#31923: Add Support for Cross-Origin Embedder Policy and Cross-Origin Resource
Policy Headers
-------------------------------------+-------------------------------------
Reporter: | Owner: nobody
meggles711 |
Type: New | Status: new
feature |
Component: HTTP | Version: master
handling | Keywords: COEP, header, CORP,
Severity: Normal | security
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
I would like to add support for the COEP header, as well as CORP which is
required to support this header, in Django.
**
What is Cross-Origin Resource Policy?**
This header conveys to the browser that it should block no-cors requests
to the given resource that are cross-origin or cross-site depending on the
header’s value. This prevents information leaks and blocks the response
before it enters an attacker’s process.
The CORP header can have one of three values. If set to “same-origin”, the
browser will block any cross-origin no-cors requests. If set to “same-
site”, the browser will block any cross-site no-cors requests. If set to
“cross-origin”, no-cors requests are explicitly allowed to load this
resource.
**What is Cross-Origin Embedder Policy?**
COEP, when used with the cross-origin opener policy header, is used to
create a “cross-origin isolated state” for your site. This state prevents
the modification of document.domain and makes cross-origin requests less
dangerous. It also allows developers to use otherwise dangerous features
like SharedBufferArray, performance.measureMemory, and the JS Self-
Profiling API.
When set, COEP instructs the browser not to load cross-origin resources
into the document unless they give explicit permission using CORS or CORP.
Because of this, COEP can only be effectively used if developers also have
the ability to set the CORP or CORS header. COEP can only be set to one
value, “require-corp”.
**Proposed Changes to Django**
Django users should have the ability to set the COEP and CORP headers.
Support for them should be added as a part of the security middleware.
COEP should default to “require-corp” and CORP should default to “same-
origin”.
--
Ticket URL: <https://code.djangoproject.com/ticket/31923>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/053.960d93f55db670dc72b2a112b1dac025%40djangoproject.com.
