Bug 94836 - Support for X-Frame-Options: Allow-From [uri]
: Support for X-Frame-Options: Allow-From [uri]
Status: NEW
: WebKit
Frames
: 528+ (Nightly build)
: All All
: P2 Normal
Assigned To:
:
: InRadar
:
:
  Show dependency treegraph
 
Reported: 2012-08-23 12:55 PST by
Modified: 2014-01-23 15:28 PST (History)


Attachments
Patch (6.56 KB, patch)
2012-08-23 12:55 PST, Phil Ames
no flags Review Patch | Details | Formatted Diff | Diff
Updated patch. (5.91 KB, patch)
2012-08-28 19:12 PST, Phil Ames
abarth: review-
Review Patch | Details | Formatted Diff | Diff
X-F-O Allow From implementation (10.65 KB, patch)
2013-04-12 09:20 PST, Phil Ames
no flags Review Patch | Details | Formatted Diff | Diff


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2012-08-23 12:55:10 PST
Related to https://bugs.webkit.org/show_bug.cgi?id=23907 (hence the initial CC's)

Attached is a patch which enables support for “Allow-From [uri]” notation in the X-Frame-Options header.  I compared the behavior of patched Chrome with IE9 with the below values (syntax:IE permitted/patched Chrome permitted/header-value) which was sent by a cross-origin site (the top origin was http://www.intra.net/)

Probably the most substantial difference is that IE doesn’t seem to regard the port number.  A similar patch for Firefox which I will be submitting soon (to https://bugzilla.mozilla.org/show_bug.cgi?id=690168) produces the same behavior as this patch to Chrome, though.

N/N/X-Frame-Options: Allow-From
N/N/X-Frame-Options: Allow-From xyz
N/N/X-Frame-Options: Allow-From www.intra.net
Y/Y/X-Frame-Options: Allow-From http://www.intra.net
Y/Y/X-Frame-Options: Allow-From http://www.intra.net/
Y/Y/X-Frame-Options: Allow-From http://www.intra.net:80/
Y/N/X-Frame-Options: Allow-From http://www.intra.net:81/
Y/N/X-Frame-Options: Allow-From http://www.intra.net:443/
Y/Y/X-Frame-Options: Allow-From http://www.intra.net/foo/bar/

Please also note that although I modelled the LayoutTests after the ones that I found in the existing tree, I was not actually able to get them to run on my development environment, so they may require some tweaking (sorry, if anyone is at Google and wants to spend a few minutes helping me troubleshoot / get it working, I’d be happy to test and send an additional diff). The results in the table above are solely from ‘empirical’ testing/observation.
------- Comment #1 From 2012-08-23 12:55:39 PST -------
Created an attachment (id=160219) [details]
Patch
------- Comment #2 From 2012-08-23 12:58:36 PST -------
[trying to cc myself]
------- Comment #3 From 2012-08-23 13:00:20 PST -------
Note: We're still discussing this feature in the IETF websec working group.  Generally, our position has been that we shouldn't be adding new features to X-Frame-Options.  Instead, we should create a CSP directive that satisfies these use cases.
------- Comment #4 From 2012-08-28 19:12:11 PST -------
Created an attachment (id=161116) [details]
Updated patch.

FYI: I managed to get the layout tests passing, and also addressed that this would accept something like "Allow-Fromhttp://foo.com" instead of "Allow-From http://foo.com".
------- Comment #5 From 2012-08-28 19:23:38 PST -------
@Phil: I appreciate your enthusiasm, but it's unlikely that we'll accept this patch until the standards issues are resolved.
------- Comment #6 From 2012-08-28 19:24:30 PST -------
Understood, I just figured it made sense to have something up-to-date and attached here rather than something broken.
------- Comment #7 From 2013-04-12 09:20:05 PST -------
Created an attachment (id=197858) [details]
X-F-O Allow From implementation

I noticed this code had been refactored, so I've updated the patch.
------- Comment #8 From 2013-04-16 17:45:32 PST -------
In radar as <rdar://problem/13658368>

I'll try to take a look at this patch soon.
------- Comment #9 From 2013-04-16 18:25:23 PST -------
(In reply to comment #8)
> In radar as <rdar://problem/13658368>
> 
> I'll try to take a look at this patch soon.

You should be aware that this feature is controversial in the W3C WebAppSec working group.  Before implementing it, you might want to confer with the working group.
------- Comment #10 From 2013-04-16 21:42:36 PST -------
(In reply to comment #9)
> (In reply to comment #8)
> > In radar as <rdar://problem/13658368>
> > 
> > I'll try to take a look at this patch soon.
> 
> You should be aware that this feature is controversial in the W3C WebAppSec working group.  Before implementing it, you might want to confer with the working group.

Interesting.

We were looking at it because it's been in the IETF draft for some time (http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01) and has utility we're interested in.

I'm failing at finding relevant threads in the webappsec archives that demonstrate this controversy.  Have any pointers?
------- Comment #11 From 2013-04-16 21:58:26 PST -------
> We were looking at it because it's been in the IETF draft for some time (http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01) and has utility we're interested in.

The IETF websec working group has not addressed my WGLC feedback on this aspect of draft-ietf-websec-x-frame-options:

http://www.ietf.org/mail-archive/web/websec/current/msg01459.html

> I'm failing at finding relevant threads in the webappsec archives that demonstrate this controversy.  Have any pointers?

I couldn't find a good email thread in quick search.  The basic issue is that allow-from is basically the same thing as a source-expression from CSP but uses an incompatible syntax.

The current agreement in both the IETF websec working group and the W3C WebAppSec working group is to not add any new features to X-Frame-Options (including allow-from) and instead make frame-options into a CSP directive.

The final point of controversy is whether to let the web site specify multiple values for the frame-options directive (i.e., whether to allow a source-list like other CSP directives or whether to restrict frame-options to a single source-expression).

I'd recommend not implementing allow-from in X-Frame-Options until these issues are resolved.  I'd expect the likely outcome to be a frame-options CSP directive that either takes a source-list or a source-expression.

The W3C WebAppSec working group has a face-to-face meeting on April 25-26 where I'd expect these issues to be hammered out.  If you're interested in these topics, I'd encourage you to attend.
------- Comment #12 From 2013-04-16 22:21:04 PST -------
I'll try to be on IRC.