Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Relax the login status requirement from same-origin to same-site #538

Merged
merged 1 commit into from
Aug 16, 2024
Merged

Relax the login status requirement from same-origin to same-site #538

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 24 additions & 3 deletions spec/index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,6 +354,26 @@ value |value|:

</div>

### Infrastructure algorithm ### {#infra-algorithm}

<div algorithm>
An [=environment settings object=] (|settings|) is <dfn noexport>same-site with its
ancestors</dfn> if the following algorithm returns `true`:

1. If |settings|'s [=relevant global object=] has no [=associated Document=],
return `false`.
1. Let |document| be |settings|' [=relevant global object=]'s [=associated Document=].
1. If |document| has no [=Document/browsing context=], return `false`.
1. Let |origin| be |settings|' [=environment settings object/origin=].
1. Let |navigable| be |document|'s [=node navigable=].
1. While |navigable| has a non-null [=navigable/parent=]:
1. Set |navigable| to |navigable|'s [=navigable/parent=].
1. If |navigable|'s [=active document=]'s [=Document/origin=] is not
[=/same site=] with |origin|, return `false`.
1. Return `true`.

</div>

### HTTP header API ### {#login-status-http}

[=IDPs=] can set the login status using an HTTP [=response=] [=header=] as follows.
Expand All @@ -366,14 +386,15 @@ be the result of [=get a structured field value=] from the response's header
list with name "<dfn><code>Set-Login</code></dfn>" and type "`item`". If |value| is not null,
process this header as follows:


<div algorithm="process the login status header">
1. Let |origin| be the response's [=response/URL=]'s [=/origin=].
1. Let |client| be the [=/request=]'s [=request/client=].
1. If the request's [=request/destination=] is not `"document"`:
1. If |client| is null, return.
1. If |origin| is not [=same origin=] with the [=/request=]'s
1. If |origin| is not [=/same site=] with the [=/request=]'s
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is the significance of / in the dfn syntax? I don't see any reference in the bikeshed docs.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See https://speced.github.io/bikeshed/#autolink-inside -- it links to a dfn that has no for attribute (here, used to disambiguate what it links to)

[=request/origin=], return.
1. If |client| is not [=same-origin with its ancestors=], return.
1. If |client| is not [=same-site with its ancestors=], return.
1. Assert that |value| is a tuple.
1. Let |token| be the first entry of |value|.
1. If |token| is `"logged-in"`, [=set the login status=] for |origin|
Expand Down Expand Up @@ -406,7 +427,7 @@ partial interface Navigator {

<div algorithm="setStatus">
When {{NavigatorLogin/setStatus()}} is called with argument |status|:
1. If the [=current settings object=] is not [=same-origin with its ancestors=],
1. If the [=current settings object=] is not [=same-site with its ancestors=],
throw a {{SecurityError}} {{DOMException}}.
1. Let |origin| be the [=current settings object=]'s
[=environment settings object/origin=].
Expand Down
Loading