Skip to content

Commit 20ebb11

Browse files
mikewestmikewest
committed
Shifting the repo to W3C.
1 parent 12a4e91 commit 20ebb11

File tree

2 files changed

+74
-143
lines changed

2 files changed

+74
-143
lines changed

‎index.bs

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@
22
Title: Post-Spectre Web Development
33
Shortname: post-spectre-webdev
44
Level: 1
5-
Status: DREAM
6-
URL: https://mikewest.github.io/post-spectre-webdev/
5+
Status: ED
6+
Group: WebAppSec
7+
URL: https://w3c.github.io/webappsec-post-spectre-webdev/
78
Editor: Mike West, Google, [email protected]
89
Abstract:
910
Post-Spectre, we need to adopt some new strategies for safe and secure web developement. This

‎index.html

Lines changed: 71 additions & 141 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<!doctype html><html lang="en">
22
<head>
33
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
4-
<title>Post-Spectre Web Development</title>
54
<meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
5+
<title>Post-Spectre Web Development</title>
66
<style data-fill-with="stylesheet">/******************************************************************************
77
* Style sheet for the W3C specifications *
88
*
@@ -1485,8 +1485,8 @@
14851485
}
14861486
</style>
14871487
<meta content="Bikeshed version c5172e83, updated Fri Nov 20 15:35:20 2020 -0800" name="generator">
1488-
<link href="https://mikewest.github.io/post-spectre-webdev/" rel="canonical">
1489-
<meta content="8b9c16d0a71431268beff275662d84b2afe6fa50" name="document-revision">
1488+
<link href="https://w3c.github.io/webappsec-post-spectre-webdev/" rel="canonical">
1489+
<meta content="f3f5c03dfbc2a45ccb51db8d8924cae404e2c05a" name="document-revision">
14901490
<style>/* style-autolinks */
14911491

14921492
.css.css, .property.property, .descriptor.descriptor {
@@ -2041,13 +2041,15 @@
20412041
</style>
20422042
<body class="h-entry">
20432043
<div class="head">
2044-
<p data-fill-with="logo"></p>
2044+
<p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2016/logos/W3C" width="72"> </a> </p>
20452045
<h1 class="p-name no-ref" id="title">Post-Spectre Web Development</h1>
2046-
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">A Collection of Interesting Ideas, <time class="dt-updated" datetime="2021-03-04">4 March 2021</time></span></h2>
2046+
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2021-03-08">8 March 2021</time></span></h2>
20472047
<div data-fill-with="spec-metadata">
20482048
<dl>
20492049
<dt>This version:
2050-
<dd><a class="u-url" href="https://mikewest.github.io/post-spectre-webdev/">https://mikewest.github.io/post-spectre-webdev/</a>
2050+
<dd><a class="u-url" href="https://w3c.github.io/webappsec-post-spectre-webdev/">https://w3c.github.io/webappsec-post-spectre-webdev/</a>
2051+
<dt>Feedback:
2052+
<dd><span><a href="mailto:[email protected]?subject=%5Bpost-spectre-webdev%5D%20YOUR%20TOPIC%20HERE">[email protected]</a> with subject line “<kbd>[post-spectre-webdev] <i data-lt>… message topic …</i></kbd>” (<a href="https://lists.w3.org/Archives/Public/public-webappsec/" rel="discussion">archives</a>)</span>
20512053
<dt>Issue Tracking:
20522054
<dd><a href="https://github.com/mikewest/post-spectre-webdev/issues/">GitHub</a>
20532055
<dd><a href="#issues-index">Inline In Spec</a>
@@ -2056,12 +2058,7 @@ <h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="cont
20562058
</dl>
20572059
</div>
20582060
<div data-fill-with="warning"></div>
2059-
<p class="copyright" data-fill-with="copyright"><a href="http://creativecommons.org/publicdomain/zero/1.0/" rel="license"><img alt="CC0" src="https://licensebuttons.net/p/zero/1.0/80x15.png"></a> To the extent possible under law, the editors have waived all copyright
2060-
and related or neighboring rights to this work.
2061-
In addition, as of 4 March 2021,
2062-
the editors have made this specification available under the <a href="http://www.openwebfoundation.org/legal/the-owf-1-0-agreements/owfa-1-0" rel="license">Open Web Foundation Agreement Version 1.0</a>,
2063-
which is available at http://www.openwebfoundation.org/legal/the-owf-1-0-agreements/owfa-1-0.
2064-
Parts of this work may be from another specification document. If so, those parts are instead covered by the license of that specification document. </p>
2061+
<p class="copyright" data-fill-with="copyright"><a href="https://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a> © 2021 <a href="https://www.w3.org/"><abbr title="World Wide Web Consortium">W3C</abbr></a><sup>®</sup> (<a href="https://www.csail.mit.edu/"><abbr title="Massachusetts Institute of Technology">MIT</abbr></a>, <a href="https://www.ercim.eu/"><abbr title="European Research Consortium for Informatics and Mathematics">ERCIM</abbr></a>, <a href="https://www.keio.ac.jp/">Keio</a>, <a href="https://ev.buaa.edu.cn/">Beihang</a>). W3C <a href="https://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>, <a href="https://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a> and <a href="https://www.w3.org/Consortium/Legal/copyright-documents">document use</a> rules apply. </p>
20652062
<hr title="Separator for header">
20662063
</div>
20672064
<div class="p-summary" data-fill-with="abstract">
@@ -2071,6 +2068,28 @@ <h2 class="no-num no-toc no-ref heading settled" id="abstract"><span class="cont
20712068
document outlines a threat model we can share, and a set of mitigation recommendations.</p>
20722069
<p><strong>TL;DR</strong>: Your data must not unexpectedly enter an attacker’s process.</p>
20732070
</div>
2071+
<h2 class="no-num no-toc no-ref heading settled" id="status"><span class="content">Status of this document</span></h2>
2072+
<div data-fill-with="status">
2073+
<p> This is a public copy of the editors’ draft.
2074+
It is provided for discussion only and may change at any moment.
2075+
Its publication here does not imply endorsement of its contents by W3C.
2076+
Don’t cite this document other than as work in progress. </p>
2077+
<p> <strong>Changes to this document may be tracked at <a href="https://github.com/w3c/webappsec">https://github.com/w3c/webappsec</a>.</strong> </p>
2078+
<p> The (<a href="https://lists.w3.org/Archives/Public/public-webappsec/">archived</a>) public mailing list <a href="mailto:[email protected]?Subject=%5Bpost-spectre-webdev%5D%20PUT%20SUBJECT%20HERE">[email protected]</a> (see <a href="https://www.w3.org/Mail/Request">instructions</a>)
2079+
is preferred for discussion of this specification.
2080+
When sending e-mail,
2081+
please put the text “post-spectre-webdev” in the subject,
2082+
preferably like this:
2083+
“[post-spectre-webdev] <em>…summary of comment…</em>” </p>
2084+
<p> This document was produced by the <a href="https://www.w3.org/2011/webappsec/">Web Application Security Working Group</a>. </p>
2085+
<p> This document was produced by a group operating under
2086+
the <a href="https://www.w3.org/Consortium/Patent-Policy-20170801/">W3C Patent Policy</a>.
2087+
W3C maintains a <a href="https://www.w3.org/2004/01/pp-impl/49309/status" rel="disclosure">public list of any patent disclosures</a> made in connection with the deliverables of the group;
2088+
that page also includes instructions for disclosing a patent.
2089+
An individual who has actual knowledge of a patent which the individual believes contains <a href="https://www.w3.org/Consortium/Patent-Policy-20170801/#def-essential">Essential Claim(s)</a> must disclose the information in accordance with <a href="https://www.w3.org/Consortium/Patent-Policy-20170801/#sec-Disclosure">section 6 of the W3C Patent Policy</a>. </p>
2090+
<p> This document is governed by the <a href="https://www.w3.org/2020/Process-20200915/" id="w3c_process_revision">15 September 2020 W3C Process Document</a>. </p>
2091+
<p></p>
2092+
</div>
20742093
<div data-fill-with="at-risk"></div>
20752094
<nav data-fill-with="table-of-contents" id="toc">
20762095
<h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
@@ -2104,6 +2123,12 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
21042123
<li><a href="#explicit-defaults"><span class="secno">3.1</span> <span class="content">Explicitly Setting Headers with Default Values</span></a>
21052124
</ol>
21062125
<li><a href="#acks"><span class="secno">4</span> <span class="content">Acknowledgements</span></a>
2126+
<li>
2127+
<a href="#conformance"><span class="secno"></span> <span class="content">Conformance</span></a>
2128+
<ol class="toc">
2129+
<li><a href="#conventions"><span class="secno"></span> <span class="content">Document conventions</span></a>
2130+
<li><a href="#conformant-algorithms"><span class="secno"></span> <span class="content">Conformant Algorithms</span></a>
2131+
</ol>
21072132
<li>
21082133
<a href="#index"><span class="secno"></span> <span class="content">Index</span></a>
21092134
<ol class="toc">
@@ -2472,135 +2497,38 @@ <h2 class="heading settled" data-level="4" id="acks"><span class="secno">4. </sp
24722497
we currently espouse. The following is an incomplete list of those works:</p>
24732498
<p><a data-link-type="biblio" href="#biblio-application-principals">[APPLICATION-PRINCIPALS]</a>, <a data-link-type="biblio" href="#biblio-long-term-mitigations">[LONG-TERM-MITIGATIONS]</a>, <a data-link-type="biblio" href="#biblio-spectre-shaped-web">[SPECTRE-SHAPED-WEB]</a>, <a data-link-type="biblio" href="#biblio-post-spectre-rethink">[POST-SPECTRE-RETHINK]</a>, <a data-link-type="biblio" href="#biblio-spilling-the-beans">[SPILLING-THE-BEANS]</a>, <a data-link-type="biblio" href="#biblio-cross-origin-embedder-policy">[CROSS-ORIGIN-EMBEDDER-POLICY]</a>, <a data-link-type="biblio" href="#biblio-cross-origin-opener-policy-explainer">[CROSS-ORIGIN-OPENER-POLICY-EXPLAINER]</a>, <a data-link-type="biblio" href="#biblio-coop-coep-explained">[COOP-COEP-EXPLAINED]</a>, <a data-link-type="biblio" href="#biblio-safely-reviving-shared-memory">[SAFELY-REVIVING-SHARED-MEMORY]</a>, <a data-link-type="biblio" href="#biblio-coi-threat-model">[COI-THREAT-MODEL]</a></p>
24742499
</main>
2475-
<script>
2476-
(function() {
2477-
"use strict";
2478-
var collapseSidebarText = '<span aria-hidden="true">←</span> '
2479-
+ '<span>Collapse Sidebar</span>';
2480-
var expandSidebarText = '<span aria-hidden="true">→</span> '
2481-
+ '<span>Pop Out Sidebar</span>';
2482-
var tocJumpText = '<span aria-hidden="true">↑</span> '
2483-
+ '<span>Jump to Table of Contents</span>';
2484-
2485-
var sidebarMedia = window.matchMedia('screen and (min-width: 78em)');
2486-
var autoToggle = function(e){ toggleSidebar(e.matches) };
2487-
if(sidebarMedia.addListener) {
2488-
sidebarMedia.addListener(autoToggle);
2489-
}
2490-
2491-
function toggleSidebar(on) {
2492-
if (on == undefined) {
2493-
on = !document.body.classList.contains('toc-sidebar');
2494-
}
2495-
2496-
/* Don’t scroll to compensate for the ToC if we’re above it already. */
2497-
var headY = 0;
2498-
var head = document.querySelector('.head');
2499-
if (head) {
2500-
// terrible approx of "top of ToC"
2501-
headY += head.offsetTop + head.offsetHeight;
2502-
}
2503-
var skipScroll = window.scrollY < headY;
2504-
2505-
var toggle = document.getElementById('toc-toggle');
2506-
var tocNav = document.getElementById('toc');
2507-
if (on) {
2508-
var tocHeight = tocNav.offsetHeight;
2509-
document.body.classList.add('toc-sidebar');
2510-
document.body.classList.remove('toc-inline');
2511-
toggle.innerHTML = collapseSidebarText;
2512-
if (!skipScroll) {
2513-
window.scrollBy(0, 0 - tocHeight);
2514-
}
2515-
tocNav.focus();
2516-
sidebarMedia.addListener(autoToggle); // auto-collapse when out of room
2517-
}
2518-
else {
2519-
document.body.classList.add('toc-inline');
2520-
document.body.classList.remove('toc-sidebar');
2521-
toggle.innerHTML = expandSidebarText;
2522-
if (!skipScroll) {
2523-
window.scrollBy(0, tocNav.offsetHeight);
2524-
}
2525-
if (toggle.matches(':hover')) {
2526-
/* Unfocus button when not using keyboard navigation,
2527-
because I don’t know where else to send the focus. */
2528-
toggle.blur();
2529-
}
2530-
}
2531-
}
2532-
2533-
function createSidebarToggle() {
2534-
/* Create the sidebar toggle in JS; it shouldn’t exist when JS is off. */
2535-
var toggle = document.createElement('a');
2536-
/* This should probably be a button, but appearance isn’t standards-track.*/
2537-
toggle.id = 'toc-toggle';
2538-
toggle.class = 'toc-toggle';
2539-
toggle.href = '#toc';
2540-
toggle.innerHTML = collapseSidebarText;
2541-
2542-
sidebarMedia.addListener(autoToggle);
2543-
var toggler = function(e) {
2544-
e.preventDefault();
2545-
sidebarMedia.removeListener(autoToggle); // persist explicit off states
2546-
toggleSidebar();
2547-
return false;
2548-
}
2549-
toggle.addEventListener('click', toggler, false);
2550-
2551-
2552-
/* Get <nav id=toc-nav>, or make it if we don’t have one. */
2553-
var tocNav = document.getElementById('toc-nav');
2554-
if (!tocNav) {
2555-
tocNav = document.createElement('p');
2556-
tocNav.id = 'toc-nav';
2557-
/* Prepend for better keyboard navigation */
2558-
document.body.insertBefore(tocNav, document.body.firstChild);
2559-
}
2560-
/* While we’re at it, make sure we have a Jump to Toc link. */
2561-
var tocJump = document.getElementById('toc-jump');
2562-
if (!tocJump) {
2563-
tocJump = document.createElement('a');
2564-
tocJump.id = 'toc-jump';
2565-
tocJump.href = '#toc';
2566-
tocJump.innerHTML = tocJumpText;
2567-
tocNav.appendChild(tocJump);
2568-
}
2569-
2570-
tocNav.appendChild(toggle);
2571-
}
2572-
2573-
var toc = document.getElementById('toc');
2574-
if (toc) {
2575-
createSidebarToggle();
2576-
toggleSidebar(sidebarMedia.matches);
2577-
2578-
/* If the sidebar has been manually opened and is currently overlaying the text
2579-
(window too small for the MQ to add the margin to body),
2580-
then auto-close the sidebar once you click on something in there. */
2581-
toc.addEventListener('click', function(e) {
2582-
if(e.target.tagName.toLowerCase() == "a" && document.body.classList.contains('toc-sidebar') && !sidebarMedia.matches) {
2583-
toggleSidebar(false);
2584-
}
2585-
}, false);
2586-
}
2587-
else {
2588-
console.warn("Can’t find Table of Contents. Please use <nav id='toc'> around the ToC.");
2589-
}
2590-
2591-
/* Wrap tables in case they overflow */
2592-
var tables = document.querySelectorAll(':not(.overlarge) > table.data, :not(.overlarge) > table.index');
2593-
var numTables = tables.length;
2594-
for (var i = 0; i < numTables; i++) {
2595-
var table = tables[i];
2596-
var wrapper = document.createElement('div');
2597-
wrapper.className = 'overlarge';
2598-
table.parentNode.insertBefore(wrapper, table);
2599-
wrapper.appendChild(table);
2600-
}
2601-
2602-
})();
2603-
</script>
2500+
<h2 class="no-ref no-num heading settled" id="conformance"><span class="content">Conformance</span><a class="self-link" href="#conformance"></a></h2>
2501+
<h3 class="no-ref no-num heading settled" id="conventions"><span class="content">Document conventions</span><a class="self-link" href="#conventions"></a></h3>
2502+
<p>Conformance requirements are expressed with a combination of
2503+
descriptive assertions and RFC 2119 terminology. The key words “MUST”,
2504+
“MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”,
2505+
“RECOMMENDED”, “MAY”, and “OPTIONAL” in the normative parts of this
2506+
document are to be interpreted as described in RFC 2119.
2507+
However, for readability, these words do not appear in all uppercase
2508+
letters in this specification. </p>
2509+
<p>All of the text of this specification is normative except sections
2510+
explicitly marked as non-normative, examples, and notes. <a data-link-type="biblio" href="#biblio-rfc2119">[RFC2119]</a></p>
2511+
<p>Examples in this specification are introduced with the words “for example”
2512+
or are set apart from the normative text with <code>class="example"</code>,
2513+
like this: </p>
2514+
<div class="example" id="example-ae2b6bc0">
2515+
<a class="self-link" href="#example-ae2b6bc0"></a>
2516+
<p>This is an example of an informative example.</p>
2517+
</div>
2518+
<p>Informative notes begin with the word “Note” and are set apart from the
2519+
normative text with <code>class="note"</code>, like this: </p>
2520+
<p class="note" role="note">Note, this is an informative note.</p>
2521+
<h3 class="no-ref no-num heading settled" id="conformant-algorithms"><span class="content">Conformant Algorithms</span><a class="self-link" href="#conformant-algorithms"></a></h3>
2522+
<p>Requirements phrased in the imperative as part of algorithms (such as
2523+
"strip any leading space characters" or "return false and abort these
2524+
steps") are to be interpreted with the meaning of the key word ("must",
2525+
"should", "may", etc) used in introducing the algorithm.</p>
2526+
<p>Conformance requirements phrased as algorithms or specific steps can be
2527+
implemented in any manner, so long as the end result is equivalent. In
2528+
particular, the algorithms defined in this specification are intended to
2529+
be easy to understand and are not intended to be performant. Implementers
2530+
are encouraged to optimize.</p>
2531+
<script src="https://www.w3.org/scripts/TR/2016/fixup.js"></script>
26042532
<h2 class="no-num no-ref heading settled" id="index"><span class="content">Index</span><a class="self-link" href="#index"></a></h2>
26052533
<aside class="dfn-panel" data-for="term-for-header-content-security-policy">
26062534
<a href="https://w3c.github.io/webappsec-csp/#header-content-security-policy">https://w3c.github.io/webappsec-csp/#header-content-security-policy</a><b>Referenced in:</b>
@@ -2752,6 +2680,8 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
27522680
<dd>Anne van Kesteren. <a href="https://fetch.spec.whatwg.org/">Fetch Standard</a>. Living Standard. URL: <a href="https://fetch.spec.whatwg.org/">https://fetch.spec.whatwg.org/</a>
27532681
<dt id="biblio-html">[HTML]
27542682
<dd>Anne van Kesteren; et al. <a href="https://html.spec.whatwg.org/multipage/">HTML Standard</a>. Living Standard. URL: <a href="https://html.spec.whatwg.org/multipage/">https://html.spec.whatwg.org/multipage/</a>
2683+
<dt id="biblio-rfc2119">[RFC2119]
2684+
<dd>S. Bradner. <a href="https://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>. March 1997. Best Current Practice. URL: <a href="https://tools.ietf.org/html/rfc2119">https://tools.ietf.org/html/rfc2119</a>
27552685
<dt id="biblio-rfc7231">[RFC7231]
27562686
<dd>R. Fielding, Ed.; J. Reschke, Ed.. <a href="https://httpwg.org/specs/rfc7231.html">Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content</a>. June 2014. Proposed Standard. URL: <a href="https://httpwg.org/specs/rfc7231.html">https://httpwg.org/specs/rfc7231.html</a>
27572687
</dl>

0 commit comments

Comments
 (0)