Re: [w3ctag/design-reviews] Incubation: Cross-Origin Storage (Issue #1254)

tomayac left a comment (w3ctag/design-reviews#1254)

It might not immediately be clear from the explainer, but sharing globally is **_not_** the default. 

* **Omitting `origins`** keeps the file readable by same-site origins only. _**This**_ is the default. It fits resources shared across all of an organization's own subdomains.
* Passing a **list**, like `origins: ['https://write.example', 'https://calculate.example']`, restricts access to those origins and their same-site origins. This is useful for proprietary resources shared across a company's own properties. With the list form, whoever serves the bytes needs to authorize each origin in the list using the [`Cross-Origin-Storage-Allow-Origin` header](https://github.com/WICG/cross-origin-storage#the-cross-origin-storage-allow-origin-header).
* Only passing **`origins: '*'`** makes the file globally available, subject to the [availability gating](https://github.com/WICG/cross-origin-storage/#availability-gating) through the Public Hash List.

Same-site and list entries reach only the origins their storing site chose, so reading what other parties stored takes the global scope, where the PHL, GREASE'ing, and the lookup budget apply. Browsers without third-party cookies could offer the first two scopes alone by treating the PHL as empty, rendering the attacks that depend on the global scope infeasible.



-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1254#issuecomment-6220168809
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1254/6220168809@github.com>