Skip to content

Have CORP check rely on request's response tainting rather than request's mode #985

@yutakahirano

Description

@yutakahirano

Brought up at https://chromium-review.googlesource.com/c/chromium/src/+/1971810, related with w3c/ServiceWorker#1490.

We would like to run the CORP check in CacheStorage for COEP (w3c/ServiceWorker#1490), but currently the CORP check relies on the request mode which is not directly accessible there. request's response tainting is stored as response type and we can use it. What do you think about changing the first item as follows?

If request's response tainting is not "opaque", then return allowed.

In the CacheStorage spec, we will restore a request for the CORP check as follows:

  • Let request be a new request.
  • Set request's URL to the given URL.
  • Set request's origin to the current realm's origin
  • Set request's response tainting to
    • "basic" if response's type is "basic", "default" or "opaqueredirect"
    • "opaque" if response's type is "opaque"
    • "cors" if response's type is "cors"

@ArthurSonzogni @wanderview @annevk

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions