GeezerVison

An origin's equality, given origins A and B, returns true if A and B are same origin; otherwise false.

The effective domain of an origin origin is computed as follows:

1. If origin is an opaque origin, then return null.

2. If origin's domain is non-null, then return origin's domain.

3. Return origin's host.

The serialization of an origin is the string obtained by applying the following algorithm to the given origin origin:

1. If origin is an opaque origin, then return "null".

2. Otherwise, let result be origin's scheme.

3. Append "://" to result.

4. Append origin's host, serialized, to result.

5. If origin's port is non-null, append a U+003A COLON character (:), and origin's port, serialized, to result.

6. Return result.

Two origins, A and B, are said to be same origin if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins, their schemes and ports are identical, and their hosts are equal, then return true.

3. Return false.

Two origins, A and B, are said to be same origin-domain if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins:

   1. If A and B's schemes are identical, and their domains are identical and non-null, then return true.

   2. Otherwise, if A and B are same origin and their domains are both null, return true.

3. Return false.

To obtain a site, given an origin origin, run these steps:

1. If origin is an opaque origin, then return origin.

2. If origin's host's registrable domain is null, then return (origin's scheme, origin's host).

3. Return (origin's scheme, origin's host's registrable domain).

Two sites, A and B, are said to be same site if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A or B is an opaque origin, then return false.

3. If A's and B's scheme values are different, then return false.

4. If A's and B's host values are not equal, then return false.

5. Return true.

The serialization of a site is the string obtained by applying the following algorithm to the given site site:

1. If site is an opaque origin, then return "null".

2. Let result be site[0].

3. Append "://" to result.

4. Append site[1], serialized, to result.

5. Return result.

Two origins, A and B, are said to be schemelessly same site if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins:

   1. Let hostA be A's host, and let hostB be B's host.

   2. If hostA equals hostB and hostA's registrable domain is null, then return true.

   3. If hostA's registrable domain equals hostB's registrable domain and is non-null, then return true.

3. Return false.

Two origins, A and B, are said to be same site if the following algorithm returns true:

1. Let siteA be the result of obtaining a site given A.

2. Let siteB be the result of obtaining a site given B.

3. If siteA is same site with siteB, then return true.

4. Return false.

Given that wildlife.museum, museum, and com are public suffixes and that example.com is not:

(Here we have omitted the port and domain components since they are not considered.)

Avoid using the document.domain setter. It undermines the security protections provided by the same-origin policy. This is especially acute when using shared hosting; for example, if an untrusted third party is able to host an HTTP server at the same IP address but on a different port, then the same-origin protection that normally protects two different sites on the same host will fail, as the ports are ignored when comparing origins after the document.domain setter has been used.

Because of these security pitfalls, this feature is in the process of being removed from the web platform. (This is a long process that takes many years.)

Instead, use postMessage() or MessageChannel objects to communicate across origins in a safe manner.

The domain getter steps are:

1. Let effectiveDomain be this's origin's effective domain.

2. If effectiveDomain is null, then return the empty string.

3. Return effectiveDomain, serialized.

The domain setter steps are:

1. If this's browsing context is null, then throw a "SecurityError" DOMException.

2. If this's active sandboxing flag set has its sandboxed document.domain browsing context flag set, then throw a "SecurityError" DOMException.

3. Let effectiveDomain be this's origin's effective domain.

4. If effectiveDomain is null, then throw a "SecurityError" DOMException.

5. If the given value is not a registrable domain suffix of and is not equal to effectiveDomain, then throw a "SecurityError" DOMException.

6. If the surrounding agent's agent cluster's is origin-keyed is true, then return.

7. Set this's origin's domain to the result of parsing the given value.

To determine if a scalar value string hostSuffixString is a registrable domain suffix of or is equal to a host originalHost:

1. If hostSuffixString is the empty string, then return false.

2. Let hostSuffix be the result of parsing hostSuffixString.

3. If hostSuffix is failure, then return false.

4. If hostSuffix does not equal originalHost:

   1. If hostSuffix or originalHost is not a domain, then return false.

      This excludes hosts that are IP addresses.

   2. If hostSuffix, prefixed by U+002E (.), does not match the end of originalHost, then return false.

   3. If any of the following are true:

      • hostSuffix equals hostSuffix's public suffix; or

      • hostSuffix, prefixed by U+002E (.), matches the end of originalHost's public suffix,

      then return false. [URL]

   4. Assert: originalHost's public suffix, prefixed by U+002E (.), matches the end of hostSuffix.

5. Return true.

Objects implementing the Origin interface's extract an origin steps are to return this's origin.

The new Origin() constructor steps are to set this's origin to a unique opaque origin.

The static from(value) method steps are:

1. If value is a platform object:

   1. Let origin be the result of executing value's extract an origin operation.

   2. If origin is not null, then return a new Origin object whose origin is origin.

2. If value is a string:

   1. Let parsedURL be the result of basic URL parsing value.

   2. If parsedURL is not failure, then return a new Origin object whose origin is set to parsedURL's origin.

3. Throw a TypeError.

The opaque getter steps are to return true if this's origin is an opaque origin; otherwise false.

The isSameOrigin(other) method steps are to return true if this's origin is same origin with other's origin; otherwise false.

The isSameSite(other) method steps are to return true if this's origin is same site with other's origin; otherwise false.

The originAgentCluster getter steps are to return the surrounding agent's agent cluster's is origin-keyed.

To match opener policy values, given an opener policy value documentCOOP, an origin documentOrigin, an opener policy value responseCOOP, and an origin responseOrigin:

1. If documentCOOP is "unsafe-none" and responseCOOP is "unsafe-none", then return true.

2. If documentCOOP is "unsafe-none" or responseCOOP is "unsafe-none", then return false.

3. If documentCOOP is responseCOOP and documentOrigin is same origin with responseOrigin, then return true.

4. Return false.

To obtain an opener policy given a response response and an environment reservedEnvironment:

1. Let policy be a new opener policy.

2. If reservedEnvironment is a non-secure context, then return policy.

3. Let parsedItem be the result of getting a structured field value given `Cross-Origin-Opener-Policy` and "item" from response's header list.

4. If parsedItem is not null and parsedItem[0] is a token:

   1. If parsedItem[0] is "same-origin":

      1. Let coep be the result of obtaining a cross-origin embedder policy from response and reservedEnvironment.

      2. If coep's value is compatible with cross-origin isolation, then set policy's value to "same-origin-plus-COEP".

      3. Otherwise, set policy's value to "same-origin".

   2. If parsedItem[0] is "same-origin-allow-popups", then set policy's value to "same-origin-allow-popups".

   3. If parsedItem[0] is "noopener-allow-popups", then set policy's value to "noopener-allow-popups".

   4. If parsedItem[1]["report-to"] exists and it is a string, then set policy's reporting endpoint to parsedItem[1]["report-to"].

5. Set parsedItem to the result of getting a structured field value given `Cross-Origin-Opener-Policy-Report-Only` and "item" from response's header list.

6. If parsedItem is not null and parsedItem[0] is a token:

   1. If parsedItem[0] is "same-origin":

      1. Let coep be the result of obtaining a cross-origin embedder policy from response and reservedEnvironment.

      2. If coep's value is compatible with cross-origin isolation or coep's report-only value is compatible with cross-origin isolation, then set policy's report-only value to "same-origin-plus-COEP".

         Report only COOP also considers report-only COEP to assign the special "same-origin-plus-COEP" value. This allows developers more freedom in the order of deployment of COOP and COEP.

      3. Otherwise, set policy's report-only value to "same-origin".

   2. If parsedItem[0] is "same-origin-allow-popups", then set policy's report-only value to "same-origin-allow-popups".

   3. If parsedItem[1]["report-to"] exists and it is a string, then set policy's report-only reporting endpoint to parsedItem[1]["report-to"].

7. Return policy.

To check if popup COOP values require a browsing context group switch, given two origins responseOrigin and activeDocumentNavigationOrigin, and two opener policy values responseCOOPValue and activeDocumentCOOPValue:

1. If responseCOOPValue is "noopener-allow-popups", then return true.

2. If all of the following are true:

   • activeDocumentCOOPValue is "same-origin-allow-popups" or "noopener-allow-popups"; and

   • responseCOOPValue is "unsafe-none",

   then return false.

3. If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, responseCOOPValue, and responseOrigin is true, then return false.

4. Return true.

To check if COOP values require a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin and activeDocumentNavigationOrigin, and two opener policy values responseCOOPValue and activeDocumentCOOPValue:

1. If isInitialAboutBlank is true, then return the result of checking if popup COOP values requires a browsing context group switch with responseOrigin, activeDocumentNavigationOrigin, responseCOOPValue, and activeDocumentCOOPValue.

2. Here we are dealing with a non-popup navigation.

   If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, responseCOOPValue, and responseOrigin is true, then return false.

3. Return true.

To check if enforcing report-only COOP would require a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin, activeDocumentNavigationOrigin, and two opener policies responseCOOP and activeDocumentCOOP:

1. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's report-only value, and activeDocumentCOOP's report-only value is false, then return false.

   Matching report-only policies allows a website to specify the same report-only opener policy on all its pages and not receive violation reports for navigations between these pages.

2. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's value, and activeDocumentCOOP's report-only value is true, then return true.

3. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's report-only value, and activeDocumentCOOP's value is true, then return true.

4. Return false.

To enforce a response's opener policy, given a browsing context browsingContext, a URL responseURL, an origin responseOrigin, an opener policy responseCOOP, an opener policy enforcement result currentCOOPEnforcementResult, and a referrer referrer:

1. Let newCOOPEnforcementResult be a new opener policy enforcement result with

   needs a browsing context group switch

   currentCOOPEnforcementResult's needs a browsing context group switch

   would need a browsing context group switch due to report-only

   currentCOOPEnforcementResult's would need a browsing context group switch due to report-only

   url

   responseURL

   origin

   responseOrigin

   opener policy

   responseCOOP

   current context is navigation source

   true

2. Let isInitialAboutBlank be browsingContext's active document's is initial about:blank.

3. If isInitialAboutBlank is true and browsingContext's initial URL is null, set browsingContext's initial URL to responseURL.

4. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, currentCOOPEnforcementResult's origin, responseCOOP's value, and currentCOOPEnforcementResult's opener policy's value is true:

   1. Set newCOOPEnforcementResult's needs a browsing context group switch to true.

   2. If browsingContext's group's browsing context set's size is greater than 1:

      1. Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "enforce", responseURL, currentCOOPEnforcementResult's url, currentCOOPEnforcementResult's origin, responseOrigin, and referrer.

      2. Queue a violation report for browsing context group switch when navigating away from a COOP response with currentCOOPEnforcementResult's opener policy, "enforce", currentCOOPEnforcementResult's url, responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and currentCOOPEnforcementResult's current context is navigation source.

5. If the result of checking if enforcing report-only COOP would require a browsing context group switch given isInitialAboutBlank, responseOrigin, currentCOOPEnforcementResult's origin, responseCOOP, and currentCOOPEnforcementResult's opener policy is true:

   1. Set newCOOPEnforcementResult's would need a browsing context group switch due to report-only to true.

   2. If browsingContext's group's browsing context set's size is greater than 1:

      1. Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "reporting", responseURL, currentCOOPEnforcementResult's url, currentCOOPEnforcementResult's origin, responseOrigin, and referrer.

      2. Queue a violation report for browsing context group switch when navigating away from a COOP response with currentCOOPEnforcementResult's opener policy, "reporting", currentCOOPEnforcementResult's url, responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and currentCOOPEnforcementResult's current context is navigation source.

6. Return newCOOPEnforcementResult.

To obtain a browsing context to use for a navigation response, given navigation params navigationParams:

1. Let browsingContext be navigationParams's navigable's active browsing context.

2. If browsingContext is not a top-level browsing context, then return browsingContext.

3. Let coopEnforcementResult be navigationParams's COOP enforcement result.

4. Let swapGroup be coopEnforcementResult's needs a browsing context group switch.

5. Let sourceOrigin be browsingContext's active document's origin.

6. Let destinationOrigin be navigationParams's origin.

7. If sourceOrigin is not same site with destinationOrigin:

   1. If either of sourceOrigin or destinationOrigin have a scheme that is not an HTTP(S) scheme and the user agent considers it necessary for sourceOrigin and destinationOrigin to be isolated from each other (for implementation-defined reasons), optionally set swapGroup to true.

      For example, if a user navigates from about:settings to https://example.com, the user agent could force a swap.

      Issue #10842 tracks settling on an interoperable behavior here, instead of letting this be optional.

   2. If navigationParams's user involvement is "browser UI", optionally set swapGroup to true.

      Issue #6356 tracks settling on an interoperable behavior here, instead of letting this be optional.

8. If browsingContext's group's browsing context set's size is 1, optionally set swapGroup to true.

   Some implementations swap browsing context groups here for performance reasons.

   The check for other contexts that could script this one is not sufficient to prevent differences in behavior that could affect a web page. Even if there are currently no other contexts, the destination page could open a window, then if the user navigates back, the previous page could expect to be able to script the opened window. Doing a swap here would break that use case.

9. If swapGroup is false:

   1. If coopEnforcementResult's would need a browsing context group switch due to report-only is true, set browsingContext's virtual browsing context group ID to a new unique identifier.

   2. Return browsingContext.

10. Let newBrowsingContext be the first return value of creating a new top-level browsing context and document.

    In this case we are going to perform a browsing context group swap. browsingContext will not be used by the new Document that we are about to create. If it is not used by other Documents either (such as ones in the back/forward cache), then the user agent might destroy it at this point.

11. Let navigationCOOP be navigationParams's cross-origin opener policy.

12. If navigationCOOP's value is "same-origin-plus-COEP", then set newBrowsingContext's group's cross-origin isolation mode to either "logical" or "concrete". The choice of which is implementation-defined.

    It is difficult on some platforms to provide the security properties required by the cross-origin isolated capability. "concrete" grants access to it and "logical" does not.

13. Let sandboxFlags be a clone of navigationParams's final sandboxing flag set.

14. If sandboxFlags is not empty:

    1. Assert: navigationCOOP's value is "unsafe-none".

    2. Assert: newBrowsingContext's popup sandboxing flag set is empty.

    3. Set newBrowsingContext's popup sandboxing flag set to sandboxFlags.

15. Return newBrowsingContext.

To check if an access between two browsing contexts should be reported, given two browsing contexts accessor and accessed, a JavaScript property name P, and an environment settings object environment:

1. If P is not a cross-origin accessible window property name, then return.

2. Assert: accessor's active document and accessed's active document are both fully active.

3. Let accessorTopDocument be accessor's top-level browsing context's active document.

4. Let accessorInclusiveAncestorOrigins be the list obtained by taking the origin of the active document of each of accessor's active document's inclusive ancestor navigables.

5. Let accessedTopDocument be accessed's top-level browsing context's active document.

6. Let accessedInclusiveAncestorOrigins be the list obtained by taking the origin of the active document of each of accessed's active document's inclusive ancestor navigables.

7. If any of accessorInclusiveAncestorOrigins are not same origin with accessorTopDocument's origin, or if any of accessedInclusiveAncestorOrigins are not same origin with accessedTopDocument's origin, then return.

   This avoids leaking information about cross-origin iframes to a top level frame with opener policy reporting.

8. If accessor's top-level browsing context's virtual browsing context group ID is accessed's top-level browsing context's virtual browsing context group ID, then return.

9. Let accessorAccessedRelationship be a new accessor-accessed relationship with value none.

10. If accessed's top-level browsing context's opener browsing context is accessor or is an ancestor of accessor, then set accessorAccessedRelationship to accessor is opener.

11. If accessor's top-level browsing context's opener browsing context is accessed or is an ancestor of accessed, then set accessorAccessedRelationship to accessor is openee.

12. Queue violation reports for accesses, given accessorAccessedRelationship, accessorTopDocument's opener policy, accessedTopDocument's opener policy, accessor's active document's URL, accessed's active document's URL, accessor's top-level browsing context's initial URL, accessed's top-level browsing context's initial URL, accessor's active document's origin, accessed's active document's origin, accessor's top-level browsing context's opener origin at creation, accessed's top-level browsing context's opener origin at creation, accessorTopDocument's referrer, accessedTopDocument's referrer, P, and environment.

To sanitize a URL to send in a report given a URL url:

1. Let sanitizedURL be a copy of url.

2. Set the username given sanitizedURL and the empty string.

3. Set the password given sanitizedURL and the empty string.

4. Return the serialization of sanitizedURL with exclude fragment set to true.

To queue a violation report for browsing context group switch when navigating to a COOP response given an opener policy coop, a string disposition, a URL coopURL, a URL previousResponseURL, two origins coopOrigin and previousResponseOrigin, and a referrer referrer:

1. If coop's reporting endpoint is null, return.

2. Let coopValue be coop's value.

3. If disposition is "reporting", then set coopValue to coop's report-only value.

4. Let serializedReferrer be an empty string.

5. If referrer is a URL, set serializedReferrer to the serialization of referrer.

6. Let body be a new object containing the following properties:

   key	value
   disposition	disposition
   effectivePolicy	coopValue
   previousResponseURL	If coopOrigin and previousResponseOrigin are same origin this is the sanitization of previousResponseURL, null otherwise.
   referrer	serializedReferrer
   type	"navigation-to-response"

7. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for browsing context group switch when navigating away from a COOP response given an opener policy coop, a string disposition, a URL coopURL, a URL nextResponseURL, two origins coopOrigin and nextResponseOrigin, and a boolean isCOOPResponseNavigationSource:

1. If coop's reporting endpoint is null, return.

2. Let coopValue be coop's value.

3. If disposition is "reporting", then set coopValue to coop's report-only value.

4. Let body be a new object containing the following properties:

   key	value
   disposition	disposition
   effectivePolicy	coopValue
   nextResponseURL	If coopOrigin and nextResponseOrigin are same origin or isCOOPResponseNavigationSource is true, this is the sanitization of nextResponseURL, null otherwise.
   type	"navigation-from-response"

5. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue violation reports for accesses, given an accessor-accessed relationship accessorAccessedRelationship, two opener policies accessorCOOP and accessedCOOP, four URLs accessorURL, accessedURL, accessorInitialURL, accessedInitialURL, four origins accessorOrigin, accessedOrigin, accessorCreatorOrigin and accessedCreatorOrigin, two referrers accessorReferrer and accessedReferrer, a string propertyName, and an environment settings object environment:

1. If accessorAccessedRelationship is accessor is opener:

   1. Queue a violation report for access to an opened window, given accessorCOOP, accessorURL, accessedURL, accessedInitialURL, accessorOrigin, accessedOrigin, accessedCreatorOrigin, propertyName, and environment.

   2. Queue a violation report for access from the opener, given accessedCOOP, accessedURL, accessorURL, accessedOrigin, accessorOrigin, propertyName, and accessedReferrer.

2. Otherwise, if accessorAccessedRelationship is accessor is openee:

   1. Queue a violation report for access to the opener, given accessorCOOP, accessorURL, accessedURL, accessorOrigin, accessedOrigin, propertyName, accessorReferrer, and environment.

   2. Queue a violation report for access from an opened window, given accessedCOOP, accessedURL, accessorURL, accessorInitialURL, accessedOrigin, accessorOrigin, accessorCreatorOrigin, and propertyName.

3. Otherwise:

   1. Queue a violation report for access to another window, given accessorCOOP, accessorURL, accessedURL, accessorOrigin, accessedOrigin, propertyName, and environment.

   2. Queue a violation report for access from another window, given accessedCOOP, accessedURL, accessorURL, accessedOrigin, accessorOrigin, and propertyName.

To queue a violation report for access to the opener, given an opener policy coop, two URLs coopURL and openerURL, two origins coopOrigin and openerOrigin, a string propertyName, a referrer referrer, and an environment settings object environment:

1. If coop's reporting endpoint is null, then return.

2. Let sourceFile, lineNumber, and columnNumber be the relevant script URL and problematic position which triggered this report.

3. Let serializedReferrer be an empty string.

4. If referrer is a URL, set serializedReferrer to the serialization of referrer.

5. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openerURL	If coopOrigin and openerOrigin are same origin, this is the sanitization of openerURL, null otherwise.
   referrer	serializedReferrer
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

6. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access to an opened window, given an opener policy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and openerInitialOrigin, a string propertyName, and an environment settings object environment:

1. If coop's reporting endpoint is null, then return.

2. Let sourceFile, lineNumber, and columnNumber be the relevant script URL and problematic position which triggered this report.

3. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openedWindowURL	If coopOrigin and openedWindowOrigin are same origin, this is the sanitization of openedWindowURL, null otherwise.
   openedWindowInitialURL	If coopOrigin and openerInitialOrigin are same origin, this is the sanitization of initialWindowURL, null otherwise.
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

4. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access to another window, given an opener policy coop, two URLs coopURL and otherURL, two origins coopOrigin and otherOrigin, a string propertyName, and an environment settings object environment:

1. If coop's reporting endpoint is null, then return.

2. Let sourceFile, lineNumber, and columnNumber be the relevant script URL and problematic position which triggered this report.

3. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   otherURL	If coopOrigin and otherOrigin are same origin, this is the sanitization of otherURL, null otherwise.
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

4. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access from the opener, given an opener policy coop, two URLs coopURL and openerURL, two origins coopOrigin and openerOrigin, a string propertyName, and a referrer referrer:

1. If coop's reporting endpoint is null, return.

2. Let serializedReferrer be an empty string.

3. If referrer is a URL, set serializedReferrer to the serialization of referrer.

4. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openerURL	If coopOrigin and openerOrigin are same origin, this is the sanitization of openerURL, null otherwise.
   referrer	serializedReferrer
   type	"access-to-opener"

5. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for access from an opened window, given an opener policy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and openerInitialOrigin, and a string propertyName:

1. If coop's reporting endpoint is null, return.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openedWindowURL	If coopOrigin and openedWindowOrigin are same origin, this is the sanitization of openedWindowURL, null otherwise.
   openedWindowInitialURL	If coopOrigin and openerInitialOrigin are same origin, this is the sanitization of initialWindowURL, null otherwise.
   type	"access-to-opener"

3. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for access from another window, given an opener policy coop, two URLs coopURL and otherURL, two origins coopOrigin and otherOrigin, and a string propertyName:

1. If coop's reporting endpoint is null, return.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   otherURL	If coopOrigin and otherOrigin are same origin, this is the sanitization of otherURL, null otherwise.
   type	access-to-opener

3. Queue body as "coop" for coop's reporting endpoint with coopURL.

Before supporting "credentialless", implementers are strongly encouraged to support both:

• Private Network Access
• Opaque Response Blocking

Otherwise, it would allow attackers to leverage the client's network position to read non public resources, using the cross-origin isolated capability.

An embedder policy value is compatible with cross-origin isolation if it is "credentialless" or "require-corp".

The processing model fails open (by defaulting to "unsafe-none") in the presence of a header that cannot be parsed as a token. This includes inadvertent lists created by combining multiple instances of the `Cross-Origin-Embedder-Policy` header present in a given response:

(The same applies to `Cross-Origin-Embedder-Policy-Report-Only`.)

To obtain an embedder policy from a response response and an environment environment:

1. Let policy be a new embedder policy.

2. If environment is a non-secure context, then return policy.

3. Let parsedItem be the result of getting a structured field value with `Cross-Origin-Embedder-Policy` and "item" from response's header list.

4. If parsedItem is non-null, parsedItem[0] is a token, and parsedItem[0] is compatible with cross-origin isolation:

   1. Set policy's value to parsedItem[0].

   2. If parsedItem[1]["report-to"] exists and it is a string, then set policy's reporting endpoint to parsedItem[1]["report-to"].

5. Set parsedItem to the result of getting a structured field value with `Cross-Origin-Embedder-Policy-Report-Only` and "item" from response's header list.

6. If parsedItem is non-null, parsedItem[0] is a token, and parsedItem[0] is compatible with cross-origin isolation:

   1. Set policy's report-only value to parsedItem[0].

   2. If parsedItem[1]["report-to"] exists and it is a string, then set policy's report-only reporting endpoint to parsedItem[1]["report-to"].

7. Return policy.

To check a navigation response's adherence to its embedder policy given a response response, a navigable navigable, and an embedder policy responsePolicy:

1. If navigable is not a child navigable, then return true.

2. Let parentPolicy be navigable's container document's policy container's embedder policy.

3. If parentPolicy's report-only value is compatible with cross-origin isolation and responsePolicy's value is not, then queue a cross-origin embedder policy inheritance violation with response, "navigation", parentPolicy's report-only reporting endpoint, "reporting", and navigable's container document's relevant settings object.

4. If parentPolicy's value is not compatible with cross-origin isolation or responsePolicy's value is compatible with cross-origin isolation, then return true.

5. Queue a cross-origin embedder policy inheritance violation with response, "navigation", parentPolicy's reporting endpoint, "enforce", and navigable's container document's relevant settings object.

6. Return false.

To check a global object's embedder policy given a WorkerGlobalScope workerGlobalScope, an environment settings object owner, and a response response:

1. If workerGlobalScope is not a DedicatedWorkerGlobalScope object, then return true.

2. Let policy be workerGlobalScope's embedder policy.

3. Let ownerPolicy be owner's policy container's embedder policy.

4. If ownerPolicy's report-only value is compatible with cross-origin isolation and policy's value is not, then queue a cross-origin embedder policy inheritance violation with response, "worker initialization", ownerPolicy's report-only reporting endpoint, "reporting", and owner.

5. If ownerPolicy's value is not compatible with cross-origin isolation or policy's value is compatible with cross-origin isolation, then return true.

6. Queue a cross-origin embedder policy inheritance violation with response, "worker initialization", ownerPolicy's reporting endpoint, "enforce", and owner.

7. Return false.

To queue a cross-origin embedder policy inheritance violation given a response response, a string type, a string endpoint, a string disposition, and an environment settings object settings:

1. Let serialized be the result of serializing a response URL for reporting with response.

2. Let body be a new object containing the following properties:

   key	value
   type	type
   blockedURL	serialized
   disposition	disposition

3. Queue body as the "coep" report type for endpoint on settings.

When the user agent is to parse a sandboxing directive, given a string input and a sandboxing flag set output, it must run the following steps:

1. Split input on ASCII whitespace, to obtain tokens.

2. Let output be empty.

3. Add the following flags to output:

   • The sandboxed navigation browsing context flag.

   • The sandboxed auxiliary navigation browsing context flag, unless tokens contains the allow-popups keyword.

   • The sandboxed top-level navigation without user activation browsing context flag, unless tokens contains the allow-top-navigation keyword.

   • The sandboxed top-level navigation with user activation browsing context flag, unless tokens contains either the allow-top-navigation-by-user-activation keyword or the allow-top-navigation keyword.

     This means that if the allow-top-navigation is present, the allow-top-navigation-by-user-activation keyword will have no effect. For this reason, specifying both is a document conformance error.

   • The sandboxed origin browsing context flag, unless the tokens contains the allow-same-origin keyword.

     The allow-same-origin keyword is intended for two cases.

     First, it can be used to allow content from the same site to be sandboxed to disable scripting, while still allowing access to the DOM of the sandboxed content.

     Second, it can be used to embed content from a third-party site, sandboxed to prevent that site from opening popups, etc, without preventing the embedded page from communicating back to its originating site, using the database APIs to store data, etc.

   • The sandboxed forms browsing context flag, unless tokens contains the allow-forms keyword.

   • The sandboxed pointer lock browsing context flag, unless tokens contains the allow-pointer-lock keyword.

   • The sandboxed scripts browsing context flag, unless tokens contains the allow-scripts keyword.

   • The sandboxed automatic features browsing context flag, unless tokens contains the allow-scripts keyword (defined above).

     This flag is relaxed by the same keyword as scripts, because when scripts are enabled these features are trivially possible anyway, and it would be unfortunate to force authors to use script to do them when sandboxed rather than allowing them to use the declarative features.

   • The sandboxed document.domain browsing context flag.

   • The sandbox propagates to auxiliary browsing contexts flag, unless tokens contains the allow-popups-to-escape-sandbox keyword.

   • The sandboxed modals flag, unless tokens contains the allow-modals keyword.

   • The sandboxed orientation lock browsing context flag, unless tokens contains the allow-orientation-lock keyword.

   • The sandboxed presentation browsing context flag, unless tokens contains the allow-presentation keyword.

   • The sandboxed downloads browsing context flag, unless tokens contains the allow-downloads keyword.

   • The sandboxed custom protocols navigation browsing context flag, unless tokens contains either the allow-top-navigation-to-custom-protocols keyword, the allow-popups keyword, or the allow-top-navigation keyword.

Every CSP list cspList has CSP-derived sandboxing flags, which is a sandboxing flag set. It is the return value of the following algorithm:

1. Let directives be an empty ordered set.

2. For each policy in cspList:

   1. If policy's disposition is not "enforce", then continue.

   2. If policy's directive set contains a directive whose name is "sandbox", then append that directive to directives.

3. If directives is empty, then return an empty sandboxing flag set.

4. Let directive be directives[directives's size − 1].

5. Return the result of parsing the sandboxing directive directive.

To determine the creation sandboxing flags for a browsing context browsing context, given null or an element embedder, return the union of the flags that are present in the following sandboxing flag sets:

• If embedder is null, then the flags set on browsing context's popup sandboxing flag set.

• If embedder is an element, then the flags set on embedder's iframe sandboxing flag set.

• If embedder is an element, then the flags set on embedder's node document's active sandboxing flag set.

To determine the iframe element referrer policy given an element-or-null embedder:

1. If embedder is an iframe element, then return embedder's referrerpolicy attribute's state's corresponding keyword.

2. Return the empty string.

To clone a policy container given a policy container policyContainer:

1. Let clone be a new policy container.

2. For each policy in policyContainer's CSP list, append a copy of policy into clone's CSP list.

3. Set clone's embedder policy to a copy of policyContainer's embedder policy.

4. Set clone's referrer policy to policyContainer's referrer policy.

5. Set clone's integrity policy to a copy of policyContainer's integrity policy.

6. Return clone.

To determine whether a URL url requires storing the policy container in history:

1. If url's scheme is "blob", then return false.

2. If url is local, then return true.

3. Return false.

To create a policy container from a fetch response given a response response and an environment-or-null environment:

1. If response's URL's scheme is "blob", then return a clone of response's URL's blob URL entry's environment's policy container.

2. Let result be a new policy container.

3. Set result's CSP list to the result of parsing a response's Content Security Policies given response.

4. If environment is non-null, then set result's embedder policy to the result of obtaining an embedder policy given response and environment. Otherwise, set it to "unsafe-none".

5. Set result's referrer policy to the result of parsing the `Referrer-Policy` header given response. [REFERRERPOLICY]

6. Parse Integrity-Policy headers with response and result.

7. Return result.

To determine navigation params policy container given a URL responseURL and four policy container-or-nulls historyPolicyContainer, initiatorPolicyContainer, parentPolicyContainer, and responsePolicyContainer:

1. If historyPolicyContainer is not null:

   1. Assert: responseURL requires storing the policy container in history.

   2. Return a clone of historyPolicyContainer.

2. If responseURL is about:srcdoc:

   1. Assert: parentPolicyContainer is not null.

   2. Return a clone of parentPolicyContainer.

3. If responseURL is local and initiatorPolicyContainer is not null, then return a clone of initiatorPolicyContainer.

4. If responsePolicyContainer is not null, then return responsePolicyContainer.

5. Return a new policy container.

To initialize a worker global scope's policy container given a WorkerGlobalScope workerGlobalScope, a response response, and an environment environment:

1. If workerGlobalScope's url is local but its scheme is not "blob":

   1. Assert: workerGlobalScope's owner set's size is 1.

   2. Set workerGlobalScope's policy container to a clone of workerGlobalScope's owner set[0]'s relevant settings object's policy container.

2. Otherwise, set workerGlobalScope's policy container to the result of creating a policy container from a fetch response given response and environment.