shell: Add iframe sandbox to restrict frame Origin #6260
Conversation
stefwalter
added
blocked
|
@petervo Do you think we should leave this sandbox off for frames on the localhost? |
|
Doesn't this block the parent cookie from being sent along with the http requests from the iframe? The cookie is needed there for the html/js files to load. |
I don't think so. It prevents the javascript from accessing the cookies, but not use in the request. At least that's what I understood, and saw in practice here. |
…igin In order to use <iframe> sandbox attribute and split various frames into their own origin, we have to specify very cleary that these frames are allowed to access the main origin server side. This involves two things: * Further clarifying all the Content-Security-Policy headers to include our own Origin in addition to 'self' * Adding Access-Control-Allow-Origin headers with our own Origin Closes cockpit-project#6258 Signed-off-by: Peter Volpe <[email protected]> * Respect and forward incoming headers
When running in an <iframe> sandbox the window.localStorage can have its access denied, so handle this case.
This prevents one frame from accessing stuff in another frame. Models the security model that we're going for better, where stuff loaded from one server should not access stuff in another server.
If we're navigating to another URL in a window, or are closing the window, make sure to send an explicit hint to the parent.
stefwalter
force-pushed
the
iframe-sandbox
branch
from
1100928 to
52f6e5d
Compare
martinpitt
changed the title
|
Needs to rebase to master since #12367 changed tests names |
|
Closing for now, to clean up our stale PR list. This would be a great feature to have, but in the next months we have more urgent issues to address. It will take someone else quite some time to get up to speed with this code, so this will be quite a large project. |
This prevents one frame from accessing stuff in another frame.
Models the security model that we're going for better, where stuff
loaded from one server should not access stuff in another server.