3 ms·

Why only in secure contexts? You can use storage APIs in insecure contexts, doing this by spinning, but the lock API which seems much more innocuous requires a

by remram 2y ago

Why only in secure contexts? You can use storage APIs in insecure contexts, doing this by spinning, but the lock API which seems much more innocuous requires a secure context?

endgame 2y ago
If certain lock names become well-known, maybe you could DoS browsers by holding random locks and never releasing them?
- Spivak 2y ago
  I guess but since they're origin-bound can you do anything except DoS your page?
chrismorgan 2y ago
I believe most new capabilities are limited to secure contexts, in part as a way of discouraging bad habits, even when there’s no particular risk. The ideal is that everything should run in a secure context, but it’s a hard sell removing existing functionality from insecure contexts. If it were being added now, I’m pretty sure storage APIs would be secure-only. Search around and you’ll find various information and explanations about it. https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/ https://blog.mozilla.org/security/2018/01/15/secure-contexts... is one, though https://w3ctag.github.io/design-principles/#secure-context https://w3ctag.github.io/design-principles/#secure-context has apparently been significantly watered down from what it was originally—see the initial proposal in https://github.com/w3ctag/design-principles/pull/75 https://github.com/w3ctag/design-principles/pull/75, and what was then merged in https://github.com/w3ctag/design-principles/pull/89 https://github.com/w3ctag/design-principles/pull/89.
berkes 2y ago
I'd presume that a MITM could set, release and read locks, by which it might determine that you have certain sites open. In general¹, I presume that any API that uses "same origin" as bounding criteria, must be secure. Since there's no way to enforce this "same origin" in insecure contexts. -- ¹ Aside from the idea that maybe just make all new APIs "secure only", just to discourage insecure contexts.
- eddd-ddde 2y ago
  Or also just lock resources and stop other pages from working.

by remram 2y ago

Why only in secure contexts? You can use storage APIs in insecure contexts, doing this by spinning, but the lock API which seems much more innocuous requires a secure context?

endgame 2y ago

If certain lock names become well-known, maybe you could DoS browsers by holding random locks and never releasing them?

Spivak 2y ago
I guess but since they're origin-bound can you do anything except DoS your page?

chrismorgan 2y ago

I believe most new capabilities are limited to secure contexts, in part as a way of discouraging bad habits, even when there’s no particular risk. The ideal is that everything should run in a secure context, but it’s a hard sell removing existing functionality from insecure contexts. If it were being added now, I’m pretty sure storage APIs would be secure-only. Search around and you’ll find various information and explanations about it. https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/ https://blog.mozilla.org/security/2018/01/15/secure-contexts... is one, though https://w3ctag.github.io/design-principles/#secure-context https://w3ctag.github.io/design-principles/#secure-context has apparently been significantly watered down from what it was originally—see the initial proposal in https://github.com/w3ctag/design-principles/pull/75 https://github.com/w3ctag/design-principles/pull/75, and what was then merged in https://github.com/w3ctag/design-principles/pull/89 https://github.com/w3ctag/design-principles/pull/89.

berkes 2y ago

I'd presume that a MITM could set, release and read locks, by which it might determine that you have certain sites open. In general¹, I presume that any API that uses "same origin" as bounding criteria, must be secure. Since there's no way to enforce this "same origin" in insecure contexts. -- ¹ Aside from the idea that maybe just make all new APIs "secure only", just to discourage insecure contexts.

eddd-ddde 2y ago
Or also just lock resources and stop other pages from working.