NEW 273240
COEP supported for non-secure contexts 
https://bugs.webkit.org/show_bug.cgi?id=273240
Summary COEP supported for non-secure contexts
jannis.rautenstrauch
Reported 2024-04-25 02:49:34 PDT
The specification of COEP state that it only applies in secure contexts: https://html.spec.whatwg.org/multipage/browsers.html#coep 7.4.1.2: If environment is a non-secure context, then return policy. Safari seems to apply COEP regardless of the context: Visit a top-level page with HTTPS, frame an HTTP page (that sets COEP require-corp), load resources that are not allowed due to COEP (nor CORS or CORP header), they are blocked by Safari (applies COEP in non-secure context) but not in other browsers. Example URL: http://sub.headers.websec.saarland/_hp/tests/subresource-loading-coep.sub.html?resp_type=parsing&browser_id=1&label=COEP&first_id=20261&last_id=20265&scheme=http&t_resp_id=20263&t_element_relation=img_direct&t_resp_origin=https://headers.webappsec.eu swag.jpg has neither CORS nor CORP and is not allowed to load. FYI: I first reported the issue to Firefox and Chrome which follows the spec, but not applying COEP feels less secure. Firefox people mentioned it might make sense to change the spec. Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1891692 Chrome: https://issues.chromium.org/issues/334965851
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2024-05-02 02:50:15 PDT
<rdar://problem/127417844>
Note You need to log in before you can comment on or make changes to this bug.