From 01f734f9062fad535a1a1083551797c06020c5c1 Mon Sep 17 00:00:00 2001 From: Yao Xiao Date: Thu, 15 Feb 2024 01:05:46 -0800 Subject: [PATCH] [shared storage] Support cross-origin worklet For the sharedStorage.createWorklet() API, relax the same-origin restriction to allow cross-origin script, in which case a cross-origin worklet will be created. How: - Rely on CORS for the worklet to be loaded/used by the embedder. - Leverage the existing process allocation and management logic from service workers and directly re-use SiteInstanceImpl::CreateForServiceWorker(). To keep this CL focused, renaming will occur in a separate CL, as it will involve renaming other downstream components like 'UnmatchedServiceWorkerProcessTracker'. Explainer: https://github.com/WICG/shared-storage/pull/130 Spec: https://github.com/WICG/shared-storage/pull/131 Design doc: https://docs.google.com/document/d/1QTaaroCMeFVZVghI6JkUcDvmDQEacjvpyTfk6mpvQhA/edit?usp=sharing Bug: 325302836 Change-Id: I11c1fc87bc76f4400c54d9fa809349d1d1781247 --- ...edentials-include.tentative.https.sub.html | 35 +++++++++++++++++++ ...-credentials-omit.tentative.https.sub.html | 34 ++++++++++++++++++ ...tials-same-origin.tentative.https.sub.html | 34 ++++++++++++++++++ ...allow-credentials.tentative.https.sub.html | 29 +++++++++++++++ ...trol-allow-origin.tentative.https.sub.html | 28 +++++++++++++++ .../resources/credentials-test-helper.py | 6 ++++ 6 files changed, 166 insertions(+) create mode 100644 shared-storage/cross-origin-create-worklet-credentials-include.tentative.https.sub.html create mode 100644 shared-storage/cross-origin-create-worklet-credentials-omit.tentative.https.sub.html create mode 100644 shared-storage/cross-origin-create-worklet-credentials-same-origin.tentative.https.sub.html create mode 100644 shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-credentials.tentative.https.sub.html create mode 100644 shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-origin.tentative.https.sub.html diff --git a/shared-storage/cross-origin-create-worklet-credentials-include.tentative.https.sub.html b/shared-storage/cross-origin-create-worklet-credentials-include.tentative.https.sub.html new file mode 100644 index 000000000000000..601533d022eebb0 --- /dev/null +++ b/shared-storage/cross-origin-create-worklet-credentials-include.tentative.https.sub.html @@ -0,0 +1,35 @@ + + + + + + + + + + diff --git a/shared-storage/cross-origin-create-worklet-credentials-omit.tentative.https.sub.html b/shared-storage/cross-origin-create-worklet-credentials-omit.tentative.https.sub.html new file mode 100644 index 000000000000000..857449020bb5352 --- /dev/null +++ b/shared-storage/cross-origin-create-worklet-credentials-omit.tentative.https.sub.html @@ -0,0 +1,34 @@ + + + + + + + + + + diff --git a/shared-storage/cross-origin-create-worklet-credentials-same-origin.tentative.https.sub.html b/shared-storage/cross-origin-create-worklet-credentials-same-origin.tentative.https.sub.html new file mode 100644 index 000000000000000..84b0e8b122d2f3e --- /dev/null +++ b/shared-storage/cross-origin-create-worklet-credentials-same-origin.tentative.https.sub.html @@ -0,0 +1,34 @@ + + + + + + + + + + diff --git a/shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-credentials.tentative.https.sub.html b/shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-credentials.tentative.https.sub.html new file mode 100644 index 000000000000000..598fd8f405abdc8 --- /dev/null +++ b/shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-credentials.tentative.https.sub.html @@ -0,0 +1,29 @@ + + + + + + + + + + diff --git a/shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-origin.tentative.https.sub.html b/shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-origin.tentative.https.sub.html new file mode 100644 index 000000000000000..4195d09fc06c46d --- /dev/null +++ b/shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-origin.tentative.https.sub.html @@ -0,0 +1,28 @@ + + + + + + + + + + diff --git a/shared-storage/resources/credentials-test-helper.py b/shared-storage/resources/credentials-test-helper.py index 81a988e3581f056..46fc0ea6fb2a998 100644 --- a/shared-storage/resources/credentials-test-helper.py +++ b/shared-storage/resources/credentials-test-helper.py @@ -13,6 +13,12 @@ def main(request, response): response.status = 200 response.headers.append(b"Content-Type", b"text/javascript") + if b"access_control_allow_credentials_header" in request.GET: + response.headers.append(b"Access-Control-Allow-Credentials", request.GET[b"access_control_allow_credentials_header"]) + + if b"access_control_allow_origin_header" in request.GET: + response.headers.append(b"Access-Control-Allow-Origin", request.GET[b"access_control_allow_origin_header"]) + if action == b"store-cookie": cookie = request.headers.get(b"Cookie", b"NO_COOKIE_HEADER") request.server.stash.put(token, cookie)