Define X-Frame-Options processing

[domenic]

Closes #1230.

@annevk can you help me define the ABNF for this, and relatedly, the header handling? I used "get, decode, and split" but maybe I should be using one of https://fetch.spec.whatwg.org/#extract-header-values ?

Interop issues/deviations from this spec:

• Firefox does not treat quoted values the same as unquoted values. Chrome does. This spec does (by using "get, decode, and split").
• Chrome and Safari treat XFO: INVALID; XFO: SAMEORIGIN (or the reverse) as XFO: DENY. Firefox and this spec treats them as XFO: SAMEORIGIN.

• At least two implementers are interested (and none opposed):
  • This processing model matches Chrome and Safari exactly. Firefox does not implement the conflicts -> fail logic.
• Tests are written and can be reviewed and commented upon at:
  • Test some more edge cases for X-Frame-Options web-platform-tests/wpt#24618 greatly fleshes out the existing suite to cover all the edge cases detailed here
• Implementation bugs are filed:
  • Chrome: N/A
  • Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1659763
  • Safari: N/A

(See WHATWG Working Mode: Changes for more details.)

---

/browsing-the-web.html ( diff )
/iana.html ( diff )
/index.html ( diff )
/infrastructure.html ( diff )
/references.html ( diff )

[annevk]

Thanks for tackling this. I've asked @mozfreddyb to take a look as well.

[dveditz]

Why do we need to parse quoted values? They weren't in the original IE implementation nor RFC 7034. In Scott Helme's "top 1 million Alexa site" security header scans there are very few instances of XFO headers that contain quotes at all, and most of those are otherwise invalid with or without the quotes, like this gem: ALLOW-FROM="^https?:\/\/([^\/]+\.)?(tv-karelia\.ru|webvisor\.com)\/". There were 8 instances of "SAMEORIGIN" that allowing quotes would make valid. That doesn't seem like enough to change this syntax.

https://crawler.ninja/files/xfo-values.txt

[domenic]

Because that's consistent with all other comma-delimited headers that use https://fetch.spec.whatwg.org/#concept-header-list-get-decode-split .

[domenic]

Hmm, adding more tests for quoted values explicitly:

• Firefox treats "sameOriGin" and "denY" as SAMEORIGIN
• Chrome treats "sameOriGin" and "denY" as no-header (allows all)

Given the lack of interop here, I think the proposed spec (treating the quoted values the same as unquoted ones) is better, as it is stricter and matches other headers' processing models.

[annevk]

Daniel's comment did make me wonder if X-Content-Type-Options does in fact support "nosniff" as value. And it seems that fetch/nosniff/resources/x-content-type-options.json has no coverage for that and browsers do not support it. I filed whatwg/fetch#1068 on Fetch for this. Would appreciate your thoughts.

[domenic]

Hmm, OK. So let's write this spec assuming whatwg/fetch#1068 is fixed, and thus quoted values are treated as invalid values.

With the current PR draft that would give Chrome's behavior, treating "sameOriGin" and "denY" as no-header, and thus allowing all values through. I'll update the tests PR in that direction, tentatively.

[domenic]

Something must have been wrong with my tests previously. (There is a lot of copying and pasting in the current infrastructure; probably we should straighten that out in the future.) With the latest version Firefox passes everything.

[domenic]

Let's continue the discussion in the issue: #1230 (comment)

[annevk]

Thanks @domenic. I think this looks good now that we resolved the confusion around quotes. Should we address the quotes in an example to be sure or is that no longer needed now that Fetch covers it?

@mozfreddyb you might want to have a final look at this.

[domenic]

Fixed up; going to merge! Indeed, I think the quotes are not necessary to address in the examples table, as it's handled at a lower layer and doesn't exemplify any of the specific processing model in this algorithm. In general the examples table treads a fine line between duplicating web platform tests and being a helpful aid to the reader, so my instinct is to keep it more minimal...