Limiting Same Origin Document Access

[dtapuska]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: Document Access Feature Policy
• Specification or proposal URL: Add disallowdocumentaccess iframe attribute to force a creation of a new agent cluster map whatwg/html#4606, https://github.com/dtapuska/documentaccess
• Mozillians who can provide input (optional): @bzbarsky @annevk

Other information

Blink Intent to Implement
TAG Review

[bzbarsky]

I'm generally pretty wary of adding new security primitives. I raised dtapuska/documentaccess#2 asking whether forcing nonce origins would achieve the goals of this proposal without the new-security-primitive angle.

[annevk]

Given the use cases provided and the statement that this is a security primitive, I don't think this is a good idea as while it allows some isolation between same-origin content, it leaves plenty of channels around. I recommend harmful as a position therefore. (I filed dtapuska/documentaccess#4 on this.)

[dbaron]

@annevk do you still hold that position following the discussion in that issue? If so, do you want to make a PR to add this to the table?

[dtapuska]

@annevk Just wanted to check in now that W3C has closed their review indicating that they do recognize the problem and the approach Chromium outlined was reasonable. I anticipate proceeding with it in Chromium but wanted to just have a final statement from Mozilla after the TAG review was completed.

[annevk]

I don't really see what's changed and it doesn't seem like the TAG considered the point about influencing the way code in third parties runs.