HTML Standard Tracker

Diff (omit for latest revision)
Filter

Short URL: http://html5.org/r/2525

File a bug

SVNBugCommentTime (UTC)
2525[Webkit] CSRF mitigation -- add Origin header to all non-GET requests.2008-12-02 11:26
Index: source
===================================================================
--- source	(revision 2524)
+++ source	(revision 2525)
@@ -5766,8 +5766,9 @@
 
   <p class="note">In the case of HTTP, the <code
   title="dom-document-referrer">referrer</code> DOM attribute will
-  match the <code title="">Referer</code> (sic) header that was sent
-  when <span title="fetch">fetching</span> the current page.</p>
+  match the <code title="http-referer">Referer</code> (sic) header
+  that was sent when <span title="fetch">fetching</span> the current
+  page.</p>
 
   <p class="note">Typically user agents are configured to not report
   referrers in the case where the referrer uses an encrypted protocol
@@ -39568,8 +39569,9 @@
 
   <p><strong>Leaking secure URLs.</strong> User agents should not send
   HTTPS URLs to third-party sites registered as content handlers, in
-  the same way that user agents do not send <code>Referer</code>
-  headers from secure sites to third-party sites.</p>
+  the same way that user agents do not send <code
+  title="http-referer">Referer</code> headers from secure sites to
+  third-party sites.</p>
 
   <p><strong>Leaking credentials.</strong> User agents must never send
   username or password information in the URLs that are escaped and
@@ -42031,10 +42033,6 @@
     title="concept-appcache-selection">most appropriate application
     cache</span> of those that match.</p>
 
-    <p>Otherwise, <span>fetch</span> the new resource. If this results
-    in a redirect, return to <a href="#navigate-fragid-step">the step
-    labeled "fragment identifiers"</a> with the new resource.</p>
-
     <p class="example">For example, imagine an HTML page with an
     associated application cache displaying an image and a form, where
     the image is also used by several other application caches. If the
@@ -42047,6 +42045,29 @@
     application cache at all; the submission will be made to the
     network.</p>
 
+    <p>Otherwise, <span>fetch</span> the new resource. If the resource
+    is being fetched using HTTP, and the method is not GET<!-- or HEAD
+    (but that can't happen) -->, then the user agent must include an
+    <code title="http-origin">Origin</code> header whose value is
+    determined as follows:</p>
+
+    <dl class="switch">
+
+     <dt>If the <span title="navigate">navigation</span> algorithm has
+     so far contacted more than one <span>origin</span></dt>
+     <dt>If there is no <span>source browsing context</span></dt>
+
+     <dd>The value must be the string "<code title="">null</code>".</dd>
+
+     <dt>Otherwise</dt>
+
+     <dd>The value must be the <span title="ASCII serialization of an
+     origin">ASCII serialization</span> of the <span>origin</span> of
+     the <span>active document</span> of the <span>source browsing
+     context</span> at the time the navigation was started.</dd>
+
+    </dl>
+
    </li>
 
    <li>
@@ -42062,6 +42083,18 @@
 
    </li>
 
+   <li>
+
+    <p>If fetching the resource results in a redirect, return to <a
+    href="#navigate-fragid-step">the step labeled "fragment
+    identifiers"</a> with the new resource.</p>
+
+    <p class="note">Cross-origin redirects cause the <code
+    title="http-origin">Origin</code> header to become "<code
+    title="">null</code>" on subsequent requests in the chain.</p>
+
+   </li>
+
    <li><p>Wait for one or more bytes to be available or for the user
    agent to establish that the resource in question is empty. During
    this time, the user agent may allow the user to cancel this
@@ -44161,8 +44194,8 @@
 
   <p>User agents should allow the user to adjust this behavior, for
   example in conjunction with a setting that disables the sending of
-  HTTP <code title="">Referer</code> headers. Based on the user's
-  preferences, UAs may either <span>ignore</span> the <code
+  HTTP <code title="http-referer">Referer</code> headers. Based on the
+  user's preferences, UAs may either <span>ignore</span> the <code
   title="attr-hyperlink-ping">ping</code> attribute altogether, or
   selectively ignore URLs in the list (e.g. ignoring any third-party
   URLs).</p>
@@ -44181,37 +44214,52 @@
    of the <code>Document</code> object containing the hyperlink being
    audited and the ping URL have the <span>same origin</span></dt>
 
-   <dd>The request must include a <code title="">Ping-From</code> HTTP
-   header with, as its value, the <span title="the document's
-   address">address</span> of the document containing the hyperlink,
-   and a <code title="">Ping-To</code> HTTP header with, as its value,
+   <dd>The request must include a <code
+   title="http-ping-from">Ping-From</code> HTTP header with, as its
+   value, the <span title="the document's address">address</span> of
+   the document containing the hyperlink, and a <code
+   title="http-ping-to">Ping-To</code> HTTP header with, as its value,
    the address of the <span>absolute URL</span> of the target of the
    hyperlink. The request must not include a <code
-   title="">Referer</code> HTTP header. <!-- why not? --></dd>
+   title="http-referer">Referer</code> HTTP header. <!-- because
+   otherwise it would look like a trustable same-origin POST --></dd>
 
    <dt>Otherwise, if the origins are different, but the document
    containing the hyperlink being audited was not retrieved over an
-   encrypted connection</dt> <!-- why different? -->
+   encrypted connection</dt>
 
    <dd>The request must include a <code title="">Referer</code> HTTP
    header [sic] with, as its value, the <span title="the document's
    address">address</span> of the document containing the hyperlink, a
-   <code title="">Ping-From</code> HTTP header with the same value,
-   and a <code title="">Ping-To</code> HTTP header with, as its value,
-   the address of the target of the hyperlink.</dd>
+   <code title="http-ping-from">Ping-From</code> HTTP header with the
+   same value, and a <code title="http-ping-to">Ping-To</code> HTTP
+   header with, as its value, the address of the target of the
+   hyperlink.</dd>
 
    <dt>Otherwise, the origins are different and the document
    containing the hyperlink being audited was retrieved over an
    encrypted connection</dt>
 
-   <dd>The request must include a <code title="">Ping-To</code> HTTP
-   header with, as its value, the address of the target of the
-   hyperlink. The request must neither include a <code
-   title="">Referer</code> HTTP header nor include a <code
-   title="">Ping-From</code> HTTP header.</dd>
+   <dd>The request must include a <code
+   title="http-ping-to">Ping-To</code> HTTP header with, as its value,
+   the address of the target of the hyperlink. The request must
+   neither include a <code title="">Referer</code> HTTP header nor
+   include a <code title="http-ping-from">Ping-From</code> HTTP
+   header.</dd>
 
   </dl>
 
+  <p>In addition, an <code title="http-origin">Origin</code> header
+  must always be included, whose value is the <span title="ASCII
+  serialization of an origin">ASCII serialization</span> of the
+  <span>origin</span> of the the <code>Document</code> containing the
+  <span>hyperlink</span>. The value of the <code
+  title="http-origin">Origin</code> header must be set to "<code
+  title="">null</code>" when following redirects if the <span
+  title="origin">origins</span> of all the <span
+  title="URL">URLs</span> involved are not the <span title="same
+  origin">same</span>.</p>
+
   <p class="note">To save bandwidth, implementors might also wish to
   consider omitting optional headers such as <code>Accept</code> from
   these requests.</p>

|