diff --git a/files/en-us/web/security/defenses/secure_contexts/index.md b/files/en-us/web/security/defenses/secure_contexts/index.md index 8e2062c75b6dd2d..3b5fd95bc00b645 100644 --- a/files/en-us/web/security/defenses/secure_contexts/index.md +++ b/files/en-us/web/security/defenses/secure_contexts/index.md @@ -2,11 +2,12 @@ title: Secure contexts slug: Web/Security/Defenses/Secure_Contexts page-type: guide -spec-urls: https://w3c.github.io/webappsec-secure-contexts/ sidebar: security --- -A **secure context** is a `Window` or `Worker` for which certain minimum standards of authentication and confidentiality are met. Many Web APIs and features are accessible only in a secure context. The primary goal of secure contexts is to prevent [manipulator in the middle (MITM)](/en-US/docs/Web/Security/Attacks/MITM) attackers from accessing powerful APIs that could further compromise the victim of an attack. +A **secure context** is an environment such as a `Window` or `Worker` which meets a defined standard of authentication and confidentiality. Many Web APIs and features are accessible only in a secure context. + +The canonical definition of a secure context, along with the rationale for restricting some web platform features to secure contexts, is given in the [Secure Contexts](https://w3c.github.io/webappsec-secure-contexts/) specification. ## Why should some features be restricted? @@ -16,37 +17,83 @@ Some APIs on the web are very powerful, giving an attacker the ability to do the - Get low-level access to a user's computer. - Get access to data such as user credentials. +If these APIs were available to content that was not delivered over a secure connection, then a [manipulator in the middle (MITM)](/en-US/docs/Web/Security/Attacks/MITM) attacker would be able to access them. + ## When is a context considered secure? -A context is considered secure when it meets certain minimum standards of authentication and confidentiality defined in the [Secure Contexts](https://w3c.github.io/webappsec-secure-contexts/) specification. A particular document is considered to be in a secure context when it is the [active document](https://html.spec.whatwg.org/multipage/browsers.html#active-document) of a [top-level browsing context](https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context) (basically, a containing window or tab) that is a secure context. +To a first approximation: -For example, even for a document delivered over TLS within an {{HTMLElement("iframe")}}, its context is **not** considered secure if it has an ancestor that was not also delivered over TLS. +- Documents are secure contexts when their resources are delivered over an [HTTPS](/en-US/docs/Web/Security/Defenses/Transport_Layer_Security) connection, or are delivered from a loopback (local) address. Framed documents must also be embedded in a document which is itself a secure context. -However, it's important to note that if a non-secure context causes a new window to be created (with or without specifying [noopener](/en-US/docs/Web/API/Window/open)), then the fact that the opener was insecure has no effect on whether the new window is considered secure. That's because the determination of whether a particular document is in a secure context is based only on considering it within the top-level browsing context with which it is associated — and not whether a non-secure context happened to be used to create it. +- Workers are secure contexts when they are created by a secure context. -Resources that are not local, to be considered secure, must meet the following criteria: +### Top-level documents -- They must be served over `https://` URLs. -- The security properties of the network channel used to deliver the resource must not be considered deprecated. +Top-level documents provide a secure context when their URL is a [potentially trustworthy URL](#potentially_trustworthy_urls). -## Potentially trustworthy origins +For example: + +| URL | Secure | +| ------------------------------- | --------------------------- | +| `https://example.com` | ✅ Secure (`https` URL) | +| `http://localhost` | ✅ Secure (`localhost` URL) | +| `file:///path/to/resource.html` | ✅ Secure (`file` URL) | +| `https://example.com` | ❌ Not secure (`http` URL) | + +### Framed documents + +Documents in an {{htmlelement("iframe")}} provide a secure context when they are delivered from a [potentially trustworthy URL](#potentially_trustworthy_urls), and are themselves embedded in a secure context. + +The means that if a top-level document from `http://example.com` embeds an `