Skip to content

Commit 776714a

Browse files
mikewestmikewest
committed
SECURE: Shared Workers === creation context status.
1 parent 5ad05ae commit 776714a

File tree

2 files changed

+98
-30
lines changed

2 files changed

+98
-30
lines changed

‎specs/powerfulfeatures/index.html

Lines changed: 50 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,11 @@
6161
text {
6262
font-family: monospace;
6363
}
64+
text.rejection {
65+
fill: #F00;
66+
font-weight: 700;
67+
font-size: 2em;
68+
}
6469
g path {
6570
stroke-width: 2px;
6671
stroke: #666;
@@ -73,7 +78,7 @@
7378
<div class="head">
7479
<p data-fill-with="logo"><a class="logo" href="http://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/Icons/w3c_home" width="72"> </a> </p>
7580
<h1 class="p-name no-ref" id="title">Secure Contexts</h1>
76-
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2015-09-15">15 September 2015</time></span></h2>
81+
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2015-09-16">16 September 2015</time></span></h2>
7782
<div data-fill-with="spec-metadata">
7883
<dl>
7984
<dt>This version:
@@ -359,12 +364,11 @@ <h4 class="heading settled" data-level="1.1.3" id="examples-workers"><span class
359364
</svg>
360365
</div>
361366
<h4 class="heading settled" data-level="1.1.4" id="examples-shared-workers"><span class="secno">1.1.4. </span><span class="content">Shared Workers</span><a class="self-link" href="#examples-shared-workers"></a></h4>
362-
<p>Shared Workers are similar to dedicated Workers, but need to check through
363-
each of the documents which share them:</p>
364-
<p class="issue" id="issue-c5802c14"><a class="self-link" href="#issue-c5802c14"></a> The current handling of Shared Workers means that
365-
the worker’s state will oscillate between secure and insecure based on the
366-
documents that attach to it. That will likely confuse developers. Several
367-
options for improvements have been suggested in the associated bug. <a href="https://github.com/w3c/webappsec/issues/406">&lt;https://github.com/w3c/webappsec/issues/406></a></p>
367+
<p>Shared Workers can have multiple contexts attached, so their behavior is a
368+
bit special. In short, if a Shared Worker is created from a secure context,
369+
it is a secure context, and may only be connected to by other secure
370+
contexts. If a Shared Worker is created from an insecure context, it is an
371+
insecure context, and may only be connected to by other insecure contexts.</p>
368372
<div class="example" id="example-7e3c52b5">
369373
<a class="self-link" href="#example-7e3c52b5"></a>
370374
<p>If <code>https://example.com/</code> in a <a data-link-type="dfn" href="http://www.w3.org/TR/html5/browsers.html#top-level-browsing-context">top-level browsing
@@ -385,11 +389,11 @@ <h4 class="heading settled" data-level="1.1.4" id="examples-shared-workers"><spa
385389
</g>
386390
</svg>
387391
</div>
388-
<div class="example" id="example-44bac5c8">
389-
<a class="self-link" href="#example-44bac5c8"></a>
392+
<div class="example" id="example-34d1a1ea">
393+
<a class="self-link" href="#example-34d1a1ea"></a>
390394
<p>If <code>https://example.com/</code> in a different <a data-link-type="dfn" href="http://www.w3.org/TR/html5/browsers.html#top-level-browsing-context">top-level
391-
browsing context</a> (e.g. in a new window) access the same shared worker,
392-
it is still a secure context, as every document accessing it is secure.</p>
395+
browsing context</a> (e.g. in a new window) is a secure context, so it may
396+
access the secure shared worker:</p>
393397
<svg height="400" width="600">
394398
<g transform="translate(10,10)">
395399
<rect class="secure" height="175" width="300" x="0" y="0"></rect>
@@ -411,9 +415,39 @@ <h4 class="heading settled" data-level="1.1.4" id="examples-shared-workers"><spa
411415
</g>
412416
</svg>
413417
</div>
414-
<div class="example" id="example-ba3d2b06">
415-
<a class="self-link" href="#example-ba3d2b06"></a>
416-
<p>If <code>https://example.com/</code> nested in <code>http://insecure.example.com/</code> runs <code>https://example.com/worker.js</code> as a Shared
418+
<div class="example" id="example-6a0d6906">
419+
<a class="self-link" href="#example-6a0d6906"></a>
420+
<p><code>https://example.com/</code> nested in <code>http://insecure.example.com/</code> may not connect to the secure
421+
worker, as it is not a secure context.</p>
422+
<svg height="400" width="600">
423+
<g transform="translate(10,10)">
424+
<rect class="secure" height="175" width="300" x="0" y="0"></rect>
425+
<text transform="translate(10, 20)">https://example.com/</text>
426+
<g transform="translate(400, 110)">
427+
<circle class="secure" r="50"></circle>
428+
<text transform="translate(-75, -55)">https://example.com/worker.js</text>
429+
</g>
430+
<g>
431+
<path d="M150, 87 C 200 75, 350 75, 405 110"></path>
432+
</g>
433+
</g>
434+
<g transform="translate(10,200)">
435+
<rect class="insecure" height="175" width="300" x="0" y="0"></rect>
436+
<text transform="translate(10, 20)">http://insecure.example.com/</text>
437+
<g transform="translate(20, 50)">
438+
<rect class="insecure" height="105" width="250" x="0" y="0"></rect>
439+
<text transform="translate(10, 20)">https://example.com/</text>
440+
</g>
441+
<g>
442+
<path d="M150, 87 C 200 75, 350 75, 405 20"></path>
443+
<text class="rejection" transform="translate(405, 20)">X</text>
444+
</g>
445+
</g>
446+
</svg>
447+
</div>
448+
<div class="example" id="example-3ecd4071">
449+
<a class="self-link" href="#example-3ecd4071"></a>
450+
<p>Likewise, if <code>https://example.com/</code> nested in <code>http://insecure.example.com/</code> runs <code>https://example.com/worker.js</code> as a Shared
417451
Worker, then both the document and the worker are considered insecure.</p>
418452
<svg height="400" width="600">
419453
<g transform="translate(10,10)">
@@ -435,7 +469,8 @@ <h4 class="heading settled" data-level="1.1.4" id="examples-shared-workers"><spa
435469
<rect class="secure" height="175" width="300" x="0" y="0"></rect>
436470
<text transform="translate(10, 20)">https://example.com/</text>
437471
<g>
438-
<path d="M150, 87 C 200 75, 350 75, 405 -80"></path>
472+
<path d="M150, 87 C 200 75, 350 75, 405 20"></path>
473+
<text class="rejection" transform="translate(405, 20)">X</text>
439474
</g>
440475
</g>
441476
</svg>
@@ -985,10 +1020,6 @@ <h2 class="no-num heading settled" id="idl-index"><span class="content">IDL Inde
9851020
</pre>
9861021
<h2 class="no-num heading settled" id="issues-index"><span class="content">Issues Index</span><a class="self-link" href="#issues-index"></a></h2>
9871022
<div style="counter-reset:issue">
988-
<div class="issue"> The current handling of Shared Workers means that
989-
the worker’s state will oscillate between secure and insecure based on the
990-
documents that attach to it. That will likely confuse developers. Several
991-
options for improvements have been suggested in the associated bug. <a href="https://github.com/w3c/webappsec/issues/406">&lt;https://github.com/w3c/webappsec/issues/406></a><a href="#issue-c5802c14"> ↵ </a></div>
9921023
<div class="issue"> WHATWG’s HTML for <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#creation-url">creation URL</a>, as W3C’s doesn’t
9931024
define the primitive we need.<a href="#issue-091ab16c"> ↵ </a></div>
9941025
<div class="issue"> <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response-https-state">HTTPS state</a> is poorly defined. For example, we should ensure

‎specs/powerfulfeatures/index.src.html

Lines changed: 48 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,11 @@ <h3 id="examples">Examples</h3>
127127
text {
128128
font-family: monospace;
129129
}
130+
text.rejection {
131+
fill: #F00;
132+
font-weight: 700;
133+
font-size: 2em;
134+
}
130135
g path {
131136
stroke-width: 2px;
132137
stroke: #666;
@@ -288,13 +293,11 @@ <h4 id="examples-workers">Web Workers</h4>
288293

289294
<h4 id="examples-shared-workers">Shared Workers</h4>
290295

291-
Shared Workers are similar to dedicated Workers, but need to check through
292-
each of the documents which share them:
293-
294-
ISSUE(w3c/webappsec#406): The current handling of Shared Workers means that
295-
the worker's state will oscillate between secure and insecure based on the
296-
documents that attach to it. That will likely confuse developers. Several
297-
options for improvements have been suggested in the associated bug.
296+
Shared Workers can have multiple contexts attached, so their behavior is a
297+
bit special. In short, if a Shared Worker is created from a secure context,
298+
it is a secure context, and may only be connected to by other secure
299+
contexts. If a Shared Worker is created from an insecure context, it is an
300+
insecure context, and may only be connected to by other insecure contexts.
298301

299302
<div class="example">
300303
<p>If <code>https://example.com/</code> in a <a>top-level browsing
@@ -319,8 +322,8 @@ <h4 id="examples-shared-workers">Shared Workers</h4>
319322

320323
<div class="example">
321324
<p>If <code>https://example.com/</code> in a different <a>top-level
322-
browsing context</a> (e.g. in a new window) access the same shared worker,
323-
it is still a secure context, as every document accessing it is secure.</p>
325+
browsing context</a> (e.g. in a new window) is a secure context, so it may
326+
access the secure shared worker:</p>
324327

325328
<svg width="600" height="400">
326329
<g transform="translate(10,10)">
@@ -345,7 +348,40 @@ <h4 id="examples-shared-workers">Shared Workers</h4>
345348
</div>
346349

347350
<div class="example">
348-
<p>If <code>https://example.com/</code> nested in
351+
<p><code>https://example.com/</code> nested in
352+
<code>http://insecure.example.com/</code> may not connect to the secure
353+
worker, as it is not a secure context.</p>
354+
355+
<svg width="600" height="400">
356+
<g transform="translate(10,10)">
357+
<rect height="175" width="300" y="0" x="0" class="secure" />
358+
<text transform="translate(10, 20)">https://example.com/</text>
359+
<g transform="translate(400, 110)">
360+
<circle r="50" class="secure" />
361+
<text transform="translate(-75, -55)">https://example.com/worker.js</text>
362+
</g>
363+
<g>
364+
<path d="M150, 87 C 200 75, 350 75, 405 110"></path>
365+
</g>
366+
</g>
367+
<g transform="translate(10,200)">
368+
<rect height="175" width="300" y="0" x="0" class="insecure" />
369+
<text transform="translate(10, 20)">http://insecure.example.com/</text>
370+
<g transform="translate(20, 50)">
371+
<rect height="105" width="250" y="0" x="0" class="insecure" />
372+
<text transform="translate(10, 20)">https://example.com/</text>
373+
</g>
374+
<g>
375+
<path d="M150, 87 C 200 75, 350 75, 405 20"></path>
376+
<text transform="translate(405, 20)" class="rejection">X</text>
377+
</g>
378+
</g>
379+
</svg>
380+
381+
</div>
382+
383+
<div class="example">
384+
<p>Likewise, if <code>https://example.com/</code> nested in
349385
<code>http://insecure.example.com/</code> runs
350386
<code>https://example.com/worker.js</code> as a Shared
351387
Worker, then both the document and the worker are considered insecure.</p>
@@ -370,7 +406,8 @@ <h4 id="examples-shared-workers">Shared Workers</h4>
370406
<rect height="175" width="300" y="0" x="0" class="secure" />
371407
<text transform="translate(10, 20)">https://example.com/</text>
372408
<g>
373-
<path d="M150, 87 C 200 75, 350 75, 405 -80"></path>
409+
<path d="M150, 87 C 200 75, 350 75, 405 20"></path>
410+
<text transform="translate(405, 20)" class="rejection">X</text>
374411
</g>
375412
</g>
376413
</svg>

0 commit comments

Comments
 (0)