they're cross-site, we shouldn't include cookies, because doing so would allow an attacker to manipulate an iframe into CSRF-ing itself, IIUC.
Note that this is one of the two things that change to be 'same-origin' in 6b6ccef, since the rest of the web platform uses origin as the security boundary, rather than site.
There was a problem hiding this comment.
Right, okay, and SAH would override eligibility if supplied by the request then?
There was a problem hiding this comment.
Yeah, see step 8 of https://privacycg.github.io/storage-access-headers/#http-storage-access-retry-fetch.
I tweaked the field name (eligible to storage-access -> storage access eligibility) when I modified its type (bool -> tri-state enum) in this PR, but the SAH spec can be updated to use the new name once this PR lands.
This splits out the underlying infrastructure changes introduced in #213 so that #213 can just introduce the behavior change, and this PR can add the infrastructure needed to formally define the current behavior (in Chrome and Firefox; Safari TBD).
I also incorporated @annevk's request that
request/eligible for storage-accessbe a tri-state enum, rather than a boolean.This PR relies on the
environment/ancestryenum, similar to other cookie layering work (e.g.).Preview | Diff