Add a `noopener-allow-popups` value to COOP #10394

yoavweiss · 2024-06-05T07:34:33Z

Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application.

In such cases, it can be beneficial for a document to ensure its opener cannot script it, even if the opener document is a same-origin one.

This PR adds a noopener-allow-popups Cross-Origin-Opener-Policy value that severs the opener relationship between the document loaded with this policy and its opener. At the same time, this document can open further documents (as the "allow-popups" in the name suggests) and maintain its opener relationship with them, assuming that their COOP policy allows it.

Explainer

At least two implementers are interested (and none opposed):
- Chromium - I'm implementing
- WebKit - positive + I'm implementing
Tests are written and can be reviewed and commented upon at:
- https://chromium-review.googlesource.com/c/chromium/src/+/5640893/13/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https.html
- https://chromium-review.googlesource.com/c/chromium/src/+/5640893/13/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https.html
Implementation bugs are filed:
- Chromium: https://issues.chromium.org/issues/344963946
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1918971
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=275147
MDN issue is filed: Cover noopener-allow-popups COOP value mdn/mdn#579
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/browsers.html ( diff )
/references.html ( diff )

annevk

Would like to hear what @camillelamy thinks as well, but I think one change I'd like to see is that we drop "cross-origin" from the internal naming scheme now that we make it apply to same-origin scenarios.

(We probably don't want to change any of the IDs though.)

It also seems to me some other algorithms need updating here:

obtain a cross-origin opener policy
check if COOP values require a browsing context group switch

yoavweiss · 2024-06-10T16:05:36Z

I think one change I'd like to see is that we drop "cross-origin" from the internal naming scheme now that we make it apply to same-origin scenarios

Would it make sense to spin off this editorial only change to a separate PR? (happy to work on it, just wondering RE editorial vs. functional split)

obtain a cross-origin opener policy

Oops, added!

check if COOP values require a browsing context group switch

I think this is covered by the change to matching COOP, but I could be I'm missing something..

annevk · 2024-06-10T16:40:12Z

@yoavweiss I think once we have agreement for this PR, that could be a separate PR as well (to be landed first). It would be a bit of extra work, but I agree that it would be nicer.

https://bugs.webkit.org/show_bug.cgi?id=275147 Reviewed by NOBODY (OOPS!). The `noopener-allow-popups` COOP value would enable a document to ensure it can't be scripted by other same-origin documents that have opened it. Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application. The noopener-allow-popups Cross-Origin-Opener-Policy value severs the opener relationship between the document loaded with this policy and its opener. At the same time, this document can open further documents (as the "allow-popups" in the name suggests) and maintain its opener relationship with them, assuming that their COOP policy allows it. This implements whatwg/html#10394 * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/resources/reporting-common.js: (const.coopHeaders): A helper to create headers in a more succinct way. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resources/noopener-helper.js: Added. (getExecutorPath): (const.test_noopener_opening_popup): The logic for the noopener tests. (async const): * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https.html: Added. * Source/WebCore/loader/CrossOriginOpenerPolicy.cpp: (WebCore::crossOriginOpenerPolicyToString): Add the "noopener-allow-popups" string. (WebCore::crossOriginOpenerPolicyValueToEffectivePolicyString): Add the "noopener-allow-popups" string. (WebCore::matchingCOOP): Implement the related HTML algorithm. (WebCore::coopValuesRequireBrowsingContextGroupSwitch): Implement the switching logic related to noopener-allow-popups. (WebCore::obtainCrossOriginOpenerPolicy): Parse the "noopener-allow-popups" value. * Source/WebCore/loader/CrossOriginOpenerPolicy.h: Add the noopener-allow-popups enum value. * Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in: Add the noopener-allow-popups enum value.

yoavweiss · 2024-07-10T12:05:35Z

I added @ddworken's commented risks as a note.
I thought that a "browser context group switch" also implied a potentially separate process. @arturjanc - should I understand from your comment that you'd like to see something more explicit here?

arturjanc · 2024-08-07T11:27:18Z

@arturjanc - should I understand from your comment that you'd like to see something more explicit here?

Yes, I think it could be helpful to at least add a note somewhere saying that browser should aim to put documents with this COOP value in a separate renderer process (or something along these lines) -- otherwise, same-origin documents would still be able to read arbitrary from memory even if they can't directly access it using web-level APIs.

annevk · 2024-08-21T07:26:27Z

@yoavweiss did you open a PR already to drop "cross origin" from the internal concepts?

yoavweiss · 2024-08-27T11:28:03Z

@yoavweiss did you open a PR already to drop "cross origin" from the internal concepts?

Was out, will do that now..

This is a refactor-only change, that serves as a precursor to #10394, and makes progress on #10373.

source

annevk

I've done a quick editorial pass. I hope Camille can do another review regarding behavior.

source

camillelamy · 2024-10-04T12:47:12Z

Thanks! The behavior lgtm.

source

yoavweiss · 2024-10-07T08:21:04Z

Thanks for reviewing! Can you hit the merge button? I don't have permissions

annevk · 2024-10-07T08:22:50Z

See WHATWG Chat. Given it's a relatively big feature I'm doing a final call for comments. Will merge tomorrow if nobody replies.

https://bugs.webkit.org/show_bug.cgi?id=275147 Reviewed by NOBODY (OOPS!). The `noopener-allow-popups` COOP value would enable a document to ensure it can't be scripted by other same-origin documents that have opened it. Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application. The noopener-allow-popups Cross-Origin-Opener-Policy value severs the opener relationship between the document loaded with this policy and its opener. At the same time, this document can open further documents (as the "allow-popups" in the name suggests) and maintain its opener relationship with them, assuming that their COOP policy allows it. This implements whatwg/html#10394 * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/resources/reporting-common.js: (const.coopHeaders): A helper to create headers in a more succinct way. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resources/noopener-helper.js: Added. (getExecutorPath): (const.test_noopener_opening_popup): The logic for the noopener tests. (async const): * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https.html: Added. * Source/WebCore/loader/CrossOriginOpenerPolicy.cpp: (WebCore::crossOriginOpenerPolicyToString): Add the "noopener-allow-popups" string. (WebCore::crossOriginOpenerPolicyValueToEffectivePolicyString): Add the "noopener-allow-popups" string. (WebCore::matchingCOOP): Implement the related HTML algorithm. (WebCore::coopValuesRequireBrowsingContextGroupSwitch): Implement the switching logic related to noopener-allow-popups. (WebCore::obtainCrossOriginOpenerPolicy): Parse the "noopener-allow-popups" value. * Source/WebCore/loader/CrossOriginOpenerPolicy.h: Add the noopener-allow-popups enum value. * Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in: Add the noopener-allow-popups enum value.

annevk · 2024-10-08T12:23:38Z

Thanks @yoavweiss for all your hard work on this COOP improvement!

https://bugs.webkit.org/show_bug.cgi?id=275147 Reviewed by NOBODY (OOPS!). The `noopener-allow-popups` COOP value would enable a document to ensure it can't be scripted by other same-origin documents that have opened it. Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application. The noopener-allow-popups Cross-Origin-Opener-Policy value severs the opener relationship between the document loaded with this policy and its opener. At the same time, this document can open further documents (as the "allow-popups" in the name suggests) and maintain its opener relationship with them, assuming that their COOP policy allows it. This implements whatwg/html#10394 * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/resources/reporting-common.js: (const.coopHeaders): A helper to create headers in a more succinct way. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resources/noopener-helper.js: Added. (getExecutorPath): (const.test_noopener_opening_popup): The logic for the noopener tests. (async const): * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https.html: Added. * Source/WebCore/loader/CrossOriginOpenerPolicy.cpp: (WebCore::crossOriginOpenerPolicyToString): Add the "noopener-allow-popups" string. (WebCore::crossOriginOpenerPolicyValueToEffectivePolicyString): Add the "noopener-allow-popups" string. (WebCore::matchingCOOP): Implement the related HTML algorithm. (WebCore::coopValuesRequireBrowsingContextGroupSwitch): Implement the switching logic related to noopener-allow-popups. (WebCore::obtainCrossOriginOpenerPolicy): Parse the "noopener-allow-popups" value. * Source/WebCore/loader/CrossOriginOpenerPolicy.h: Add the noopener-allow-popups enum value. * Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in: Add the noopener-allow-popups enum value.

https://bugs.webkit.org/show_bug.cgi?id=275147 Reviewed by Alex Christensen. The `noopener-allow-popups` COOP value would enable a document to ensure it can't be scripted by other same-origin documents that have opened it. Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application. The noopener-allow-popups Cross-Origin-Opener-Policy value severs the opener relationship between the document loaded with this policy and its opener. At the same time, this document can open further documents (as the "allow-popups" in the name suggests) and maintain its opener relationship with them, assuming that their COOP policy allows it. This implements whatwg/html#10394 * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/resources/reporting-common.js: (const.coopHeaders): A helper to create headers in a more succinct way. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/reporting/tentative/access-to-noopener-page-from-no-coop-ro.https.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resources/noopener-helper.js: Added. (getExecutorPath): (const.test_noopener_opening_popup): The logic for the noopener tests. (async const): * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/tentative/noopener/coop-noopener-allow-popups.https.html: Added. * Source/WebCore/loader/CrossOriginOpenerPolicy.cpp: (WebCore::crossOriginOpenerPolicyToString): Add the "noopener-allow-popups" string. (WebCore::crossOriginOpenerPolicyValueToEffectivePolicyString): Add the "noopener-allow-popups" string. (WebCore::matchingCOOP): Implement the related HTML algorithm. (WebCore::coopValuesRequireBrowsingContextGroupSwitch): Implement the switching logic related to noopener-allow-popups. (WebCore::obtainCrossOriginOpenerPolicy): Parse the "noopener-allow-popups" value. * Source/WebCore/loader/CrossOriginOpenerPolicy.h: Add the noopener-allow-popups enum value. * Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in: Add the noopener-allow-popups enum value. Canonical link: https://commits.webkit.org/284866@main

This is a refactor-only change, that serves as a precursor to whatwg#10394, and makes progress on whatwg#10373.

This was referenced Jun 5, 2024

noopener-allow-popups value in COOP w3ctag/design-reviews#964

Closed

noopener-allow-popups value in COOP mozilla/standards-positions#1037

Open

Add a noopener-allow-popups value to COOP WebKit/standards-positions#360

Closed

annevk reviewed Jun 10, 2024

View reviewed changes

annevk added addition/proposal New features or enhancements needs implementer interest Moving the issue forward requires implementers to express interest labels Jun 10, 2024

yoavweiss mentioned this pull request Jun 17, 2024

Upcoming WHATNOT meeting on 6/20/2024 #10408

Closed

past added the agenda+ To be discussed at a triage meeting label Jun 17, 2024

yoavweiss force-pushed the coop_noopener_allow_popups branch from 9aa933f to a743f59 Compare June 20, 2024 06:44

past removed the agenda+ To be discussed at a triage meeting label Jun 21, 2024

yoavweiss mentioned this pull request Jul 2, 2024

COOP noopener-allow-popups WebKit/WebKit#30344

Merged

yoavweiss added agenda+ To be discussed at a triage meeting and removed agenda+ To be discussed at a triage meeting labels Jul 30, 2024

yoavweiss force-pushed the coop_noopener_allow_popups branch from f345df4 to 35c581a Compare August 9, 2024 09:15

yoavweiss mentioned this pull request Aug 27, 2024

Rename cross-origin opener policy concepts #10579

Merged

yoavweiss added the agenda+ To be discussed at a triage meeting label Sep 3, 2024

past mentioned this pull request Sep 5, 2024

Upcoming WHATNOT meeting on 2024-09-05 #10589

Closed

domfarolino pushed a commit that referenced this pull request Sep 12, 2024

Editorial: rename cross-origin opener policy concepts

54acf22

This is a refactor-only change, that serves as a precursor to #10394, and makes progress on #10373.

past removed the agenda+ To be discussed at a triage meeting label Sep 12, 2024

past mentioned this pull request Sep 12, 2024

Upcoming WHATNOT meeting on 2024-09-12 #10601

Closed

yoavweiss added 3 commits September 13, 2024 10:41

Add an omit value to Cross-Origin-Opener-Policy

99a9f5c

Change to noopener

b0a00bf

Parse the noopener value

bd2de0f

yoavweiss requested a review from domfarolino September 30, 2024 08:57

camillelamy reviewed Oct 2, 2024

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

clamy comments

5b9b277

yoavweiss requested a review from camillelamy October 2, 2024 12:25

More changes following discussion with clamy

0e6a6ba

yoavweiss requested a review from annevk October 3, 2024 03:55

annevk reviewed Oct 4, 2024

View reviewed changes

source Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

camillelamy approved these changes Oct 4, 2024

View reviewed changes

annevk review comments

cb7779e

yoavweiss requested a review from annevk October 4, 2024 13:28

annevk reviewed Oct 4, 2024

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

More review comments

1c0680e

yoavweiss requested a review from annevk October 5, 2024 03:50

annevk approved these changes Oct 7, 2024

View reviewed changes

annevk added the topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header label Oct 7, 2024

yoavweiss mentioned this pull request Oct 7, 2024

Coop noopener allow popups mdn/content#36232

Open

yoavweiss mentioned this pull request Oct 8, 2024

Add COOP noopener-allow-popups mdn/browser-compat-data#24660

Merged

annevk merged commit 60d1874 into whatwg:main Oct 8, 2024
2 checks passed

AtkinsSJ mentioned this pull request Oct 9, 2024

Add noopener-allow-popups value to Opener Policy LadybirdBrowser/ladybird#1690

Open

past mentioned this pull request Oct 12, 2024

Upcoming WHATNOT meeting on 2024-10-10 #10666

Closed

quadristan mentioned this pull request Oct 14, 2024

Fix typo in noopener-allow-popups #10700

Merged

2 tasks

dizhang168 pushed a commit to dizhang168/html that referenced this pull request Oct 28, 2024

Editorial: rename cross-origin opener policy concepts

235e953

This is a refactor-only change, that serves as a precursor to whatwg#10394, and makes progress on whatwg#10373.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a `noopener-allow-popups` value to COOP #10394

Add a `noopener-allow-popups` value to COOP #10394

yoavweiss commented Jun 5, 2024 •

edited by pr-preview bot

Loading

annevk left a comment

yoavweiss commented Jun 10, 2024

annevk commented Jun 10, 2024

yoavweiss commented Jul 10, 2024

arturjanc commented Aug 7, 2024

annevk commented Aug 21, 2024

yoavweiss commented Aug 27, 2024

annevk left a comment

camillelamy commented Oct 4, 2024

yoavweiss commented Oct 7, 2024

annevk commented Oct 7, 2024

annevk commented Oct 8, 2024

Add a noopener-allow-popups value to COOP #10394

Add a noopener-allow-popups value to COOP #10394

Conversation

yoavweiss commented Jun 5, 2024 • edited by pr-preview bot Loading

annevk left a comment

Choose a reason for hiding this comment

yoavweiss commented Jun 10, 2024

annevk commented Jun 10, 2024

yoavweiss commented Jul 10, 2024

arturjanc commented Aug 7, 2024

annevk commented Aug 21, 2024

yoavweiss commented Aug 27, 2024

annevk left a comment

Choose a reason for hiding this comment

camillelamy commented Oct 4, 2024

yoavweiss commented Oct 7, 2024

annevk commented Oct 7, 2024

annevk commented Oct 8, 2024

Add a `noopener-allow-popups` value to COOP #10394

Add a `noopener-allow-popups` value to COOP #10394

yoavweiss commented Jun 5, 2024 •

edited by pr-preview bot

Loading