Re: [sysapps/runtime] cross origin XHR in packaged apps

On Monday, April 8, 2013 at 8:17 AM, John Lyle wrote:

> On 08/04/2013 05:32, Jonas Sicking wrote: 
> > I personally don't think it's a good idea to ask the user which websites 
> > an app should be able to connect to outside of the usual web SOP.
> > 
> > This is a very technical question and very few users are likely to 
> > understand the implications of such a question.
> 
> 
> 
> I strongly agree.
> 
> Realistically, at most only three agents should be involved in this decision:
> 
> (1) The app developer should define the origins with which the app needs to communicate (definition of least privilege)
To clarify, by "define" I think you mean the app developer should attempt to access the origins through some means (e.g., XHR, an ing tag, a script tag, etc.). CSP rules in the manifest may intervene at this point. But you don't mean that the app developer declares those origins in a list within the JSON manifest, right? 
> (2) The origin should define the applications with which it is prepared to communicate (access control)
> (3) The user agent may intervene based on a list of known malicious origins (host based malware protection)
> 
> Where (2) might be skipped for privileged native-replacement apps, particularly those with access to raw sockets, and (3) seems outside of the scope of standardisation, but could be mentioned in the security considerations for UA implementers.
> 

Agree with 2 and 3. 

-- 
Marcos Caceres

Received on Monday, 8 April 2013 08:09:07 UTC