Opener information

[yoavweiss]

Related to #17 and #83

Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application.

If there are no valid use cases for application A to open application B as a popup/tab, B communicating its opener to the server can help the server terminate requests for B that have an opener A (and are therefore suspicious of being a result of an XSS attack trying to migrate from A to B).

/cc @annevk @mjz3

[yoavweiss]

I think we'd only need to add those headers to navigation requests that actually have an opener, so the overhead of this extra header would be negligible.

[yoavweiss]

The use case here may be redundant with whatwg/html#10373

[annevk]

cc @bartoszniemczura