From bd798296a9675cf221174b86c768d9c4cac1647c Mon Sep 17 00:00:00 2001 From: Domenic Denicola Date: Wed, 15 Jul 2020 17:46:01 -0400 Subject: [PATCH] Define X-Frame-Options processing Closes #1230. --- source | 148 ++++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 131 insertions(+), 17 deletions(-) diff --git a/source b/source index b2b37c96d67..11094226680 100644 --- a/source +++ b/source @@ -2505,6 +2505,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • `Cross-Origin-Resource-Policy` header
  • process response
  • set
    • +
  • get, decode, and split
  • terminate
  • cross-origin resource policy check
  • the RequestCredentials enumeration
    • @@ -3796,6 +3797,8 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute

    then:

    @@ -84786,6 +84791,89 @@ interface BeforeUnloadEvent : Event { +

    The `X-Frame-Options` header

    + +

    The `X-Frame-Options` HTTP response header is a legacy way of controlling whether + and how a Document may be loaded inside of a child browsing context. It + is obsoleted by the frame-ancestors CSP directive, + which provides more granular control over the same situations. It was originally defined in + HTTP Header Field X-Frame-Options, but the definition and processing + model here supersedes that document. + +

    In particular, HTTP Header Field X-Frame-Options specified an ALLOW-FROM variant of the header, but this is not to be implemented.

    + +

    Per the below processing model, ifIf + both CSP frame-ancestors directive and + `X-Frame-Options` are used in the same response, then `X-Frame-Options` is ignored.

    + +

    TODO ABNF? Not sure of the normative status of those these days.

    + +
    + +

    To check a navigation response's adherence to `X-Frame-Options`, given + a response response, a browsing + context browsingContext, and an origin + destinationOrigin:

    + +
      +

    1. If browsingContext is not a child browsing context, then return + true.

      2. + +
    2. +

      For each policy of response's CSP list:

      + +
        +

      1. If policy's disposition is not "enforce", then continue.

        2. + +

      2. If policy's directive set contains a frame-ancestors directive, then return true.

        3. +
      +
      3. + +

    3. Let xFrameOptions be the result of getting, decoding, and splitting + `X-Frame-Options` from response's header list.

      4. + +

    4. If xFrameOptions contains "DENY", then return false.

      5. + +
    5. +

      If xFrameOptions contains "SAMEORIGIN", then:

      + +
        +

      1. Let ancestorBC be browsingContext's parent browsing + context.

        2. + +
      2. +

        While ancestorBC is not null:

        + +
          +

        1. Let origin be ancestorBC's active document's + origin.

          2. + +

        2. If origin is not same origin with + destinationOrigin, then return false.

          3. + +

        3. Set ancestorBC to ancestorBC's parent browsing + context, if one exists; otherwise, null.

          4. +
        +
        3. +
      +
      6. + +

    6. Return true.

      7. +
    + +
    + +

    Offline web applications

    @@ -117207,6 +117295,29 @@ interface External { +

    `X-Frame-Options`

    + +

    This section describes a header for registration in the Permanent Message Header Field + Registry.

    + +
    +
    Header field name:
    +
    X-Frame-Options
    +
    Applicable protocol:
    +
    http
    +
    Status:
    +
    standard
    +
    Author/Change controller:
    +
    WHATWG
    +
    Specification document(s):
    +
    + This document is the relevant specification. +
    +
    Related information:
    +
    None.
    +
    + +

    web+ scheme prefix

    This section describes a convention for use with the IANA URI scheme registry. It does not @@ -122164,6 +122275,9 @@ INSERT INTERFACES HERE

    [RFC6596]
    The Canonical Link Relation, M. Ohye, J. Kupke. IETF.
    +
    [RFC7034]
    +
    HTTP Header Field X-Frame-Options, D. Ross, T. Gondrom. IETF.
    +
    [RFC7303]
    XML Media Types, H. Thompson, C. Lilley. IETF.