Bug 273240
| Summary: | COEP supported for non-secure contexts | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | jannis.rautenstrauch |
| Component: | Page Loading | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | annevk, ap, beidson, cdumez, mike, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | Safari 17 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
jannis.rautenstrauch
The specification of COEP state that it only applies in secure contexts: https://html.spec.whatwg.org/multipage/browsers.html#coep
7.4.1.2: If environment is a non-secure context, then return policy.
Safari seems to apply COEP regardless of the context:
Visit a top-level page with HTTPS, frame an HTTP page (that sets COEP require-corp), load resources that are not allowed due to COEP (nor CORS or CORP header), they are blocked by Safari (applies COEP in non-secure context) but not in other browsers.
Example URL: http://sub.headers.websec.saarland/_hp/tests/subresource-loading-coep.sub.html?resp_type=parsing&browser_id=1&label=COEP&first_id=20261&last_id=20265&scheme=http&t_resp_id=20263&t_element_relation=img_direct&t_resp_origin=https://headers.webappsec.eu
swag.jpg has neither CORS nor CORP and is not allowed to load.
FYI: I first reported the issue to Firefox and Chrome which follows the spec, but not applying COEP feels less secure. Firefox people mentioned it might make sense to change the spec.
Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1891692
Chrome: https://issues.chromium.org/issues/334965851
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/127417844>