W3C home > Mailing lists > Public > public-webappsec@w3.org > May 2015

Re: [REFERRER] policy inheritance via javascript: URI and new document

From: Sid Stamm <sid@mozilla.com>
Date: Fri, 1 May 2015 08:22:20 -0400
Message-ID: <CAP=NJFOcOu8SsUURiTbWsa8=4RHPT6xdTVVrRFXhTaDTL6e7Uw@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: Mike West <mkwst@google.com>, Jochen Eisinger <eisinger@google.com>, WebAppSec WG <public-webappsec@w3.org>
This all sounds to me like a good direction.

1. Align referrer policy with CSP propagation and reuse
2. make sure about:blank inherits.

How do we best capture this in the spec?  Would it make sense to
actually call out that it's inherited with *any* inherited script
security context, or address about:blank specifically?

-Sid

On Thu, Apr 30, 2015 at 4:45 AM, Anne van Kesteren <annevk@annevk.nl> wrote:
> On Tue, Apr 28, 2015 at 4:35 PM, Mike West <mkwst@google.com> wrote:
>> I think that logic would have to carry across to new documents created via
>> `window.open`. Until that context navigates, it's fairly indistinguishable
>> from the context that created it.
>
> Note that
>
>   <a href=http://example.com/ target=_blank>
>
> is fairly indistinguishable from that case and we should inherit there
> too. Because indeed, an about:blank context is created for which no
> meaningful policy is set. So it better match the one from its creator
> otherwise you have a way out.
>
>
> --
> https://annevankesteren.nl/
Received on Friday, 1 May 2015 12:22:50 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:12 UTC