websec A. Barth Internet-Draft Google, Inc. Intended status: Informational February 21, 2011 Expires: August 25, 2011 Principles of the Same-Origin Policy draft-abarth-principles-of-origin-00 Abstract The security model of the web platform has evolved over time to meet the needs of new applications and to correct earlier mistakes. Although web security has evolved largely organically, the security model has converged towards a handful of key concepts. This document presents those concepts and provides advice to designers of new pieces of the web platform. Status of this Memo This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on August 25, 2011. Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents Barth Expires August 25, 2011 [Page 1]

Internet-Draft Principles of the Same-Origin Policy February 2011 (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Trust . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1. Pitfalls . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Origin . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 4. Authority . . . . . . . . . . . . . . . . . . . . . . . . . . 6 4.1. Pitfalls . . . . . . . . . . . . . . . . . . . . . . . . . 6 5. Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 5.1. Object Access . . . . . . . . . . . . . . . . . . . . . . 7 5.2. Network Access . . . . . . . . . . . . . . . . . . . . . . 7 5.3. Pitfalls . . . . . . . . . . . . . . . . . . . . . . . . . 7 6. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 10 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 11 Barth Expires August 25, 2011 [Page 2]

Internet-Draft Principles of the Same-Origin Policy February 2011 1 . Introduction Barth Expires August 25, 2011 [Page 3]

Internet-Draft Principles of the Same-Origin Policy February 2011 2 . Trust 2.1 . Pitfalls Barth Expires August 25, 2011 [Page 4]

Internet-Draft Principles of the Same-Origin Policy February 2011 3 . Origin https://example.edu/~student/, but that does not mean a document authored by a student should be part of the same origin (i.e., represent the same principal) as a web application for managing grades hosted at https://grades.example.edu/. Barth Expires August 25, 2011 [Page 5]

Internet-Draft Principles of the Same-Origin Policy February 2011 4 . Authority 4.1 . Pitfalls Barth Expires August 25, 2011 [Page 6]

Internet-Draft Principles of the Same-Origin Policy February 2011 5 . Policy 5.1 . Object Access 5.2 . Network Access 5.3 . Pitfalls Barth Expires August 25, 2011 [Page 7]

Internet-Draft Principles of the Same-Origin Policy February 2011 send network requests to another origin gives rise to cross-site request forgery vulnerabilities. However, user agents tolerate these risks when the value proposition is high enough. For example, a user agent that blocked cross-origin network requests would prevent its users from following hyperlinks, a core component of the web architecture. When designing new pieces of the web platform, it can be tempting to grant a privilege to one document but to withhold that privilege from another document in the same origin. However, withholding privileges in this way is ineffective because the document without the privilege can usually obtain the privilege anyway because user agents do not isolate documents within an origin. Instead, new pieces of the platform should grant or withhold privileges from origins as a whole (rather than discriminating between individual documents within an origin). Barth Expires August 25, 2011 [Page 8]

Internet-Draft Principles of the Same-Origin Policy February 2011 6 . Conclusion Barth Expires August 25, 2011 [Page 9]

Internet-Draft Principles of the Same-Origin Policy February 2011 Appendix A . Acknowledgements Barth Expires August 25, 2011 [Page 10]

Internet-Draft Principles of the Same-Origin Policy February 2011 Author's Address Adam Barth Google, Inc. Email: ietf@adambarth.com URI: http://www.adambarth.com/ Barth Expires August 25, 2011 [Page 11]