Re: Reports feature violates the same-origin policy

On Wed, Feb 15, 2017 at 4:51 PM, Anne van Kesteren <annevk@annevk.nl> wrote:

> Reports go across origins and don't follow the MIME type safelist from
> CORS/HTML forms. It seems problematic that we keep breaking our own
> rules with regards to the same-origin policy, especially as it doesn't
> seem to happen on purpose.
>

I agree that we're not doing a great job here. Practically, I'm not
terribly worried about this since the browser remains in control of the
payload's content and structure. It is, however, clearly a blot on our
record if we're exempting ourselves from certain rules without explaining
how that could possibly be justified.

This is an issue for CSP, and for the upcoming
https://wicg.github.io/reporting/.


> Note that simply adding these MIME types to the safelist would not be
> great either, as the servers that are currently "guaranteed" to get
> JSON (depends a little bit on whether tokens are used or whether it's
> an intranet as I believe credentials are not included in these
> reports), might then be able to get more carefully crafted attack
> payloads.
>

I agree with your analysis about this course of action. Given that it seems
like a bad idea, what would you suggest that we do?

-mike