From bed2e42a83644404ae4141d0cda2b8767f2398e8 Mon Sep 17 00:00:00 2001 From: wbamberg Date: Fri, 4 Sep 2026 16:30:18 -0700 Subject: [PATCH 01/11] Update secure contexts guide --- .../defenses/secure_contexts/index.md | 86 ++++++++++++++----- 1 file changed, 64 insertions(+), 22 deletions(-) diff --git a/files/en-us/web/security/defenses/secure_contexts/index.md b/files/en-us/web/security/defenses/secure_contexts/index.md index 8e2062c75b6dd2d..77ab7c302db23c5 100644 --- a/files/en-us/web/security/defenses/secure_contexts/index.md +++ b/files/en-us/web/security/defenses/secure_contexts/index.md @@ -2,11 +2,12 @@ title: Secure contexts slug: Web/Security/Defenses/Secure_Contexts page-type: guide -spec-urls: https://w3c.github.io/webappsec-secure-contexts/ sidebar: security --- -A **secure context** is a `Window` or `Worker` for which certain minimum standards of authentication and confidentiality are met. Many Web APIs and features are accessible only in a secure context. The primary goal of secure contexts is to prevent [manipulator in the middle (MITM)](/en-US/docs/Web/Security/Attacks/MITM) attackers from accessing powerful APIs that could further compromise the victim of an attack. +A **secure context** is an environment such as a `Window` or `Worker` which meets a defined standard of authentication and confidentiality. Many Web APIs and features are accessible only in a secure context. + +The canonical definition of a secure context, along with the rationale for restricting some web platform features to secure contexts, is given in the [Secure Contexts](https://w3c.github.io/webappsec-secure-contexts/) specification. ## Why should some features be restricted? @@ -16,37 +17,83 @@ Some APIs on the web are very powerful, giving an attacker the ability to do the - Get low-level access to a user's computer. - Get access to data such as user credentials. +If these APIs were available to content that was not delivered over a secure connection, then a [manipulator in the middle (MITM)](/en-US/docs/Web/Security/Attacks/MITM) attacker would be able to access them. + ## When is a context considered secure? -A context is considered secure when it meets certain minimum standards of authentication and confidentiality defined in the [Secure Contexts](https://w3c.github.io/webappsec-secure-contexts/) specification. A particular document is considered to be in a secure context when it is the [active document](https://html.spec.whatwg.org/multipage/browsers.html#active-document) of a [top-level browsing context](https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context) (basically, a containing window or tab) that is a secure context. +To a first approximation, a window context is secure when its document was delivered over an [HTTPS](/en-US/docs/Web/Security/Defenses/Transport_Layer_Security) connection, or it is delivered from a loopback (local) address. A worker context is secure when it was created by a secure context. -For example, even for a document delivered over TLS within an {{HTMLElement("iframe")}}, its context is **not** considered secure if it has an ancestor that was not also delivered over TLS. +### Top-level documents -However, it's important to note that if a non-secure context causes a new window to be created (with or without specifying [noopener](/en-US/docs/Web/API/Window/open)), then the fact that the opener was insecure has no effect on whether the new window is considered secure. That's because the determination of whether a particular document is in a secure context is based only on considering it within the top-level browsing context with which it is associated — and not whether a non-secure context happened to be used to create it. +Top-level documents provide a secure context when their URL is a [potentially trustworthy URL](#potentially_trustworthy_urls). -Resources that are not local, to be considered secure, must meet the following criteria: +For example: -- They must be served over `https://` URLs. -- The security properties of the network channel used to deliver the resource must not be considered deprecated. +| URL | Secure context | +| ------------------------------- | -------------- | +| `https://example.com` | Secure | +| `http://localhost` | Secure | +| `file:///path/to/resource.html` | Secure | +| `https://example.com` | Not secure | -## Potentially trustworthy origins +### Framed documents + +Documents in an {{htmlelement("iframe")}} provide a secure context when they are delivered from a [potentially trustworthy origin](#potentially_trustworthy_origins), and are themselves embedded in a secure context. + +The means that if a top-level document from `http://example.com` embeds an `