diff --git a/fetch.bs b/fetch.bs index 8b4adf811..275cae0e4 100644 --- a/fetch.bs +++ b/fetch.bs @@ -3552,61 +3552,6 @@ X-Content-Type-Options = "nosniff" ; case-insensitive pertain to them. Also, considering "image" was not compatible with deployed content. -

CORB

- -

Cross-origin read blocking, better known as CORB, is an algorithm which identifies -dubious cross-origin resource fetches (e.g., fetches that would fail anyway like attempts to render -JSON inside an img element) and blocks them before they reach a web page. CORB reduces -the risk of leaking sensitive data by keeping it further from cross-origin web pages. - -

A CORB-protected MIME type is an HTML MIME type, a JSON MIME type, or an -XML MIME type excluding image/svg+xml. - -

Even without CORB, accessing the content of cross-origin resources with -CORB-protected MIME types is either managed by the CORS protocol (e.g., in case of -{{XMLHttpRequest}}), not observable (e.g., in case of pings or CSP reports which ignore the -response), or would result in an error (e.g., when failing to decode an HTML document embedded in an -img element as an image). This means that CORB can block -CORB-protected MIME types resources without being disruptive to web pages. - -

To perform a CORB check, given a request and response, -run these steps:

- -
    -
  1. -

    If request's initiator is "download", then return - allowed. - -

    If we recast downloading as navigation this step can be removed. - -

  2. If request's current URL's scheme is not an - HTTP(S) scheme, then return allowed. - -

  3. Let mimeType be the result of extracting a MIME type - from response's header list. - -

  4. If mimeType is failure, then return allowed. - -

  5. If response's status is 206 and mimeType is a - CORB-protected MIME type, then return blocked. - -

  6. -

    If determine nosniff with response's header list is true - and mimeType is a CORB-protected MIME type or its essence - is "text/plain", then return blocked. - -

    CORB only protects text/plain responses with a - `X-Content-Type-Options: nosniff` header. Unfortunately, protecting such responses - without that header when their status is 206 would break too many existing - video responses that have a text/plain MIME type. - - - - -

  7. Return allowed. -

- -

`Cross-Origin-Resource-Policy` header

The @@ -4125,35 +4070,19 @@ steps: HTTP(S) scheme. [[!HTML]] [[!SW]] -

request's mode is - "same-origin" +
request's mode is "same-origin"

Return a network error. -

request's mode is - "no-cors" +
request's mode is "no-cors"

  1. If request's redirect mode is not "follow", then return a network error. -

  2. Set request's - response tainting to - "opaque". +

  3. Set request's response tainting to "opaque". -

  4. Let noCorsResponse be the result of running scheme fetch given - fetchParams. +

  5. Return the result of running scheme fetch given fetchParams. - -

  6. If noCorsResponse is a filtered response or the CORB check with - request and noCorsResponse returns allowed, then return - noCorsResponse. - -

  7. -

    Return a new response whose status is - noCorsResponse's status. - -

    This is only an effective defense against side channel attacks if - noCorsResponse is kept isolated from the process that initiated the request.

request's current URL's scheme is not an