Enforce COEP in SharedWorker

[ArthurSonzogni]

Request for Mozilla Position on a Web Specification

• Specification Title: Enforce COEP in SharedWorker
• Specification or proposal URL: https://html.spec.whatwg.org/multipage/browsers.html#coep
  • This is not something new. It was specified in the COEP specification. It is now living in the HTML specification mostly. See HTML PR: Introduce COEP whatwg/html#5454
• Caniuse.com URL (optional): https://caniuse.com/?search=cross-origin-embedder-policy
• Bugzilla URL (optional): https://bugzilla.mozilla.org/show_bug.cgi?id=1613912
• Mozillians who can provide input (optional): @annevk

Other information

Chrome would like to implement the COEP specification and support SharedWorker. For now, this is only about enforcing COEP, without granting the cross-origin-isolation capability. (+CC @iVanlIsh who bring support)
See intent-to-ship: https://groups.google.com/a/chromium.org/g/blink-dev/c/wM0W7z_Vh0Y

To ship, we need the official Mozilla's position about enforcing COEP in SharedWorker.

Current support of COEP:

Firefox currently supports Document and DedicatedWorker, and I think want to implement support for ServiceWorker and SharedWorker:
https://bugzilla.mozilla.org/show_bug.cgi?id=1613912

Chrome currently support Document, DedicatedWorker (1) and ServiceWorker (2).
(1) Partial support until PlzDedicatedWorker.
(2) Partial support until PlzServiceWorker. Moreover, Cross-origin-isolation capability is not granted.

Webkit is implementing COEP with support for every workers (according to this patch), however SharedWorker is excluded, because Webkit dropped SharedWorker from their implementation.

[annevk]

This is worth prototyping as per agreement on the spec PR. I don't think it needs a dashboard entry. Will leave it open for a bit in case anyone else has thoughts.