From security as opt-in to security by default
summary
Proposal: browsers flip permissive behaviors to opt-in and ship defaults that block cross-origin hazards. Concrete changes include deprecating document.domain deprecated because it prevents origin isolation, requiring embed permission via X-Frame-Options / CSP frame-ancestors, protecting resources with Cross-Origin-Resource-Policy (same-origin / same-site / cross-origin), and making pop-ups isolated by default unless opted out with COOP: unsafe-none. Proof-of-concept Spectre demos (leakey.page) motivate these defaults.
AI-written summary · about
chapters (4)
related talks
08mEnable and debug cross-origin isolated
27mPatterns for privacy
42mThe Perilous Future of Browser Security
19mWeb Platform Security
59mThe Final Frontier: Security APIs in Modern Browsers
27mCode-Origin Policy: Towards a Formal User Privacy Protection for the Web
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps