Add a `noopener-allow-popups` value to COOP #10394

yoavweiss · 2024-06-05T07:34:33Z

Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application.

In such cases, it can be beneficial for a document to ensure its opener cannot script it, even if the opener document is a same-origin one.

This PR adds a noopener-allow-popups Cross-Origin-Opener-Policy value that severs the opener relationship between the document loaded with this policy and its opener. At the same time, this document can open further documents (as the "allow-popups" in the name suggests) and maintain its opener relationship with them, assuming that their COOP policy allows it.

Explainer

At least two implementers are interested (and none opposed):
- Chromium - I'm implementing
- WebKit - positive + I'm implementing
Tests are written and can be reviewed and commented upon at:
- https://chromium-review.googlesource.com/c/chromium/src/+/5640893/13/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https.html
- https://chromium-review.googlesource.com/c/chromium/src/+/5640893/13/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https.html
Implementation bugs are filed:
- Chromium: https://issues.chromium.org/issues/344963946
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1918971
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=275147
MDN issue is filed: Cover noopener-allow-popups COOP value mdn/mdn#579
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

💥 Error: read ECONNRESET 💥

PR Preview failed to build. (Last tried on Sep 30, 2024, 8:56 AM UTC).

More

PR Preview relies on a number of web services to run. There seems to be an issue with the following one:

🚨 Wattsi Server - Wattsi Server is the web service used to build the WHATWG HTML spec.

🔗 Related URL

Network error while accessing Wattsi server

If you don't have enough information above to solve the error by yourself (or to understand to which web service the error is related to, if any), please file an issue.

annevk

Would like to hear what @camillelamy thinks as well, but I think one change I'd like to see is that we drop "cross-origin" from the internal naming scheme now that we make it apply to same-origin scenarios.

(We probably don't want to change any of the IDs though.)

It also seems to me some other algorithms need updating here:

obtain a cross-origin opener policy
check if COOP values require a browsing context group switch

yoavweiss · 2024-06-10T16:05:36Z

I think one change I'd like to see is that we drop "cross-origin" from the internal naming scheme now that we make it apply to same-origin scenarios

Would it make sense to spin off this editorial only change to a separate PR? (happy to work on it, just wondering RE editorial vs. functional split)

obtain a cross-origin opener policy

Oops, added!

check if COOP values require a browsing context group switch

I think this is covered by the change to matching COOP, but I could be I'm missing something..

annevk · 2024-06-10T16:40:12Z

@yoavweiss I think once we have agreement for this PR, that could be a separate PR as well (to be landed first). It would be a bit of extra work, but I agree that it would be nicer.

https://bugs.webkit.org/show_bug.cgi?id=275147 Reviewed by NOBODY (OOPS!). The `noopener-allow-popups` COOP value would enable a document to ensure it can't be scripted by other same-origin documents that have opened it. Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application. The noopener-allow-popups Cross-Origin-Opener-Policy value severs the opener relationship between the document loaded with this policy and its opener. At the same time, this document can open further documents (as the "allow-popups" in the name suggests) and maintain its opener relationship with them, assuming that their COOP policy allows it. This implements whatwg/html#10394 * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/resources/reporting-common.js: (const.coopHeaders): A helper to create headers in a more succinct way. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resources/noopener-helper.js: Added. (getExecutorPath): (const.test_noopener_opening_popup): The logic for the noopener tests. (async const): * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https.html: Added. * Source/WebCore/loader/CrossOriginOpenerPolicy.cpp: (WebCore::crossOriginOpenerPolicyToString): Add the "noopener-allow-popups" string. (WebCore::crossOriginOpenerPolicyValueToEffectivePolicyString): Add the "noopener-allow-popups" string. (WebCore::matchingCOOP): Implement the related HTML algorithm. (WebCore::coopValuesRequireBrowsingContextGroupSwitch): Implement the switching logic related to noopener-allow-popups. (WebCore::obtainCrossOriginOpenerPolicy): Parse the "noopener-allow-popups" value. * Source/WebCore/loader/CrossOriginOpenerPolicy.h: Add the noopener-allow-popups enum value. * Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in: Add the noopener-allow-popups enum value.

yoavweiss · 2024-07-10T12:05:35Z

I added @ddworken's commented risks as a note.
I thought that a "browser context group switch" also implied a potentially separate process. @arturjanc - should I understand from your comment that you'd like to see something more explicit here?

arturjanc · 2024-08-07T11:27:18Z

@arturjanc - should I understand from your comment that you'd like to see something more explicit here?

Yes, I think it could be helpful to at least add a note somewhere saying that browser should aim to put documents with this COOP value in a separate renderer process (or something along these lines) -- otherwise, same-origin documents would still be able to read arbitrary from memory even if they can't directly access it using web-level APIs.

annevk · 2024-08-21T07:26:27Z

@yoavweiss did you open a PR already to drop "cross origin" from the internal concepts?

yoavweiss · 2024-08-27T11:28:03Z

@yoavweiss did you open a PR already to drop "cross origin" from the internal concepts?

Was out, will do that now..

This is a refactor-only change, that serves as a precursor to #10394, and makes progress on #10373.

domfarolino

This is looking good, I have nothing but nits.

source

yoavweiss

Thanks for reviewing!

source

shhnjk · 2024-09-16T19:49:03Z

It'd be nice to also document the vector in this comment.

yoavweiss · 2024-09-16T20:06:26Z

It'd be nice to also document the vector in this comment.

I believe it's covered in the note under https://whatpr.org/html/10394/browsers.html#coop-noopener-allow-popups

yoavweiss · 2024-09-16T20:08:15Z

It'd be nice to also document the vector in this comment.

I believe it's covered in the note under https://whatpr.org/html/10394/browsers.html#coop-noopener-allow-popups

@shhnjk - or did you mean that the note should cover Cache API usage as well?

shhnjk · 2024-09-16T21:01:12Z

It'd be nice to also document the vector in this comment.

I believe it's covered in the note under https://whatpr.org/html/10394/browsers.html#coop-noopener-allow-popups

The note talks about Service worker installation as a risk from same-origin application, but I think if the sensitive application uses a service worker, those SW caches can be manipulated without Service worker installation from the same-origin application.

i.e.:

// A script running on /chat.
// Assuming the sensitive application has a service worker which returns cached contents.
caches.open("v1").then(cache => {
  const init = {
    headers: {
      'Content-Type': 'text/html'
    }
  };
  cache.put('/password', new Response('<img src=x onerror=alert(origin)>', init));
})

yoavweiss · 2024-09-17T09:11:02Z

Added a separate line for "Cache API manipulation or access to sensitive data". Thanks!!

domfarolino · 2024-09-22T01:33:15Z

source

+     data-x="">httponly</code>.</p></li>
+     <li><p>localStorage access to sensitive data.</p></li>
+     <li><p>Service worker installation.</p></li>
+     <li><p>Cache API manipulation or access to sensitive data.</p></li>


https://w3c.github.io/ServiceWorker/#cache right? Maybe link to it manually here, and then add a [SW] ref like in https://html.spec.whatwg.org/multipage/webappapis.html#fetching-scripts-perform-fetch:~:text=Service%20Workers%20is%20an%20example%20of%20a%20specification%20that%20runs%20these%20algorithms%20with%20its%20own%20options%20for%20the%20hook

done! Let me know if this matches what you had in mind

source

domfarolino · 2024-09-22T04:00:49Z

source

-   <var>responseCOOPValue</var>, and <var>responseOrigin</var> is true, return false.</p></li>
+   <var>responseCOOPValue</var>, and <var>responseOrigin</var> is true, then return false.</p></li>
+
+   <li><p>If <var>activeDocumentCOOPValue</var> is "<code


I'm curious about this condition and how it relates to what I'm seeing in https://chromium-review.googlesource.com/c/chromium/src/+/5581251/25/content/browser/security/coop/cross_origin_opener_policy_status.cc. I'm not super familiar with COOP impl specifics, so I'm probably missing something but it seems in Chromium when an initiator has noopener-allow-popups and the destination/response has same-origin-allow-popups we only conditionally "no swap" (based on origin), but the spec here unconditionally returns false?

Is this a real difference or am I incorrectly comparing two different things?

Yes this seems like it would prevent the popup from being opened at all. When you open a popup, you create an about:blank document that inherits COOP from its creator, so in this case noopener-allow-popups. With this clause, then the navigation from noopener-allow-popups about:blank to the actual popup would always trigger a BCG swap. Which is not what you want. This is why same-origin-allow-popups has the conditions below about not swapping when you're the initial about:blank document. You should do something similar.

@domfarolino - I think you're right and for same-origin-allow-popups we should check for an origin here.

@camillelamy - I'm not sure the scenario you're describing matches my read of the spec, so I'd love to better understand it. For a navigation from noopener-allow-popups about:blank to the actual popup, I think this line returns "false", which means no BCG swap will take place. Am I reading it wrong?

In the about:blank popup case, the line will not return false because activeDocumentCOOP value is noopener-allow-popups and the value of responseCOOP is unsafe-none. So they don't match, per line 86864 in this PR.

The step 2 of this algorithm (if all of the following are true...) deals specifically with the popup case. You should modify the following in this step:

activeDocumentCOOPValue's value is "same-origin-allow-popups"; and

so that it also applies if activeDocumentCOOPValue is noopener-allow-popups.

However, this line will return false when navigating an about:blank noopener-allow-popups to another noopener-allow-popups page, meaning that the noopener-allow-popups popup will keep its opener (which is itself noopener-allow-popups). I think this would be unexpected.

camillelamy · 2024-10-02T09:21:56Z

source

-   <var>responseCOOPValue</var>, and <var>responseOrigin</var> is true, return false.</p></li>
+   <var>responseCOOPValue</var>, and <var>responseOrigin</var> is true, then return false.</p></li>
+
+   <li><p>If <var>activeDocumentCOOPValue</var> is "<code


In the about:blank popup case, the line will not return false because activeDocumentCOOP value is noopener-allow-popups and the value of responseCOOP is unsafe-none. So they don't match, per line 86864 in this PR.

The step 2 of this algorithm (if all of the following are true...) deals specifically with the popup case. You should modify the following in this step:

activeDocumentCOOPValue's value is "same-origin-allow-popups"; and

so that it also applies if activeDocumentCOOPValue is noopener-allow-popups.

However, this line will return false when navigating an about:blank noopener-allow-popups to another noopener-allow-popups page, meaning that the noopener-allow-popups popup will keep its opener (which is itself noopener-allow-popups). I think this would be unexpected.

camillelamy · 2024-10-02T09:23:55Z

source

+
+    <ol>
+     <li><p>If <var>responseCOOPValue</var> is "<code
+     data-x="coop-unsafe-none">unsafe-none</code>", then return false.</p></li>


This means that we will not trigger a BCG switch when navigating from noopener-allow-popups to unsafe-none. This is different from the same-origin-allow-popups behavior, where this is only true for the intial navigation in a popup. I would recommend removing this and aligning on same-origin-allow-popups here.

camillelamy · 2024-10-02T09:29:20Z

source

+     <li><p>If <var>responseCOOPValue</var> is "<code
+     data-x="coop-unsafe-none">unsafe-none</code>", then return false.</p></li>
+
+     <li><p>If <var>responseCOOPValue</var> is "<code


So navigating from noopener-allow-popups to same-origin-allow-popups doesn't trigger a BCG switch, but the reverse does? I think this is likely to be confusing, especially when you factor in back navigations.

For example, consider the following scenario:

You're on page A with noopener-allow-popups. Page A opens popup B. Communication with the popup works.

Page A navigates to a same -origin same-origin-allow-popups page. Communication with the popup works.

The user goes back to the noopener-allow-popups page. Communication with the popup stops working. This might be unexpected to the original noopener-allow-popups page.

This was referenced Jun 5, 2024

noopener-allow-popups value in COOP w3ctag/design-reviews#964

Closed

noopener-allow-popups value in COOP mozilla/standards-positions#1037

Open

Add a noopener-allow-popups value to COOP WebKit/standards-positions#360

Closed

annevk reviewed Jun 10, 2024

View reviewed changes

annevk added addition/proposal New features or enhancements needs implementer interest Moving the issue forward requires implementers to express interest labels Jun 10, 2024

yoavweiss mentioned this pull request Jun 17, 2024

Upcoming WHATNOT meeting on 6/20/2024 #10408

Closed

past added the agenda+ To be discussed at a triage meeting label Jun 17, 2024

yoavweiss force-pushed the coop_noopener_allow_popups branch from 9aa933f to a743f59 Compare June 20, 2024 06:44

past removed the agenda+ To be discussed at a triage meeting label Jun 21, 2024

yoavweiss mentioned this pull request Jul 2, 2024

COOP noopener-allow-popups WebKit/WebKit#30344

Open

yoavweiss added agenda+ To be discussed at a triage meeting and removed agenda+ To be discussed at a triage meeting labels Jul 30, 2024

yoavweiss force-pushed the coop_noopener_allow_popups branch from f345df4 to 35c581a Compare August 9, 2024 09:15

yoavweiss mentioned this pull request Aug 27, 2024

Rename cross-origin opener policy concepts #10579

Merged

yoavweiss added the agenda+ To be discussed at a triage meeting label Sep 3, 2024

past mentioned this pull request Sep 5, 2024

Upcoming WHATNOT meeting on 2024-09-05 #10589

Closed

domfarolino pushed a commit that referenced this pull request Sep 12, 2024

Editorial: rename cross-origin opener policy concepts

54acf22

This is a refactor-only change, that serves as a precursor to #10394, and makes progress on #10373.

past removed the agenda+ To be discussed at a triage meeting label Sep 12, 2024

past mentioned this pull request Sep 12, 2024

Upcoming WHATNOT meeting on 2024-09-12 #10601

Closed

yoavweiss added 3 commits September 13, 2024 10:41

Add an omit value to Cross-Origin-Opener-Policy

99a9f5c

Change to noopener

b0a00bf

Parse the noopener value

bd2de0f

yoavweiss added 4 commits September 13, 2024 10:43

Fix up algorithm

443828b

Add a note regarding further leaks between same-origin documents

601aed2

Turn dl to div

dffb2ca

Tighten the warning against other leaks

28caad5

yoavweiss force-pushed the coop_noopener_allow_popups branch from 35c581a to 28caad5 Compare September 13, 2024 08:44

domfarolino added the impacts documentation Used by documentation communities, such as MDN, to track changes that impact documentation label Sep 13, 2024

domfarolino reviewed Sep 13, 2024

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

Review nits

240b599

yoavweiss commented Sep 13, 2024

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

yoavweiss mentioned this pull request Sep 16, 2024

Cover noopener-allow-popups COOP value mdn/mdn#579

Open

Cache API note

d4f8552

domfarolino reviewed Sep 22, 2024

View reviewed changes

Address comments from Dom

0567e38

yoavweiss requested a review from domfarolino September 30, 2024 08:57

camillelamy reviewed Oct 2, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a `noopener-allow-popups` value to COOP #10394

Add a `noopener-allow-popups` value to COOP #10394

yoavweiss commented Jun 5, 2024 •

edited by pr-preview bot

Loading

annevk left a comment

yoavweiss commented Jun 10, 2024

annevk commented Jun 10, 2024

yoavweiss commented Jul 10, 2024

arturjanc commented Aug 7, 2024

annevk commented Aug 21, 2024

yoavweiss commented Aug 27, 2024

domfarolino left a comment

yoavweiss left a comment

shhnjk commented Sep 16, 2024

yoavweiss commented Sep 16, 2024

yoavweiss commented Sep 16, 2024

shhnjk commented Sep 16, 2024

yoavweiss commented Sep 17, 2024

domfarolino Sep 22, 2024

yoavweiss Sep 30, 2024

domfarolino Sep 22, 2024

camillelamy Sep 23, 2024

yoavweiss Sep 30, 2024

camillelamy Oct 2, 2024

camillelamy Oct 2, 2024

camillelamy Oct 2, 2024

camillelamy Oct 2, 2024

Add a noopener-allow-popups value to COOP #10394

Are you sure you want to change the base?

Add a noopener-allow-popups value to COOP #10394

Conversation

yoavweiss commented Jun 5, 2024 • edited by pr-preview bot Loading

💥 Error: read ECONNRESET 💥

annevk left a comment

Choose a reason for hiding this comment

yoavweiss commented Jun 10, 2024

annevk commented Jun 10, 2024

yoavweiss commented Jul 10, 2024

arturjanc commented Aug 7, 2024

annevk commented Aug 21, 2024

yoavweiss commented Aug 27, 2024

domfarolino left a comment

Choose a reason for hiding this comment

yoavweiss left a comment

Choose a reason for hiding this comment

shhnjk commented Sep 16, 2024

yoavweiss commented Sep 16, 2024

yoavweiss commented Sep 16, 2024

shhnjk commented Sep 16, 2024

yoavweiss commented Sep 17, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Add a `noopener-allow-popups` value to COOP #10394

Add a `noopener-allow-popups` value to COOP #10394

yoavweiss commented Jun 5, 2024 •

edited by pr-preview bot

Loading