COEP HTTP - works with CORS and CORP - but separately #37343

hamishwillee · 2024-12-23T05:34:04Z

In addition this is a significant rework of the COEP header because I found it confusing.
The main problem I have with the existing doc is that it mixes up the effects and "nature" of CORS and CORP and the effect of this header when using these two.

Using the example of an <img> it is important to remember that a cross-origin fetch is allowed by default - if your HTML doesn't include crossorigin attribute the image is fetched in no-cors mode and will be returned by default and included unless the resource has CORP set on it.
However if you set the crossorigin attribute the request is not-no-cors - it might be a cors mode request and could have different settings for things like whether credentials are included.

So it isn't just you must set CORs or CORP, it depends on how you make the request. I have tried to draw that distinction.

PS. The bug was about navigation requests. I dont think they are relevant, because a navigation is not embedding a resource. Though I guess the fetch of a new content for a frame would count, and that would be handled as per usual for CORs (whatever that is).

hamishwillee · 2024-12-23T05:35:53Z

files/en-us/web/http/headers/cross-origin-embedder-policy/index.md

@@ -31,12 +31,24 @@ Cross-Origin-Embedder-Policy: unsafe-none | require-corp | credentialless
 ### Directives

 - `unsafe-none`
-  - : This is the default value. Allows the document to fetch cross-origin resources without giving explicit permission through the CORS protocol or the {{HTTPHeader("Cross-Origin-Resource-Policy")}} header.
+  - : Allows the document to load cross-origin resources without giving explicit permission through the CORS protocol or the {{HTTPHeader("Cross-Origin-Resource-Policy")}} header.


What if CORP is same-origin - i.e. the unsafe-none would allow loading if CORP isn't set, but will the browser allow this if CORP explicitly says it does NOT want to be loaded?

I'm having trouble working it out from the spec.

I read and re-read this and checked some explainers and this is my understanding:

You can set CORP on any individual resource (regardless of COEP) and CORP will be respected -> explicitly setting COEP 'unsafe-none' doesn't interfere with CORP.

If you set COEP require-corp, then all resources (descendents) must have a CORP / CORS policy.

It boils down to scope, so a resource can have a CORP / CORS that controls where it's embedded, then a document sets COEP, and all embedded things have to have CORP or CORS defined.

COEP prevents a document from loading any non-same-origin resources which don't explicitly grant the document permission to be loaded.

https://github.com/ArthurSonzogni/coep-reflection?tab=readme-ov-file#motivating-use-cases

Also we should add these to the See also:

https://web.dev/articles/why-coop-coep#coep

https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/edit?tab=t.0

https://developer.mozilla.org/en-US/docs/Web/API/Window/crossOriginIsolated

and maybe also https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer#security_requirements

github-actions · 2024-12-23T05:35:56Z

Preview URLs

/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy

Flaws (1)

URL: /en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
Title: Cross-Origin-Embedder-Policy
Flaw count: 1

unknown:
- No generic content config found

(comment last updated: 2025-01-23 23:30:57)

hamishwillee · 2024-12-23T05:36:49Z

files/en-us/web/http/headers/cross-origin-embedder-policy/index.md

+  - : A document can load cross-origin resources that are requested in [`no-cors` mode](/en-US/docs/Web/API/Request/mode) **without** an explicit permission via the {{HTTPHeader("Cross-Origin-Resource-Policy")}} header.
+    In this case requests are sent without credentials: cookies are omitted in the request, and ignored in the response.


Again, what if CORP is same-origin - i.e. the unsafe-none would allow loading if CORP isn't set, but will the browser allow this if CORP explicitly says it does NOT want to be loaded?

hamishwillee · 2024-12-23T05:37:29Z

files/en-us/web/http/headers/cross-origin-embedder-policy/index.md

-If you enable COEP using `require-corp` and have a cross origin resource that needs to be loaded, it needs to support [CORS](/en-US/docs/Web/HTTP/CORS) and you need to explicitly mark the resource as loadable from another origin to avoid blockage from COEP. For example, you can use the [`crossorigin`](/en-US/docs/Web/HTML/Attributes/crossorigin) attribute for this image from a third-party site:
+If you enable COEP using `require-corp` and want to embed a cross origin resource that supports [CORS](/en-US/docs/Web/HTTP/CORS), you will need to explicitly specify the HTML [`crossorigin`](/en-US/docs/Web/HTML/Attributes/crossorigin) attribute so that it is requested in `cors` mode.
+
+For example, you would you this approach to fetch an image from a third-party site that supports CORS:



Note, we could do with an equivalent example for CORP.

But not planning on doing now!

bsmth · 2025-01-21T09:46:53Z

files/en-us/web/http/headers/cross-origin-embedder-policy/index.md

-If you enable COEP using `require-corp` and have a cross origin resource that needs to be loaded, it needs to support [CORS](/en-US/docs/Web/HTTP/CORS) and you need to explicitly mark the resource as loadable from another origin to avoid blockage from COEP. For example, you can use the [`crossorigin`](/en-US/docs/Web/HTML/Attributes/crossorigin) attribute for this image from a third-party site:
+If you enable COEP using `require-corp` and want to embed a cross origin resource that supports [CORS](/en-US/docs/Web/HTTP/CORS), you will need to explicitly specify the HTML [`crossorigin`](/en-US/docs/Web/HTML/Attributes/crossorigin) attribute so that it is requested in `cors` mode.
+
+For example, you would you this approach to fetch an image from a third-party site that supports CORS:


Suggested change

For example, you would you this approach to fetch an image from a third-party site that supports CORS:

For example, you would use this approach to fetch an image from a third-party site that supports CORS:

bsmth · 2025-01-21T09:57:16Z

files/en-us/web/http/headers/cross-origin-embedder-policy/index.md

@@ -68,7 +80,9 @@ if (crossOriginIsolated) {

 ### Avoiding COEP blockage with CORS

-If you enable COEP using `require-corp` and have a cross origin resource that needs to be loaded, it needs to support [CORS](/en-US/docs/Web/HTTP/CORS) and you need to explicitly mark the resource as loadable from another origin to avoid blockage from COEP. For example, you can use the [`crossorigin`](/en-US/docs/Web/HTML/Attributes/crossorigin) attribute for this image from a third-party site:
+If you enable COEP using `require-corp` and want to embed a cross origin resource that supports [CORS](/en-US/docs/Web/HTTP/CORS), you will need to explicitly specify the HTML [`crossorigin`](/en-US/docs/Web/HTML/Attributes/crossorigin) attribute so that it is requested in `cors` mode.


Not just via HTML, but fetch('https://thing', { mode: 'cors' }) or crossOrigin like https://developer.mozilla.org/en-US/docs/Web/API/HTMLScriptElement/crossOrigin

bsmth · 2025-01-21T09:58:06Z

files/en-us/web/http/headers/cross-origin-embedder-policy/index.md

+    Cross-origin resource loading will be blocked by COEP unless:
+
+    - The resource is requested in `no-cors` mode and the response includes a {{HTTPHeader("Cross-Origin-Resource-Policy")}} header that allows it to be loaded into the document origin.
+    - The resource is requested in `cors` mode (the HTML [`crossorigin`](/en-US/docs/Web/HTML/Attributes/crossorigin) attribute is set) and the resource supports CORS.


Same comment as below, not just HTML, but via fetch mode: cors or crossOrigin in JS.

github-actions bot added Content:HTTP HTTP docs size/s [PR only] 6-50 LoC changed labels Dec 23, 2024

hamishwillee commented Dec 23, 2024

View reviewed changes

hamishwillee marked this pull request as ready for review December 23, 2024 05:37

hamishwillee requested a review from a team as a code owner December 23, 2024 05:37

hamishwillee requested review from bsmth, a team and wbamberg and removed request for a team and bsmth December 23, 2024 05:37

hamishwillee mentioned this pull request Dec 23, 2024

credentialless - explanation of "navigate" requests requiring Cross-Origin-Resource-Policy response header #36503

Open

hamishwillee force-pushed the coep_fix branch from 29e6154 to 10cf65b Compare January 20, 2025 03:22

bsmth reviewed Jan 21, 2025

View reviewed changes

wbamberg removed their request for review January 22, 2025 23:37

COEP HTTP - tidy up some confusion

d260ad3

hamishwillee force-pushed the coep_fix branch from 10cf65b to d260ad3 Compare January 23, 2025 23:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

COEP HTTP - works with CORS and CORP - but separately #37343

COEP HTTP - works with CORS and CORP - but separately #37343

hamishwillee commented Dec 23, 2024 •

edited

Loading

hamishwillee Dec 23, 2024 •

edited

Loading

bsmth Jan 21, 2025

bsmth Jan 21, 2025

github-actions bot commented Dec 23, 2024 •

edited

Loading

hamishwillee Dec 23, 2024

hamishwillee Dec 23, 2024

hamishwillee Jan 20, 2025

bsmth Jan 21, 2025

bsmth Jan 21, 2025

bsmth Jan 21, 2025

		- : A document can load cross-origin resources that are requested in [`no-cors` mode](/en-US/docs/Web/API/Request/mode) without an explicit permission via the {{HTTPHeader("Cross-Origin-Resource-Policy")}} header.
		In this case requests are sent without credentials: cookies are omitted in the request, and ignored in the response.

	For example, you would you this approach to fetch an image from a third-party site that supports CORS:
	For example, you would use this approach to fetch an image from a third-party site that supports CORS:

COEP HTTP - works with CORS and CORP - but separately #37343

Are you sure you want to change the base?

COEP HTTP - works with CORS and CORP - but separately #37343

Conversation

hamishwillee commented Dec 23, 2024 • edited Loading

hamishwillee Dec 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Dec 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hamishwillee commented Dec 23, 2024 •

edited

Loading

hamishwillee Dec 23, 2024 •

edited

Loading

github-actions bot commented Dec 23, 2024 •

edited

Loading