Partition Blob URL fetches by Storage Key #1783

recvfrom · 2024-10-25T21:33:12Z

Partition Blob URL fetches by Storage Key

This change updates the spec to partition Blob URL fetches by Storage Key. This change is part of broader changes discussed in w3c/FileAPI#153 (comment). Specifically, we will also:

Partition Blob URL revocation by storage key - Partition Blob URL revocation by Storage Key w3c/FileAPI#201
Enforce noopener for cross-top-level-site Blob URLs - (Spec changes for this will follow)

I considered incorporating the Storage Key checks into the "resolve a blob URL" algorithm instead, but it seemed that this would require an environment settings object to be available as part of https://url.spec.whatwg.org/#url-parsing, and I'm not sure whether that is the case / a change we want.

At least two implementers are interested (and none opposed):
- Firefox has already implemented this - Blob URL store partitioning w3c/FileAPI#153 (comment)
- Safari has implemented partitioning Blob URL fetches by top-level origin and is considering partitioning them by a site-based Storage Key (Storage Key specifics TBD) - Blob URL store partitioning w3c/FileAPI#153 (comment)
Tests are written and can be reviewed and commented upon at:
- https://chromium-review.googlesource.com/c/chromium/src/+/5967596
Implementation bugs are filed:
- Chromium: https://crbug.com/40057646
- Gecko: N/A
- WebKit: N/A
- Deno (not for CORS changes): N/A (it seems Deno does not partition storage or more generally implement the same-origin policy: https://docs.deno.com/runtime/reference/web_platform_apis/#spec-deviations)
MDN issue is filed: Note that Blob URL usage is restricted due to storage partitioning mdn/content#36542
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

recvfrom · 2024-11-12T20:21:29Z

@annevk would you be able to look at this PR as well? Or could you recommend another reviewer? Thank you!

recvfrom · 2024-11-18T14:41:13Z

@domenic would you mind taking a look at this when you have a chance?

domenic · 2024-11-21T07:14:56Z

fetch.bs

+prevented from succeeding if the <a spec=storage>storage key</a> of the
+<a>environment settings object</a> making the request is different than the
+<a spec=storage>storage key</a> of the <a>environment settings object</a> corresponding to where
+the Blob URL was created.


This feels like it would work better after line 5028, instead of near this algorithm.

I was thinking this would make sense in the Infrastructure section like how the HTTP cache partitioning section and determine the HTTP cache partition algorithm are, but I've moved the algorithm under the Scheme fetch section now (and removed the note since it seems kinda out of place now. WDYT?

fetch.bs

domenic

Non-editor LGTM

fetch.bs

annevk · 2024-11-22T08:47:14Z

I'm a little worried about this approach as it means obtaining and revoking are maintained in independent specifications, but need to be kept synchronized to maintain the privacy and security boundary.

I think a more ideal setup would be that File API keeps the Blob objects out of reach (i.e., they're no longer directly accessible from a 'blob URL entry') and instead exposes some kind of "obtain" algorithm that we hand the 'blob URL entry' and current 'environment' (or maybe a storage key). That way File API can stay in charge of obtaining and revoking and most of the logic associated with that. And Fetch can mainly concern itself with translating a Blob into a response.

domenic · 2024-11-22T09:30:46Z

It looks like there aren't too many references to the blob URL entry's object... https://dontcallmedom.github.io/webdex/o.html#object%40%40blob%20URL%20entry%40dfn

annevk · 2024-11-22T09:38:27Z

Nice, the HTML find is legit and would also need to be updated I suspect. It would benefit from having the obtaining defined in File API so there's less need for duplication. Reporting API seems bogus: w3c/reporting#273. Web Authentication API seems similarly bogus: w3c/webauthn#2212.

recvfrom · 2024-11-25T05:18:28Z

Thanks for the feedback, I've updated my FileAPI PR [1] to expose an obtain algorithm as recommended here, and I've updated this PR to use it. One question I thought more about was what to do when the request doesn't have an associated environment... It seems like for Blob URLs we should allow navigations to bypass the partitioning checks, but otherwise we should just fail (this seems in line with the Chromium implementation at least). WDYT?

[1] https://github.com/w3c/FileAPI/pull/201/files

recvfrom · 2024-11-25T15:16:57Z

A draft PR for the HTML spec change is at: whatwg/html#10792

annevk

Thank you for reworking this so quickly!

fetch.bs

annevk

Thanks again for improving this aspect of blob: URLs!

fetch.bs

recvfrom · 2024-12-06T23:13:13Z

Thanks again for improving this aspect of blob: URLs!

NP, thanks for all of your helpful review feedback and guidance!

As suggested in whatwg/fetch#1783 (comment), this change updates an existing use of blob URL entry's object so that the "obtain a blob object" algorithm is used instead. This algorithm was added in w3c/FileAPI#201.

Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b

Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5967596 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Andrew Williams <[email protected]> Cr-Commit-Position: refs/heads/main@{#1394563}

…PTs permanent, a=testonly Automatic update from web-platform-tests [Blob URL] Make tentative partitioning WPTs permanent Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5967596 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Andrew Williams <[email protected]> Cr-Commit-Position: refs/heads/main@{#1394563} -- wpt-commits: 949cc8c7c7067de75af00d1ba60d6921582f9c5d wpt-pr: 49629

…PTs permanent, a=testonly Automatic update from web-platform-tests [Blob URL] Make tentative partitioning WPTs permanent Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5967596 Reviewed-by: Steven Bingler <binglerchromium.org> Commit-Queue: Andrew Williams <awilliachromium.org> Cr-Commit-Position: refs/heads/main{#1394563} -- wpt-commits: 949cc8c7c7067de75af00d1ba60d6921582f9c5d wpt-pr: 49629 UltraBlame original commit: eeba0835a846042567009b99eb22224cfacd0380

…PTs permanent, a=testonly Automatic update from web-platform-tests [Blob URL] Make tentative partitioning WPTs permanent Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5967596 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Andrew Williams <[email protected]> Cr-Commit-Position: refs/heads/main@{#1394563} -- wpt-commits: 949cc8c7c7067de75af00d1ba60d6921582f9c5d wpt-pr: 49629

recvfrom and others added 4 commits October 25, 2024 14:37

Partition Blob URL fetches by Storage Key

42a4f90

Fix formatting per the style guide

2d4567d

Fix build and formatting

e7689d6

Add name to Acknowledgements section

f4f62bf

recvfrom mentioned this pull request Oct 28, 2024

Note that Blob URL usage is restricted due to storage partitioning mdn/content#36542

Open

recvfrom marked this pull request as ready for review October 28, 2024 17:10

recvfrom mentioned this pull request Oct 28, 2024

Blob URL store partitioning w3c/FileAPI#153

Open

domenic reviewed Nov 21, 2024

View reviewed changes

Address review feedback

d79ae96

domenic approved these changes Nov 22, 2024

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

Move storage key check logic to FileAPI

0d6d692

recvfrom mentioned this pull request Nov 25, 2024

Partition Blob URL revocation by Storage Key w3c/FileAPI#201

Merged

4 tasks

Refactor existing use of blob URL entry object

cacc4e5

recvfrom mentioned this pull request Nov 25, 2024

Replace existing usage of blob URL entry's object whatwg/html#10792

Merged

annevk reviewed Nov 25, 2024

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

recvfrom added 2 commits November 28, 2024 19:31

Address review feedback

2f71ba0

Fix reference to 'Obtain a blob URL'

c201d79

annevk reviewed Dec 6, 2024

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

Simplify based on review feedback

0b5fccb

Minor text wrapping change for consistency

ddae2dc

annevk approved these changes Dec 9, 2024

View reviewed changes

annevk merged commit 0ce45ae into whatwg:main Dec 9, 2024
2 checks passed

chromium-wpt-export-bot mentioned this pull request Dec 10, 2024

[Blob URL] Make tentative partitioning WPTs permanent web-platform-tests/wpt#49629

Merged

recvfrom mentioned this pull request Dec 19, 2024

Enforcing no-opener for cross-top-level-site blob URL top-level navigations mozilla/standards-positions#1151

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Partition Blob URL fetches by Storage Key #1783

Partition Blob URL fetches by Storage Key #1783

recvfrom commented Oct 25, 2024 •

edited by pr-preview bot

Loading

recvfrom commented Nov 12, 2024

recvfrom commented Nov 18, 2024

domenic Nov 21, 2024

recvfrom Nov 22, 2024

domenic left a comment

annevk commented Nov 22, 2024

domenic commented Nov 22, 2024

annevk commented Nov 22, 2024

recvfrom commented Nov 25, 2024

recvfrom commented Nov 25, 2024

annevk left a comment

annevk left a comment

recvfrom commented Dec 6, 2024

Partition Blob URL fetches by Storage Key #1783

Partition Blob URL fetches by Storage Key #1783

Conversation

recvfrom commented Oct 25, 2024 • edited by pr-preview bot Loading

recvfrom commented Nov 12, 2024

recvfrom commented Nov 18, 2024

domenic Nov 21, 2024

Choose a reason for hiding this comment

recvfrom Nov 22, 2024

Choose a reason for hiding this comment

domenic left a comment

Choose a reason for hiding this comment

annevk commented Nov 22, 2024

domenic commented Nov 22, 2024

annevk commented Nov 22, 2024

recvfrom commented Nov 25, 2024

recvfrom commented Nov 25, 2024

annevk left a comment

Choose a reason for hiding this comment

annevk left a comment

Choose a reason for hiding this comment

recvfrom commented Dec 6, 2024

recvfrom commented Oct 25, 2024 •

edited by pr-preview bot

Loading