Skip to content

Commit

Permalink
Review nits
Browse files Browse the repository at this point in the history
  • Loading branch information
yoavweiss committed Sep 13, 2024
1 parent 28caad5 commit 240b599
Showing 1 changed file with 20 additions and 20 deletions.
40 changes: 20 additions & 20 deletions source
Original file line number Diff line number Diff line change
Expand Up @@ -86794,35 +86794,35 @@ dictionary <dfn dictionary>DragEventInit</dfn> : <span>MouseEventInit</span> {

<dt>"<dfn><code data-x="coop-noopener-allow-popups">nooopener-allow-popups</code></dfn>"</dt>
<dd>
<p>This forces the creation of a new <span>top-level browsing context</span> for the
document, regardless of its predecessor.</p>
<p>This forces the creation of a new <span>top-level browsing context</span> for the document,
regardless of its predecessor.</p>

<div class="note">
<p>While including a <code
data-x="coop-noopener-allow-popups">nooopener-allow-popups</code> value severs the opener
relationship between the document on which it is applied and its opener, it does not create
a robust security boundary between those same-origin documents.</p>
relationship between the document on which it is applied and its opener, it does not create a
robust security boundary between those same-origin documents.</p>

<p>Other risks from same-origin applications include:</p>
<ul>
<li>Same-origin requests fetching the document's content - could be mitigated through Fetch
Metadata filtering.</li>
<li>Same-origin framing - could be mitigated through <code>X-Frame-Options</code> or CSP
<code data-x="frame-ancestors directive">frame-ancestors</code>.</li>
<li>Javascript accessible cookies - can be mitigated by ensuring all cookies are
<code data-x="">httponly</code>.</li>
<li>localStorage access to sensitive data.</li>
<li>Service worker installation.</li>
<li><code data-x="">postMessage</code> or <code>BroadcastChannel</code> messaging that exposes
sensitive information.</li>
<li>Autofill which may not require user interaction for same-origin documents.</li>
<li><p>Same-origin requests fetching the document's content could be mitigated through
Fetch Metadata filtering.</p></li>
<li><p>Same-origin framing - could be mitigated through <code>X-Frame-Options</code> or CSP
<code data-x="frame-ancestors directive">frame-ancestors</code>.</p></li>
<li><p>JavaScript accessible cookies - can be mitigated by ensuring all cookies are <code
data-x="">httponly</code>.</p></li>
<li><p>localStorage access to sensitive data.</p></li>
<li><p>Service worker installation.</p></li>
<li><p><code data-x="">postMessage</code> or <code>BroadcastChannel</code> messaging that
exposes sensitive information.</p></li>
<li><p>Autofill which may not require user interaction for same-origin documents.</p></li>
</ul>
<p>Developers using <code data-x="coop-noopener-allow-popups">nooopener-allow-popups</code>
need to make sure that their sensitive applications don't rely on client-side features
accessible to other same-origin documents, e.g. localStorage and other client-side storage APIs,
BroadcastChannel and related same-origin communication mechanisms. They also need to make sure
that their server-side endpoints don't return sensitive data to non-navigation requests, whose
response content is accessible to same-origin documents.</p>
accessible to other same-origin documents, e.g., localStorage and other client-side storage
APIs, BroadcastChannel and related same-origin communication mechanisms. They also need to make
sure that their server-side endpoints don't return sensitive data to non-navigation requests,
whose response content is accessible to same-origin documents.</p>
</div>
</dd>
</dl>
Expand Down Expand Up @@ -87022,7 +87022,7 @@ dictionary <dfn dictionary>DragEventInit</dfn> : <span>MouseEventInit</span> {
data-x="coop-noopener-allow-popups">noopener-allow-popups</code>" and
<var>responseCOOPValue</var> is "<code
data-x="coop-same-origin-allow-popups">same-origin-allow-popups</code>" or "<code
data-x="coop-unsafe-none">unsafe-none</code>", then return false. </p></li>
data-x="coop-unsafe-none">unsafe-none</code>", then return false.</p></li>

<li>
<p>If all of the following are true:</p>
Expand Down

0 comments on commit 240b599

Please sign in to comment.