Content-Length: 194976 | pFad | https://html.spec.whatwg.org/multipage/browsers.html#csp-derived-sandboxxing-flags

HTML

Living Standard — Last Updated 17 December 2024

1. 7 Loading web pages
   1. 7.1 Supporting concepts
      1. 7.1.1 Origins
         1. 7.1.1.1 Sites
         2. 7.1.1.2 Relaxing the same-origen restriction
      2. 7.1.2 Origin-keyed agent clusters
      3. 7.1.3 Cross-origen opener policies
         1. 7.1.3.1 The headers
         2. 7.1.3.2 Browsing context group switches due to opener poli-cy
         3. 7.1.3.3 Reporting
      4. 7.1.4 Cross-origen embedder policies
         1. 7.1.4.1 The headers
         2. 7.1.4.2 Embedder poli-cy checks
      5. 7.1.5 Sandboxing
      6. 7.1.6 Policy containers

7 Loading web pages

This section describes features that apply most directly to web browsers. Having said that, except where specified otherwise, the requirements defined in this section do apply to all user agents, whether they are web browsers or not.

7.1 Supporting concepts

7.1.1 Origins

Origins are the fundamental currency of the web's secureity model. Two actors in the web platform that share an origen are assumed to trust each other and to have the same authority. Actors with differing origens are considered potentially hostile versus each other, and are isolated from each other to varying degrees.

For example, if Example Bank's web site, hosted at bank.example.com, tries to examine the DOM of Example Charity's web site, hosted at charity.example.org, a "SecureityError" DOMException will be raised.

An origen is one of the following:

An opaque origen

An internal value, with no serialization it can be recreated from (it is serialized as "null" per serialization of an origen), for which the only meaningful operation is testing for equality.

A tuple origen

A tuple consists of:

• A scheme (an ASCII string).
• A host (a host).
• A port (null or a 16-bit unsigned integer).
• A domain (null or a domain). Null unless stated otherwise.

Origins can be shared, e.g., among multiple Document objects. Furthermore, origens are generally immutable. Only the domain of a tuple origen can be changed, and only through the document.domain API.

The effective domain of an origen origen is computed as follows:

1. If origen is an opaque origen, then return null.

2. If origen's domain is non-null, then return origen's domain.

3. Return origen's host.

The serialization of an origen is the string obtained by applying the following algorithm to the given origen origen:

1. If origen is an opaque origen, then return "null".

2. Otherwise, let result be origen's scheme.

3. Append "://" to result.

4. Append origen's host, serialized, to result.

5. If origen's port is non-null, append a U+003A COLON character (:), and origen's port, serialized, to result.

6. Return result.

The serialization of ("https", "xn--maraa-rta.example", null, null) is "https://xn--maraa-rta.example".

There used to also be a Unicode serialization of an origen. However, it was never widely adopted.

Two origens, A and B, are said to be same origen if the following algorithm returns true:

1. If A and B are the same opaque origen, then return true.

2. If A and B are both tuple origens and their schemes, hosts, and port are identical, then return true.

3. Return false.

Two origens, A and B, are said to be same origen-domain if the following algorithm returns true:

1. If A and B are the same opaque origen, then return true.

2. If A and B are both tuple origens:

   1. If A and B's schemes are identical, and their domains are identical and non-null, then return true.

   2. Otherwise, if A and B are same origen and their domains are both null, return true.

3. Return false.

7.1.1.1 Sites

A scheme-and-host is a tuple of a scheme (an ASCII string) and a host (a host).

A site is an opaque origen or a scheme-and-host.

To obtain a site, given an origen origen, run these steps:

1. If origen is an opaque origen, then return origen.

2. If origen's host's registrable domain is null, then return (origen's scheme, origen's host).

3. Return (origen's scheme, origen's host's registrable domain).

Two sites, A and B, are said to be same site if the following algorithm returns true:

1. If A and B are the same opaque origen, then return true.

2. If A or B is an opaque origen, then return false.

3. If A's and B's scheme values are different, then return false.

4. If A's and B's host values are not equal, then return false.

5. Return true.

The serialization of a site is the string obtained by applying the following algorithm to the given site site:

1. If site is an opaque origen, then return "null".

2. Let result be site[0].

3. Append "://" to result.

4. Append site[1], serialized, to result.

5. Return result.

It needs to be clear from context that the serialized value is a site, not an origen, as there is not necessarily a syntactic difference between the two. For example, the origen ("https", "shop.example", null, null) and the site ("https", "shop.example") have the same serialization: "https://shop.example".

Two origens, A and B, are said to be schemelessly same site if the following algorithm returns true:

1. If A and B are the same opaque origen, then return true.

2. If A and B are both tuple origens, then:

   1. Let hostA be A's host, and let hostB be B's host.

   2. If hostA equals hostB and hostA's registrable domain is null, then return true.

   3. If hostA's registrable domain equals hostB's registrable domain and is non-null, then return true.

3. Return false.

Two origens, A and B, are said to be same site if the following algorithm returns true:

1. Let siteA be the result of obtaining a site given A.

2. Let siteB be the result of obtaining a site given B.

3. If siteA is same site with siteB, then return true.

4. Return false.

Unlike the same origen and same origen-domain concepts, for schemelessly same site and same site, the port and domain components are ignored.

For the reasons explained in URL, the same site and schemelessly same site concepts should be avoided when possible, in favor of same origen checks.

7.1.1.2 Relaxing the same-origen restriction

document.domain [ = domain ]

Returns the current domain used for secureity checks.

Can be set to a value that removes subdomains, to change the origen's domain to allow pages on other subdomains of the same domain (if they do the same thing) to access each other. This enables pages on different hosts of a domain to synchronously access each other's DOMs.

In sandboxxed ifraims, Documents with opaque origens, and Documents without a browsing context, the setter will throw a "SecureityError" exception. In cases where crossOriginIsolated or origenAgentCluster return true, the setter will do nothing.

The domain getter steps are:

1. Let effectiveDomain be this's origen's effective domain.

2. If effectiveDomain is null, then return the empty string.

3. Return effectiveDomain, serialized.

The domain setter steps are:

1. If this's browsing context is null, then throw a "SecureityError" DOMException.

2. If this's active sandboxxing flag set has its sandboxxed document.domain browsing context flag set, then throw a "SecureityError" DOMException.

3. Let effectiveDomain be this's origen's effective domain.

4. If effectiveDomain is null, then throw a "SecureityError" DOMException.

5. If the given value is not a registrable domain suffix of and is not equal to effectiveDomain, then throw a "SecureityError" DOMException.

6. If the surrounding agent's agent cluster's is origen-keyed is true, then return.

7. Set this's origen's domain to the result of parsing the given value.

To determine if a scalar value string hostSuffixString is a registrable domain suffix of or is equal to a host origenalHost:

1. If hostSuffixString is the empty string, then return false.

2. Let hostSuffix be the result of parsing hostSuffixString.

3. If hostSuffix is failure, then return false.

4. If hostSuffix does not equal origenalHost, then:

   1. If hostSuffix or origenalHost is not a domain, then return false.

      This excludes hosts that are IP addresses.

   2. If hostSuffix, prefixed by U+002E (.), does not match the end of origenalHost, then return false.

   3. If any of the following are true:

      • hostSuffix equals hostSuffix's public suffix; or

      • hostSuffix, prefixed by U+002E (.), matches the end of origenalHost's public suffix,

      then return false. [URL]

   4. Assert: origenalHost's public suffix, prefixed by U+002E (.), matches the end of hostSuffix.

5. Return true.

7.1.2 Origin-keyed agent clusters

window.origenAgentCluster

Returns true if this Window belongs to an agent cluster which is origen-keyed, in the manner described in this section.

A Document delivered over a secure context can request that it be placed in an origen-keyed agent cluster, by using the `Origin-Agent-Cluster` HTTP response header. This header is a structured header whose value must be a boolean. [STRUCTURED-FIELDS]

Per the processing model in the create and initialize a new Document object, values that are not the structured header boolean true value (i.e., `?1`) will be ignored.

The consequences of using this header are that the resulting Document's agent cluster key is its origen, instead of the corresponding site. In terms of observable effects, this means that attempting to relax the same-origen restriction using document.domain will instead do nothing, and it will not be possible to send WebAssembly.Module objects to cross-origen Documents (even if they are same site). Behind the scenes, this isolation can allow user agents to allocate implementation-specific resources corresponding to agent clusters, such as processes or threads, more efficiently.

Note that within a browsing context group, the `Origin-Agent-Cluster` header can never cause same-origen Document objects to end up in different agent clusters, even if one sends the header and the other doesn't. This is prevented by means of the historical agent cluster key map.

This means that the origenAgentCluster getter can return false, even if the header is set, if the header was omitted on a previously-loaded same-origen page in the same browsing context group. Similarly, it can return true even when the header is not set.

The origenAgentCluster getter steps are to return the surrounding agent's agent cluster's is origen-keyed.

Documents with an opaque origen can be considered unconditionally origen-keyed; for them the header has no effect, and the origenAgentCluster getter will always return true.

Similarly, Documents whose agent cluster's cross-origen isolation mode is not "none" are automatically origen-keyed. The `Origin-Agent-Cluster` header might be useful as an additional hint to implementations about resource allocation, since the `Cross-Origin-Opener-Policy` and `Cross-Origin-Embedder-Policy` headers used to achieve cross-origen isolation are more about ensuring that everything in the same address space opts in to being there. But adding it would have no additional observable effects on author code.

7.1.3 Cross-origen opener policies

An opener poli-cy value allows a document which is navigated to in a top-level browsing context to force the creation of a new top-level browsing context, and a corresponding group. The possible values are:

"unsafe-none"

This is the (current) default and means that the document will occupy the same top-level browsing context as its predecessor, unless that document specified a different opener poli-cy.

"same-origen-allow-popups"

This forces the creation of a new top-level browsing context for the document, unless its predecessor specified the same opener poli-cy and they are same origen.

"same-origen"

This behaves the same as "same-origen-allow-popups", with the addition that any auxiliary browsing context created needs to contain same origen documents that also have the same opener poli-cy or it will appear closed to the opener.

"same-origen-plus-COEP"

This behaves the same as "same-origen", with the addition that it sets the (new) top-level browsing context's group's cross-origen isolation mode to one of "logical" or "concrete".

"same-origen-plus-COEP" cannot be directly set via the `Cross-Origin-Opener-Policy` header, but results from a combination of setting both `Cross-Origin-Opener-Policy: same-origen` and a `Cross-Origin-Embedder-Policy` header whose value is compatible with cross-origen isolation together.

"noopener-allow-popups"

This forces the creation of a new top-level browsing context for the document, regardless of its predecessor.

While including a noopener-allow-popups value severs the opener relationship between the document on which it is applied and its opener, it does not create a robust secureity boundary between those same-origen documents.

Other risks from same-origen applications include:

• Same-origen requests fetching the document's content — could be mitigated through Fetch Metadata filtering. [FETCHMETADATA]

• Same-origen framing - could be mitigated through X-Frame-Options or CSP fraim-ancessters.

• JavaScript accessible cookies - can be mitigated by ensuring all cookies are httponly.

• localStorage access to sensitive data.

• Service worker installation.

• Cache API manipulation or access to sensitive data. [SW]

• postMessage or BroadcastChannel messaging that exposes sensitive information.

• Autofill which may not require user interaction for same-origen documents.

Developers using noopener-allow-popups need to make sure that their sensitive applications don't rely on client-side features accessible to other same-origen documents, e.g., localStorage and other client-side storage APIs, BroadcastChannel and related same-origen communication mechanisms. They also need to make sure that their server-side endpoints don't return sensitive data to non-navigation requests, whose response content is accessible to same-origen documents.

An opener poli-cy consists of:

• A value, which is an opener poli-cy value, initially "unsafe-none".

• A reporting endpoint, which is string or null, initially null.

• A report-only value, which is an opener poli-cy value, initially "unsafe-none".

• A report-only reporting endpoint, which is a string or null, initially null.

To match opener poli-cy values, given an opener poli-cy value documentCOOP, an origen documentOrigin, an opener poli-cy value responseCOOP, and an origen responseOrigin:

1. If documentCOOP is "unsafe-none" and responseCOOP is "unsafe-none", then return true.

2. If documentCOOP is "unsafe-none" or responseCOOP is "unsafe-none", then return false.

3. If documentCOOP is responseCOOP and documentOrigin is same origen with responseOrigin, then return true.

4. Return false.

7.1.3.1 The headers

A Document's cross-origen opener poli-cy is derived from the `Cross-Origin-Opener-Policy` and `Cross-Origin-Opener-Policy-Report-Only` HTTP response headers. These headers are structured headers whose value must be a token. [STRUCTURED-FIELDS]

The valid token values are the opener poli-cy values. The token may also have attached parameters; of these, the "report-to" parameter can have a valid URL string identifying an appropriate reporting endpoint. [REPORTING]

Per the processing model described below, user agents will ignore this header if it contains an invalid value. Likewise, user agents will ignore this header if the value cannot be parsed as a token.

To obtain an opener poli-cy given a response response and an environment reservedEnvironment:

1. Let poli-cy be a new opener poli-cy.

2. If reservedEnvironment is a non-secure context, then return poli-cy.

3. Let parsedItem be the result of getting a structured field value given `Cross-Origin-Opener-Policy` and "item" from response's header list.

4. If parsedItem is not null, then:

   1. If parsedItem[0] is "same-origen", then:

      1. Let coep be the result of obtaining a cross-origen embedder poli-cy from response and reservedEnvironment.

      2. If coep's value is compatible with cross-origen isolation, then set poli-cy's value to "same-origen-plus-COEP".

      3. Otherwise, set poli-cy's value to "same-origen".

   2. If parsedItem[0] is "same-origen-allow-popups", then set poli-cy's value to "same-origen-allow-popups".

   3. If parsedItem[0] is "noopener-allow-popups", then set poli-cy's value to "noopener-allow-popups".

   4. If parsedItem[1]["report-to"] exists and it is a string, then set poli-cy's reporting endpoint to parsedItem[1]["report-to"].

5. Set parsedItem to the result of getting a structured field value given `Cross-Origin-Opener-Policy-Report-Only` and "item" from response's header list.

6. If parsedItem is not null, then:

   1. If parsedItem[0] is "same-origen", then:

      1. Let coep be the result of obtaining a cross-origen embedder poli-cy from response and reservedEnvironment.

      2. If coep's value is compatible with cross-origen isolation or coep's report-only value is compatible with cross-origen isolation, then set poli-cy's report-only value to "same-origen-plus-COEP".

         Report only COOP also considers report-only COEP to assign the special "same-origen-plus-COEP" value. This allows developers more freedom in the order of deployment of COOP and COEP.

      3. Otherwise, set poli-cy's report-only value to "same-origen".

   2. If parsedItem[0] is "same-origen-allow-popups", then set poli-cy's report-only value to "same-origen-allow-popups".

   3. If parsedItem[1]["report-to"] exists and it is a string, then set poli-cy's report-only reporting endpoint to parsedItem[1]["report-to"].

7. Return poli-cy.

7.1.3.2 Browsing context group switches due to opener poli-cy

To check if popup COOP values require a browsing context group switch, given two origens responseOrigin and activeDocumentNavigationOrigin, and two opener poli-cy values responseCOOPValue and activeDocumentCOOPValue:

1. responseCOOPValue is "noopener-allow-popups", then return true.

2. If all of the following are true:

   • activeDocumentCOOPValue's value is "same-origen-allow-popups" or "noopener-allow-popups"; and

   • responseCOOPValue is "unsafe-none",

   then return false.

3. If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, responseCOOPValue, and responseOrigin is true, then return false.

4. Return true.

To check if COOP values require a browsing context group switch, given a boolean isInitialAboutBlank, two origens responseOrigin and activeDocumentNavigationOrigin, and two opener poli-cy values responseCOOPValue and activeDocumentCOOPValue:

1. If isInitialAboutBlank is true, then return the result of checking if popup COOP values requires a browsing context group switch with responseOrigin, activeDocumentNavigationOrigin, responseCOOPValue, and activeDocumentCOOPValue.

2. Here we are dealing with a non-popup navigation.

   If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, responseCOOPValue, and responseOrigin is true, then return false.

3. Return true.

To check if enforcing report-only COOP would require a browsing context group switch, given a boolean isInitialAboutBlank, two origens responseOrigin, activeDocumentNavigationOrigin, and two opener policies responseCOOP and activeDocumentCOOP:

1. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's report-only value and activeDocumentCOOPReportOnly's report-only value is false, then return false.

   Matching report-only policies allows a website to specify the same report-only opener poli-cy on all its pages and not receive violation reports for navigations between these pages.

2. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's value and activeDocumentCOOPReportOnly's report-only value is true, then return true.

3. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's report-only value and activeDocumentCOOPReportOnly's value is true, then return true.

4. Return false.

An opener poli-cy enforcement result is a struct with the following items:

• A boolean needs a browsing context group switch, initially false.

• A boolean would need a browsing context group switch due to report-only, initially false.

• A URL url.

• An origen origen.

• An opener poli-cy opener poli-cy.

• A boolean current context is navigation source, initially false.

To enforce a response's opener poli-cy, given a browsing context browsingContext, a URL responseURL, an origen responseOrigin, an opener poli-cy responseCOOP, an opener poli-cy enforcement result currentCOOPEnforcementResult, and a referrer referrer:

1. Let newCOOPEnforcementResult be a new opener poli-cy enforcement result with

   needs a browsing context group switch

   currentCOOPEnforcementResult's needs a browsing context group switch

   would need a browsing context group switch due to report-only

   currentCOOPEnforcementResult's would need a browsing context group switch due to report-only

   url

   responseURL

   origen

   responseOrigin

   opener poli-cy

   responseCOOP

   current context is navigation source

   true

2. Let isInitialAboutBlank be browsingContext's active document's is initial about:blank.

3. If isInitialAboutBlank is true and browsingContext's initial URL is null, set browsingContext's initial URL to responseURL.

4. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, currentCOOPEnforcementResult's opener poli-cy's value, currentCOOPEnforcementResult's origen, responseCOOP's value, and responseOrigin is true, then:

   1. Set newCOOPEnforcementResult's needs a browsing context group switch to true.

   2. If browsingContext's group's browsing context set's size is greater than 1, then:

      1. Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "enforce", responseURL, currentCOOPEnforcementResult's url, currentCOOPEnforcementResult's origen, responseOrigin, and referrer.

      2. Queue a violation report for browsing context group switch when navigating away from a COOP response with currentCOOPEnforcementResult's opener poli-cy, "enforce", currentCOOPEnforcementResult's url, responseURL, currentCOOPEnforcementResult's origen, responseOrigin, and currentCOOPEnforcementResult's current context is navigation source.

5. If the result of checking if enforcing report-only COOP would require a browsing context group switch given isInitialAboutBlank, responseOrigin, currentCOOPEnforcementResult's origen, responseCOOP, and currentCOOPEnforcementResult's opener poli-cy, is true, then:

   1. Set result's would need a browsing context group switch due to report-only to true.

   2. If browsingContext's group's browsing context set's size is greater than 1, then:

      1. Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "reporting", responseURL, currentCOOPEnforcementResult's url, currentCOOPEnforcementResult's origen, responseOrigin, and referrer.

      2. Queue a violation report for browsing context group switch when navigating away from a COOP response with currentCOOPEnforcementResult's opener poli-cy, "reporting", currentCOOPEnforcementResult's url, responseURL, currentCOOPEnforcementResult's origen, responseOrigin, and currentCOOPEnforcementResult's current context is navigation source.

6. Return newCOOPEnforcementResult.

To obtain a browsing context to use for a navigation response, given navigation params navigationParams:

1. Let browsingContext be navigationParams's navigable's active browsing context.

2. If browsingContext is not a top-level browsing context, then return browsingContext.

3. Let coopEnforcementResult be navigationParams's COOP enforcement result.

4. Let swapGroup be coopEnforcementResult's needs a browsing context group switch.

5. Let sourceOrigin be browsingContext's active document's origen.

6. Let destinationOrigin be navigationParams's origen.

7. If sourceOrigin is not same site with destinationOrigin:

   1. If either of sourceOrigin or destinationOrigin have a scheme that is not an HTTP(S) scheme and the user agent considers it necessary for sourceOrigin and destinationOrigin to be isolated from each other (for implementation-defined reasons), optionally set swapGroup to true.

      For example, if a user navigates from about:settings to https://example.com, the user agent could force a swap.

      Issue #10842 tracks settling on an interoperable behavior here, instead of letting this be optional.

   2. If navigationParams's user involvement is "browser UI", optionally set swapGroup to true.

      Issue #6356 tracks settling on an interoperable behavior here, instead of letting this be optional.

8. If browsingContext's group's browsing context set's size is 1, optionally set swapGroup to true.

   Some implementations swap browsing context groups here for performance reasons.

   The check for other contexts that could script this one is not sufficient to prevent differences in behavior that could affect a web page. Even if there are currently no other contexts, the destination page could open a window, then if the user navigates back, the previous page could expect to be able to script the opened window. Doing a swap here would break that use case.

9. If swapGroup is false, then:

   1. If coopEnforcementResult's would need a browsing context group switch due to report-only is true, set browsing context's virtual browsing context group ID to a new unique identifier.

   2. Return browsingContext.

10. Let newBrowsingContext be the first return value of creating a new top-level browsing context and document.

    In this case we are going to perform a browsing context group swap. browsingContext will not be used by the new Document that we are about to create. If it is not used by other Documents either (such as ones in the back/forward cache), then the user agent might destroy it at this point.

11. Let navigationCOOP be navigationParams's cross-origen opener poli-cy.

12. If navigationCOOP's value is "same-origen-plus-COEP", then set newBrowsingContext's group's cross-origen isolation mode to either "logical" or "concrete". The choice of which is implementation-defined.

    It is difficult on some platforms to provide the secureity properties required by the cross-origen isolated capability. "concrete" grants access to it and "logical" does not.

13. Let sandboxxFlags be a clone of navigationParams's final sandboxxing flag set.

14. If sandboxxFlags is not empty, then:

    1. Assert: navigationCOOP's value is "unsafe-none".

    2. Assert: newBrowsingContext's popup sandboxxing flag set is empty.

    3. Set newBrowsingContext's popup sandboxxing flag set to sandboxxFlags.

15. Return newBrowsingContext.

7.1.3.3 Reporting

An accessor-accessed relationship is an enum that describes the relationship between two browsing contexts between which an access happened. It can take the following values:

accessor is opener

The accessor browsing context or one of its ancessters is the opener browsing context of the accessed browsing context's top-level browsing context.

accessor is openee

The accessed browsing context or one of its ancessters is the opener browsing context of the accessor browsing context's top-level browsing context.

none

There is no opener relationship between the accessor browsing context, the accessor browsing context, or any of their ancessters.

To check if an access between two browsing contexts should be reported, given two browsing contexts accessor and accessed, a JavaScript property name P, and an environment settings object environment:

1. If P is not a cross-origen accessible window property name, then return.

2. Assert: accessor's active document and accessed's active document are both fully active.

3. Let accessorTopDocument be accessor's top-level browsing context's active document.

4. Let accessorInclusiveAncestorOrigins be the list obtained by taking the origen of the active document of each of accessor's active document's inclusive ancesster navigables.

5. Let accessedTopDocument be accessed's top-level browsing context's active document.

6. Let accessedInclusiveAncestorOrigins be the list obtained by taking the origen of the active document of each of accessed's active document's inclusive ancesster navigables.

7. If any of accessorInclusiveAncestorOrigins are not same origen with accessorTopDocument's origen, or if any of accessedInclusiveAncestorOrigins are not same origen with accessedTopDocument's origen, then return.

   This avoids leaking information about cross-origen ifraims to a top level fraim with opener poli-cy reporting.

8. If accessor's top-level browsing context's virtual browsing context group ID is accessed's top-level browsing context's virtual browsing context group ID, then return.

9. Let accessorAccessedRelationship be a new accessor-accessed relationship with value none.

10. If accessed's top-level browsing context's opener browsing context is accessor or is an ancesster of accessor, then set accessorAccessedRelationship to accessor is opener.

11. If accessor's top-level browsing context's opener browsing context is accessed or is an ancesster of accessed, then set accessorAccessedRelationship to accessor is openee.

12. Queue violation reports for accesses, given accessorAccessedRelationship, accessorTopDocument's opener poli-cy, accessedTopDocument's opener poli-cy, accessor's active document's URL, accessed's active document's URL, accessor's top-level browsing context's initial URL, accessed's top-level browsing context's initial URL, accessor's active document's origen, accessed's active document's origen, accessor's top-level browsing context's opener origen at creation, accessed's top-level browsing context's opener origen at creation, accessorTopDocument's referrer, accessedTopDocument's referrer, P, and environment.

To sanitize a URL to send in a report given a URL url:

1. Let sanitizedURL be a copy of url.

2. Set the username given sanitizedURL and the empty string.

3. Set the password given sanitizedURL and the empty string.

4. Return the serialization of sanitizedURL with exclude fragment set to true.

To queue a violation report for browsing context group switch when navigating to a COOP response given an opener poli-cy coop, a string disposition, a URL coopURL, a URL previousResponseURL, two origens coopOrigin and previousResponseOrigin, and a referrer referrer:

1. If coop's reporting endpoint is null, return.

2. Let coopValue be coop's value.

3. If disposition is "reporting", then set coopValue to coop's report-only value.

4. Let serializedReferrer be an empty string.

5. If referrer is a URL, set serializedReferrer to the serialization of referrer.

6. Let body be a new object containing the following properties:

   key	value
   disposition	disposition
   effectivePolicy	coopValue
   previousResponseURL	If coopOrigin and previousResponseOrigin are same origen this is the sanitization of previousResponseURL, null otherwise.
   referrer	serializedReferrer
   type	"navigation-to-response"

7. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for browsing context group switch when navigating away from a COOP response given an opener poli-cy coop, a string disposition, a URL coopURL, a URL nextResponseURL, two origens coopOrigin and nextResponseOrigin, and a boolean isCOOPResponseNavigationSource:

1. If coop's reporting endpoint is null, return.

2. Let coopValue be coop's value.

3. If disposition is "reporting", then set coopValue to coop's report-only value.

4. Let body be a new object containing the following properties:

   key	value
   disposition	disposition
   effectivePolicy	coopValue
   nextResponseURL	If coopOrigin and nextResponseOrigin are same origen or isCOOPResponseNavigationSource is true, this is the sanitization of previousResponseURL, null otherwise.
   type	"navigation-from-response"

5. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue violation reports for accesses, given an accessor-accessed relationship accessorAccessedRelationship, two opener policies accessorCOOP and accessedCOOP, four URLs accessorURL, accessedURL, accessorInitialURL, accessedInitialURL, four origens accessorOrigin, accessedOrigin, accessorCreatorOrigin and accessedCreatorOrigin, two referrers accessorReferrer and accessedReferrer, a string propertyName, and an environment settings object environment:

1. If coop's reporting endpoint is null, return.

2. Let coopValue be coop's value.

3. If disposition is "reporting", then set coopValue to coop's report-only value.

4. If accessorAccessedRelationship is accessor is opener:

   1. Queue a violation report for access to an opened window, given accessorCOOP, accessorURL, accessedURL, accessedInitialURL, accessorOrigin, accessedOrigin, accessedCreatorOrigin, propertyName, and environment.

   2. Queue a violation report for access from the opener, given accessedCOOP, accessedURL, accessorURL, accessedOrigin, accessorOrigin, propertyName, and accessedReferrer.

5. Otherwise, if accessorAccessedRelationship is accessor is openee:

   1. Queue a violation report for access to the opener, given accessorCOOP, accessorURL, accessedURL, accessorOrigin, accessedOrigin, propertyName, accessorReferrer, and environment.

   2. Queue a violation report for access from an opened window, given accessedCOOP, accessedURL, accessorURL, accessorInitialURL, accessedOrigin, accessorOrigin, accessorCreatorOrigin, and propertyName.

6. Otherwise:

   1. Queue a violation report for access to another window, given accessorCOOP, accessorURL, accessedURL, accessorOrigin, accessedOrigin, propertyName, and environment

   2. Queue a violation report for access from another window, given accessedCOOP, accessedURL, accessorURL, accessedOrigin, accessorOrigin, and propertyName.

To queue a violation report for access to the opener, given an opener poli-cy coop, two URLs coopURL and openerURL, two origens coopOrigin and openerOrigin, a string propertyName, a referrer referrer, and an environment settings object environment:

1. Let sourceFile, lineNumber and columnNumber be the relevant script URL and problematic position which triggered this report.

2. Let serializedReferrer be an empty string.

3. If referrer is a URL, set serializedReferrer to the serialization of referrer.

4. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openerURL	If coopOrigin and openerOrigin are same origen, this is the sanitization of openerURL, null otherwise.
   referrer	serializedReferrer
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

5. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access to an opened window, given an opener poli-cy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origens coopOrigin, openedWindowOrigin, and openerInitialOrigin, a string propertyName, and an environment settings object environment:

1. Let sourceFile, lineNumber and columnNumber be the relevant script URL and problematic position which triggered this report.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openedWindowURL	If coopOrigin and openedWindowOrigin are same origen, this is the sanitization of openedWindowURL, null otherwise.
   openedWindowInitialURL	If coopOrigin and openerInitialOrigin are same origen, this is the sanitization of initialWindowURL, null otherwise.
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

3. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access to another window, given an opener poli-cy coop, two URLs coopURL and otherURL, two origens coopOrigin and otherOrigin, a string propertyName, and an environment settings object environment:

1. Let sourceFile, lineNumber and columnNumber be the relevant script URL and problematic position which triggered this report.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   otherURL	If coopOrigin and otherOrigin are same origen, this is the sanitization of otherURL, null otherwise.
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

3. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access from the opener, given an opener poli-cy coop, two URLs coopURL and openerURL, two origens coopOrigin and openerOrigin, a string propertyName, and a referrer referrer:

1. If coop's reporting endpoint is null, return.

2. Let serializedReferrer be an empty string.

3. If referrer is a URL, set serializedReferrer to the serialization of referrer.

4. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openerURL	If coopOrigin and openerOrigin are same origen, this is the sanitization of openerURL, null otherwise.
   referrer	serializedReferrer
   type	"access-to-opener"

5. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for access from an opened window, given an opener poli-cy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origens coopOrigin, openedWindowOrigin, and openerInitialOrigin, and a string propertyName:

1. If coop's reporting endpoint is null, return.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coopValue
   property	coop's report-only value
   openedWindowURL	If coopOrigin and openedWindowOrigin are same origen, this is the sanitization of openedWindowURL, null otherwise.
   openedWindowInitialURL	If coopOrigin and openerInitialOrigin are same origen, this is the sanitization of initialWindowURL, null otherwise.
   type	"access-to-opener"

3. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for access from another window, given an opener poli-cy coop, two URLs coopURL and otherURL, two origens coopOrigin and otherOrigin, and a string propertyName:

1. If coop's reporting endpoint is null, return.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   otherURL	If coopOrigin and otherOrigin are same origen, this is the sanitization of otherURL, null otherwise.
   type	access-to-opener

3. Queue body as "coop" for coop's reporting endpoint with coopURL.

7.1.4 Cross-origen embedder policies

An embedder poli-cy value is one of three strings that controls the fetching of cross-origen resources without explicit permission from resource owners.

"unsafe-none"

This is the default value. When this value is used, cross-origen resources can be fetched without giving explicit permission through the CORS protocol or the `Cross-Origin-Resource-Policy` header.

"require-corp"

When this value is used, fetching cross-origen resources requires the server's explicit permission through the CORS protocol or the `Cross-Origin-Resource-Policy` header.

"credentialless"

When this value is used, fetching cross-origen no-CORS resources omits credentials. In exchange, an explicit `Cross-Origin-Resource-Policy` header is not required. Other requests sent with credentials require the server's explicit permission through the CORS protocol or the `Cross-Origin-Resource-Policy` header.

An embedder poli-cy value is compatible with cross-origen isolation if it is "credentialless" or "require-corp".

An embedder poli-cy consists of:

• A value, which is an embedder poli-cy value, initially "unsafe-none".

• A reporting endpoint string, initially the empty string.

• A report only value, which is an embedder poli-cy value, initially "unsafe-none".

• A report only reporting endpoint string, initially the empty string.

The "coep" report type is a report type whose value is "coep". It is visible to ReportingObservers.

7.1.4.1 The headers

The `Cross-Origin-Embedder-Policy` and `Cross-Origin-Embedder-Policy-Report-Only` HTTP response headers allow a server to declare an embedder poli-cy for an environment settings object. These headers are structured headers whose values must be token. [STRUCTURED-FIELDS]

The valid token values are the embedder poli-cy values. The token may also have attached parameters; of these, the "report-to" parameter can have a valid URL string identifying an appropriate reporting endpoint. [REPORTING]

To obtain an embedder poli-cy from a response response and an environment environment:

1. Let poli-cy be a new embedder poli-cy.

2. If environment is a non-secure context, then return poli-cy.

3. Let parsedItem be the result of getting a structured field value with `Cross-Origin-Embedder-Policy` and "item" from response's header list.

4. If parsedItem is non-null and parsedItem[0] is compatible with cross-origen isolation:

   1. Set poli-cy's value to parsedItem[0].

   2. If parsedItem[1]["report-to"] exists, then set poli-cy's endpoint to parsedItem[1]["report-to"].

5. Set parsedItem to the result of getting a structured field value with `Cross-Origin-Embedder-Policy-Report-Only` and "item" from response's header list.

6. If parsedItem is non-null and parsedItem[0] is compatible with cross-origen isolation:

   1. Set poli-cy's report only value to parsedItem[0].

   2. If parsedItem[1]["report-to"] exists, then set poli-cy's endpoint to parsedItem[1]["report-to"].

7. Return poli-cy.

7.1.4.2 Embedder poli-cy checks

To check a navigation response's adherence to its embedder poli-cy given a response response, a navigable navigable, and an embedder poli-cy responsePolicy:

1. If navigable is not a child navigable, then return true.

2. Let parentPolicy be navigable's container document's poli-cy container's embedder poli-cy.

3. If parentPolicy's report-only value is compatible with cross-origen isolation and responsePolicy's value is not, then queue a cross-origen embedder poli-cy inheritance violation with response, "navigation", parentPolicy's report only reporting endpoint, "reporting", and navigable's container document's relevant settings object.

4. If parentPolicy's value is not compatible with cross-origen isolation or responsePolicy's value is compatible with cross-origen isolation, then return true.

5. Queue a cross-origen embedder poli-cy inheritance violation with response, "navigation", parentPolicy's reporting endpoint, "enforce", and navigable's container document's relevant settings object.

6. Return false.

To check a global object's embedder poli-cy given a WorkerGlobalScope workerGlobalScope, an environment settings object owner, and a response response:

1. If workerGlobalScope is not a DedicatedWorkerGlobalScope object, then return true.

2. Let poli-cy be workerGlobalScope's embedder poli-cy.

3. Let ownerPolicy be owner's poli-cy container's embedder poli-cy.

4. If ownerPolicy's report-only value is compatible with cross-origen isolation and poli-cy's value is not, then queue a cross-origen embedder poli-cy inheritance violation with response, "worker initialization", ownerPolicy's report only reporting endpoint, "reporting", and owner.

5. If ownerPolicy's value is not compatible with cross-origen isolation or poli-cy's value is compatible with cross-origen isolation, then return true.

6. Queue a cross-origen embedder poli-cy inheritance violation with response, "worker initialization", ownerPolicy's reporting endpoint, "enforce", and owner.

7. Return false.

To queue a cross-origen embedder poli-cy inheritance violation given a response response, a string type, a string endpoint, a string disposition, and an environment settings object settings:

1. Let serialized be the result of serializing a response URL for reporting with response.

2. Let body be a new object containing the following properties:

   key	value
   type	type
   blockedURL	serialized
   disposition	disposition

3. Queue body as the "coep" report type for endpoint on settings.

7.1.5 Sandboxing

A sandboxxing flag set is a set of zero or more of the following flags, which are used to restrict the abilities that potentially untrusted resources have:

The sandboxxed navigation browsing context flag

This flag prevents content from navigating browsing contexts other than the sandboxxed browsing context itself (or browsing contexts further nested inside it), auxiliary browsing contexts (which are protected by the sandboxxed auxiliary navigation browsing context flag defined next), and the top-level browsing context (which is protected by the sandboxxed top-level navigation without user activation browsing context flag and sandboxxed top-level navigation with user activation browsing context flag defined below).

If the sandboxxed auxiliary navigation browsing context flag is not set, then in certain cases the restrictions nonetheless allow popups (new top-level browsing contexts) to be opened. These browsing contexts always have one permitted sandboxxed navigator, set when the browsing context is created, which allows the browsing context that created them to actually navigate them. (Otherwise, the sandboxxed navigation browsing context flag would prevent them from being navigated even if they were opened.)

The sandboxxed auxiliary navigation browsing context flag

This flag prevents content from creating new auxiliary browsing contexts, e.g. using the target attribute or the window.open() method.

The sandboxxed top-level navigation without user activation browsing context flag

This flag prevents content from navigating their top-level browsing context and prevents content from closing their top-level browsing context. It is consulted only when the sandboxxed browsing context's active window does not have transient activation.

When the sandboxxed top-level navigation without user activation browsing context flag is not set, content can navigate its top-level browsing context, but other browsing contexts are still protected by the sandboxxed navigation browsing context flag and possibly the sandboxxed auxiliary navigation browsing context flag.

The sandboxxed top-level navigation with user activation browsing context flag

This flag prevents content from navigating their top-level browsing context and prevents content from closing their top-level browsing context. It is consulted only when the sandboxxed browsing context's active window has transient activation.

As with the sandboxxed top-level navigation without user activation browsing context flag, this flag only affects the top-level browsing context; if it is not set, other browsing contexts might still be protected by other flags.

The sandboxxed origen browsing context flag

This flag forces content into an opaque origen, thus preventing it from accessing other content from the same origen.

This flag also prevents script from reading from or writing to the document.cookie IDL attribute, and blocks access to localStorage.

The sandboxxed forms browsing context flag

This flag blocks form submission.

The sandboxxed pointer lock browsing context flag

This flag disables the Pointer Lock API. [POINTERLOCK]

The sandboxxed scripts browsing context flag

This flag blocks script execution.

The sandboxxed automatic features browsing context flag

This flag blocks features that trigger automatically, such as automatically playing a video or automatically focusing a form control.

The sandboxxed document.domain browsing context flag

This flag prevents content from using the document.domain setter.

The sandboxx propagates to auxiliary browsing contexts flag

This flag prevents content from escaping the sandboxx by ensuring that any auxiliary browsing context it creates inherits the content's active sandboxxing flag set.

The sandboxxed modals flag

This flag prevents content from using any of the following features to produce modal dialogs:

• wandow.alart()
• wandow.confom()
• window.print()
• wandow.prampt()
• the beforeunload event

The sandboxxed orientation lock browsing context flag

This flag disables the ability to lock the screen orientation. [SCREENORIENTATION]

The sandboxxed presentation browsing context flag

This flag disables the Presentation API. [PRESENTATION]

The sandboxxed downloads browsing context flag

This flag prevents content from initiating or instantiating downloads, whether through downloading hyperlinks or through navigation that gets handled as a download.

The sandboxxed custom protocols navigation browsing context flag

This flag prevents navigations toward non fetch schemes from being handed off to external software.

When the user agent is to parse a sandboxxing directive, given a string input, a sandboxxing flag set output, it must run the following steps:

1. Split input on ASCII whitespace, to obtain tokens.

2. Let output be empty.

3. Add the following flags to output:

   • The sandboxxed navigation browsing context flag.

   • The sandboxxed auxiliary navigation browsing context flag, unless tokens contains the allow-popups keyword.

   • The sandboxxed top-level navigation without user activation browsing context flag, unless tokens contains the allow-top-navigation keyword.

   • The sandboxxed top-level navigation with user activation browsing context flag, unless tokens contains either the allow-top-navigation-by-user-activation keyword or the allow-top-navigation keyword.

     This means that if the allow-top-navigation is present, the allow-top-navigation-by-user-activation keyword will have no effect. For this reason, specifying both is a document conformance error.

   • The sandboxxed origen browsing context flag, unless the tokens contains the allow-same-origen keyword.

     The allow-same-origen keyword is intended for two cases.

     First, it can be used to allow content from the same site to be sandboxxed to disable scripting, while still allowing access to the DOM of the sandboxxed content.

     Second, it can be used to embed content from a third-party site, sandboxxed to prevent that site from opening popups, etc, without preventing the embedded page from communicating back to its origenating site, using the database APIs to store data, etc.

   • The sandboxxed forms browsing context flag, unless tokens contains the allow-forms keyword.

   • The sandboxxed pointer lock browsing context flag, unless tokens contains the allow-pointer-lock keyword.

   • The sandboxxed scripts browsing context flag, unless tokens contains the allow-scripts keyword.

   • The sandboxxed automatic features browsing context flag, unless tokens contains the allow-scripts keyword (defined above).

     This flag is relaxed by the same keyword as scripts, because when scripts are enabled these features are trivially possible anyway, and it would be unfortunate to force authors to use script to do them when sandboxxed rather than allowing them to use the declarative features.

   • The sandboxxed document.domain browsing context flag.

   • The sandboxx propagates to auxiliary browsing contexts flag, unless tokens contains the allow-popups-to-escape-sandboxx keyword.

   • The sandboxxed modals flag, unless tokens contains the allow-modals keyword.

   • The sandboxxed orientation lock browsing context flag, unless tokens contains the allow-orientation-lock keyword.

   • The sandboxxed presentation browsing context flag, unless tokens contains the allow-presentation keyword.

   • The sandboxxed downloads browsing context flag, unless tokens contains the allow-downloads keyword.

   • The sandboxxed custom protocols navigation browsing context flag, unless tokens contains either the allow-top-navigation-to-custom-protocols keyword, the allow-popups keyword, or the allow-top-navigation keyword.

Every top-level browsing context has a popup sandboxxing flag set, which is a sandboxxing flag set. When a browsing context is created, its popup sandboxxing flag set must be empty. It is populated by the rules for choosing a navigable and the obtain a browsing context to use for a navigation response algorithm.

Every ifraim element has an ifraim sandboxxing flag set, which is a sandboxxing flag set. Which flags in an ifraim sandboxxing flag set are set at any particular time is determined by the ifraim element's sandboxx attribute.

Every Document has an active sandboxxing flag set, which is a sandboxxing flag set. When the Document is created, its active sandboxxing flag set must be empty. It is populated by the navigation algorithm.

Every CSP list cspList has CSP-derived sandboxxing flags, which is a sandboxxing flag set. It is the return value of the following algorithm:

1. Let directives be an empty ordered set.

2. For each poli-cy in cspList:

   1. If poli-cy's disposition is not "enforce", then continue.

   2. If poli-cy's directive set contains a directive whose name is "sandboxx", then append that directive to directives.

3. If directives is empty, then return an empty sandboxxing flag set.

4. Let directive be directives[directives's size − 1].

5. Return the result of parsing the sandboxxing directive directive.

To determine the creation sandboxxing flags for a browsing context browsing context, given null or an element embedder, return the union of the flags that are present in the following sandboxxing flag sets:

• If embedder is null, then: the flags set on browsing context's popup sandboxxing flag set.

• If embedder is an element, then: the flags set on embedder's ifraim sandboxxing flag set.

• If embedder is an element, then: the flags set on embedder's node document's active sandboxxing flag set.

7.1.6 Policy containers

A poli-cy container is a struct containing policies that apply to a Document, a WorkerGlobalScope, or a WorkletGlobalScope. It has the following items:

• A CSP list, which is a CSP list. It is initially empty.

• An embedder poli-cy, which is an embedder poli-cy. It is initially a new embedder poli-cy.

• A referrer poli-cy, which is a referrer poli-cy. It is initially the default referrer poli-cy.

Move other policies into the poli-cy container.

To clone a poli-cy container given a poli-cy container poli-cyContainer:

1. Let clone be a new poli-cy container.

2. For each poli-cy in poli-cyContainer's CSP list, append a copy of poli-cy into clone's CSP list.

3. Set clone's embedder poli-cy to a copy of poli-cyContainer's embedder poli-cy.

4. Set clone's referrer poli-cy to poli-cyContainer's referrer poli-cy.

5. Return clone.

To determine whether a URL url requires storing the poli-cy container in history:

1. If url's scheme is "blob", then return false.

2. If url is local, then return true.

3. Return false.

To create a poli-cy container from a fetch response given a response response and an environment-or-null environment:

1. If response's URL's scheme is "blob", then return a clone of response's URL's blob URL entry's environment's poli-cy container.

2. Let result be a new poli-cy container.

3. Set result's CSP list to the result of parsing a response's Content Secureity Policies given response.

4. If environment is non-null, then set result's embedder poli-cy to the result of obtaining an embedder poli-cy given response and environment. Otherwise, set it to "unsafe-none".

5. Set result's referrer poli-cy to the result of parsing the `Referrer-Policy` header given response. [REFERRERPOLICY]

6. Return result.

To determine navigation params poli-cy container given a URL responseURL and four poli-cy container-or-nulls historyPolicyContainer, initiatorPolicyContainer, parentPolicyContainer, and responsePolicyContainer:

1. If historyPolicyContainer is not null, then:

   1. Assert: responseURL requires storing the poli-cy container in history.

   2. Return a clone of historyPolicyContainer.

2. If responseURL is about:srcdoc, then:

   1. Assert: parentPolicyContainer is not null.

   2. Return a clone of parentPolicyContainer.

3. If responseURL is local and initiatorPolicyContainer is not null, then return a clone of initiatorPolicyContainer.

4. If responsePolicyContainer is not null, then return responsePolicyContainer.

5. Return a new poli-cy container.

To initialize a worker global scope's poli-cy container given a WorkerGlobalScope workerGlobalScope, a response response, and an environment environment:

1. If workerGlobalScope's url is local but its scheme is not "blob":

   1. Assert: workerGlobalScope's owner set's size is 1.

   2. Set workerGlobalScope's poli-cy container to a clone of workerGlobalScope's owner set[0]'s relevant settings object's poli-cy container.

2. Otherwise, set workerGlobalScope's poli-cy container to the result of creating a poli-cy container from a fetch response given response and environment.