diff --git a/source b/source index 1c9266202d6..996a59ff0c8 100644 --- a/source +++ b/source @@ -81836,6 +81836,34 @@ interface Location { // but see also origin to browsingContext's + container document's origin.

+ +

  • Set request for CORP check's + client to + browsingContext's container document's + relevant settings object.

    • + +
  • +

    If the result of cross-origin resource policy check with request for CORP + check and response is blocked, then set + response to a network error.

    + +

    Here we're running the cross-origin resource policy check against + the parent browsing context rather than sourceBrowsingContext. This is + because we do care about the same-originness of the embedded content against the parent + context, not the navigation source.

    +
    • + + +

  • If response has a location URL that is failure, then set response to a network error.

    • @@ -81923,6 +81951,97 @@ interface Location { // but see also     request(request), a string(endpoint) + and an environment settings object(settings), run the following + steps:

    + +
      +
    1. +

      Let blocked url be request's + URL.

      + +

      This is not request's + current URL in order to avoid leaking + information about redirect targets (see + here too).

      +
      2. + +

    2. Set blocked url's username + to the empty string, and its password to + null.

      3. + +

    3. Let serialized blocked url be blocked url + serialized with the exclude fragment + flag set.

      4. + +
    4. +

      Let body be a new object containing the following properties with keys:

      + + + + + + + + + + + + + + + + + + +
      keyvalue
      type"navigation"
      blocked-urlserialized blocked url
      +
      5. + +

    5. Queue body as + "coep" for endpoint on settings. +

    + +

    To check a navigation response's adherence to its embedder policy given a + request(request), a + response(response), and a + browsing context(target), run the following steps:

    + +
      +

    1. Return allowed if target is not a child browsing + context.

      2. + +

    2. Let response policy be the result of + obtaining an embedder policy from + response.

      3. + +

    3. Let parent policy be target's + container document's + embedder policy.

      4. + +

    4. If parent policy's report + only value is "require-corp" and response policy's + value is "unsafe-none", + then queue a Cross-Origin Embedder Policy violation on navigation + with request, parent policy's report only reporting endpoint + and target's container document's + relevant settings object.

      5. + +

    5. If parent policy's value is + "unsafe-none" or policy's + value is "require-corp", + then return allowed.

      6. + +

    6. Queue a Cross-Origin Embedder Policy violation on navigation + with request, parent policy's + reporting endpoint and + target's container document's + relevant settings object.

      7. + +

    7. Return blocked.

      8. +
    +

    To process a navigate response, given null or a request request, a response response, a string navigationType, @@ -81952,6 +82071,11 @@ interface Location { // but see also Blocked" when executed upon request, response, navigationType, source, and browsingContext.

    + +

  • The result of checking a + navigation response's adherence to its embedder policy with request, + response and browsingContext is blocked.

    This is where the network errors defined and propagated by Fetch, @@ -97978,7 +98102,8 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope {

    To queue a Cross-Origin Embedder Policy violation on worker initialization given a request(request), a string(endpoint) - and an environment settings object(settings), run the following steps.

    + and an environment settings object(settings), run the following + steps.

    1. @@ -97996,7 +98121,7 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope { null.

    2. Let serialized blocked url be blocked url - serializedwith the exclude fragment + serialized with the exclude fragment flag set.