Re: [w3ctag/design-reviews] "credentialless" embedder policy. (#582)

Thanks a lot for the analysis, @ArthurSonzogni! 

I think a problem with Option 2.a is that this would allow you to force same-origin credentialed resources loaded by the iframe into the embedder's process (assuming the lack of OOPIFs). This may be fine in a world with partitioned storage, but then partitioning becomes an important security boundary, and I'm not sure we've treated it as such in the past.

So while I like the simplicity and deployability of that approach, my guess is that we may want "stricter" credentiallessness for iframes, i.e. ensure that they cannot load authenticated resources at all.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/582#issuecomment-775456644