{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/687","repository_url":"https://api.github.com/repos/whatwg/fetch","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/687/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/687/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/687/events","html_url":"https://github.com/whatwg/fetch/issues/687","id":309443482,"number":687,"title":"From-Origin","user":{"login":"johnwilander","id":784671,"avatar_url":"https://avatars2.githubusercontent.com/u/784671?v=4","gravatar_id":"","url":"https://api.github.com/users/johnwilander","html_url":"https://github.com/johnwilander","followers_url":"https://api.github.com/users/johnwilander/followers","following_url":"https://api.github.com/users/johnwilander/following{/other_user}","gists_url":"https://api.github.com/users/johnwilander/gists{/gist_id}","starred_url":"https://api.github.com/users/johnwilander/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnwilander/subscriptions","organizations_url":"https://api.github.com/users/johnwilander/orgs","repos_url":"https://api.github.com/users/johnwilander/repos","events_url":"https://api.github.com/users/johnwilander/events{/privacy}","received_events_url":"https://api.github.com/users/johnwilander/received_events","type":"User","site_admin":false},"labels":[{"id":308176090,"url":"https://api.github.com/repos/whatwg/fetch/labels/addition/proposal","name":"addition/proposal","color":"d4c5f9","default":false},{"id":906872404,"url":"https://api.github.com/repos/whatwg/fetch/labels/needs%20concrete%20proposal","name":"needs concrete proposal","color":"1cddc7","default":false},{"id":412528373,"url":"https://api.github.com/repos/whatwg/fetch/labels/security/privacy","name":"security/privacy","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":75,"created_at":"2018-03-28T16:37:51Z","updated_at":"2018-05-18T20:36:58Z","closed_at":null,"author_association":"NONE","body":"Websites should have an explicit way to restrict any kind of cross-origin load to protect themselves against Spectre attacks. Content such as images, video, and audio may be sensitive and websites may be protected solely by virtue of their network position (inside a firewall), relying on the same-origin policy to protect against exfiltration.\r\n\r\nThere's a previous proposal from 2012 called the [From-Origin header](https://www.w3.org/TR/from-origin/) that we'd like to resurrect. With it, a server can send a `From-Origin : same` header on responses it wants to protect from Spectre attacks. Here's a snippet from the currently inactive proposal:\r\n\r\n> The From-Origin header can be used to restrict embedding of a resource to only certain origins. When used it must match the following ABNF:\r\n> \r\n> `From-Origin = \"From-Origin\" \":\" #(serialized-origin | \"same\")`\r\n\r\n[Cross-Origin Read Blocking (CORB)](https://github.com/whatwg/fetch/issues/681) automatically protects against Spectre attacks that load cross-origin, cross-type HTML, XML, and JSON resources, and is based on the browser’s ability to distinguish resource types. We think CORB is a good idea. From-Origin would offer servers an opt-in protection beyond CORB.\r\n\r\nIn addition to the original proposal, we might want to offer servers a way to say cross-origin requests are OK within the same eTLD+1, e.g. the server may want to say that cross-origin subresources from cdn.example.com may be loaded from *.example.com without listing all those origins."},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/390325274","html_url":"https://github.com/whatwg/fetch/issues/687#issuecomment-390325274","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/687","id":390325274,"user":{"login":"youennf","id":5575980,"avatar_url":"https://avatars2.githubusercontent.com/u/5575980?v=4","gravatar_id":"","url":"https://api.github.com/users/youennf","html_url":"https://github.com/youennf","followers_url":"https://api.github.com/users/youennf/followers","following_url":"https://api.github.com/users/youennf/following{/other_user}","gists_url":"https://api.github.com/users/youennf/gists{/gist_id}","starred_url":"https://api.github.com/users/youennf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/youennf/subscriptions","organizations_url":"https://api.github.com/users/youennf/orgs","repos_url":"https://api.github.com/users/youennf/repos","events_url":"https://api.github.com/users/youennf/events{/privacy}","received_events_url":"https://api.github.com/users/youennf/received_events","type":"User","site_admin":false},"created_at":"2018-05-18T20:36:58Z","updated_at":"2018-05-18T20:36:58Z","author_association":"COLLABORATOR","body":"Some WebKittens talked about this and are agreeing on the following direction:\r\n- Do not check ancestors\r\n- Support same/same-site values\r\n- Check this header for no-cors loads\r\n- Check this header in case of redirection as well as final response\r\n- Rename From-Origin to something like Cross-Origin-Resource-Policy or Cross-Origin-Read-Policy\r\n\r\nIs there consensus here?\r\n\r\nTo be noted that, if the check fails, WebKit will fail the load. IIANM, CORB is not doing so, probably to minimize breakage risks.\r\nGiven this header is opt-in, I have a slight preference to continue raising an error.\r\n\r\nWebKit also currently checks this header for navigation loads. Some discussion might be good to decide whether doing navigation loads checks or not, cc @johnwilander."}}
{"actor":{"display_login":"youennf"}}