Cross-Origin iFrame - Revision history

Tom: /* Federated Learning of Cohorts */

2024-08-14T17:51:21Z

‎Federated Learning of Cohorts

Tom: /* Legacy security Headers */

2024-03-25T20:51:54Z

‎Legacy security Headers

Tom: /* Legacy security Headers */

2024-03-25T20:51:00Z

‎Legacy security Headers

Tom: /* Legacy security Headers */

2024-03-25T20:49:19Z

‎Legacy security Headers

Tom: /* Legacy security Headers */

2024-03-25T20:48:16Z

‎Legacy security Headers

Tom: /* Legacy security Headers */

2024-03-25T20:47:39Z

‎Legacy security Headers

Tom: /* Problems */

2022-08-05T02:26:05Z

‎Problems

Tom: /* Taxonomy */

2022-07-27T02:02:56Z

‎Taxonomy

Tom: /* Taxonomy */

2022-06-20T20:12:01Z

‎Taxonomy

Tom: /* Taxonomy */

2022-06-20T20:11:25Z

‎Taxonomy

@@ Line 91: / Line 91: @@
 * [https://wccftech.com/google-commits-to-not-tracking-individual-users-for-ad-targeting-after-cookie-phase-out/ Google Commits To Not Tracking Individual Users For Ad Targeting After Cookie Phase Out] This paper is a regurgitation of Google's PR. 2021-03-03
 * [https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea Google's FLoC Is a Terrible Idea] per the Electronic Frontier Foundation Bennet Cyphers 2021-03-03
-* [https://www.wired.com/story/google-floc-age-privacy-theater Google and the Age of Privacy Theater] Wired 2021-03-18 The demise of surveillance capitalism has been greatly exaggerated.
+* [https://www.wired.com/story/google-floc-age-privacy-theater Google and the Age of Privacy Theater] Wired 2021-03-18 The demise of [[Surveillance]] capitalism has been greatly exaggerated.
 ===Elimination of Third-Party Cookies===

@@ Line 115: / Line 115: @@
 ===Legacy security Headers===
-# HTTP Strict Transport Security (HSTS) - everybody should do this. If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.  See wiki site [[TLS#HST|TLS HST]]
+# HTTP Strict Transport Security (HSTS) - everybody should do this. If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.  See wiki site [[TLS#HSTS|TLS HSTS]]
 # Content Security Policy (CSP) - help protect against XSS, but not foolproof.
 # Cross Site Scripting Protection (X-XSS) - The browser filter doesn’t let the page load when it detects a cross-site scripting attack.

@@ Line 115: / Line 115: @@
 ===Legacy security Headers===
-# HTTP Strict Transport Security (HSTS) - everybody should do this. If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.  See wiki site [[TLS#HSTS]]
+# HTTP Strict Transport Security (HSTS) - everybody should do this. If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.  See wiki site [[TLS#HST|TLS HST]]
 # Content Security Policy (CSP) - help protect against XSS, but not foolproof.
 # Cross Site Scripting Protection (X-XSS) - The browser filter doesn’t let the page load when it detects a cross-site scripting attack.

@@ Line 115: / Line 115: @@
 ===Legacy security Headers===
-# HTTP Strict Transport Security (HSTS) - everybody should do this. If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.  See wiki site [[TLS#HSTS(HTTP_Strict_Transport_Security)]]
+# HTTP Strict Transport Security (HSTS) - everybody should do this. If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.  See wiki site [[TLS#HSTS]]
-# Content Security Policy (CSP) - help protect agains XSS, but not foolproof.
+# Content Security Policy (CSP) - help protect against XSS, but not foolproof.
 # Cross Site Scripting Protection (X-XSS) - The browser filter doesn’t let the page load when it detects a cross-site scripting attack.
 # X-Frame-Options to block 'Clickjacking'

@@ Line 115: / Line 115: @@
 ===Legacy security Headers===
-# HTTP Strict Transport Security (HSTS) - everybody should do this. If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.  See wiki site [[TLS#HSTS(HTTP_Strict_Transport_Security)]
+# HTTP Strict Transport Security (HSTS) - everybody should do this. If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.  See wiki site [[TLS#HSTS(HTTP_Strict_Transport_Security)]]
 # Content Security Policy (CSP) - help protect agains XSS, but not foolproof.
 # Cross Site Scripting Protection (X-XSS) - The browser filter doesn’t let the page load when it detects a cross-site scripting attack.

@@ Line 28: / Line 28: @@
 ==Problems==
 * The user has no real control over the [[JavaScript]] that is embedded in the HTML pages that are loaded by a web site onto the browser running on their computer.
-* Advertisers have exploited the iframe and cookies to track users across multiple origin sites.
+* Advertisers have exploited the iFrame and cookies to track users across multiple origin sites.
 * The user is somewhat at the mercy of the web site in that the site is more interested in gaining users than in their security.
 * Limitations that have been placed on iFrames can (with the exception of running plugins) be disabled by the source web site which does not fully share the user's security concerns.
@@ Line 35: / Line 35: @@
 # Change the parent web page’s URL - disabled by allow-top-navigation
 # Read cookies or local storage, even if it’s from the parent domain
-# Open new tabs, new windows or pop-up windows - partially disabled by allow-popups
+# Open new tabs, new windows or [[Pop-up Window]]s - partially disabled by allow-popups
-# Run any JavaScript (even if it would only impact what’s inside the iframe) - disabled by allow-scripts.
+# Run any JavaScript (even if it would only impact what’s inside the iFrame) - disabled by allow-scripts.
 # Access data from Origin URL - allow-same-origin

@@ Line 10: / Line 10: @@
 * DOM = Document Object Model resident in a "window" object in an HTML based user agent (typically a browser).
 * [https://html.spec.whatwg.org/multipage/origin.html#coep COEP: Cross Origin Embedder Policy]
-* [https://html.spec.whatwg.org/multipage/origin.html#cross-origin-opener-policies COOP: Cross Origin Opener Policy]
+* [https://html.spec.whatwg.org/multipage/origin.html#cross-origin-opener-policies COOP: Cross Origin Opener Policy] - a [https://github.com/hemeryar/explainers/blob/main/coop_restrict_properties.md softening of this policy was proposed] (2022-07-26)
 * [https://developer.mozilla.org/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP) CORP: Cross Origin Resource Policy]
 * [https://developer.mozilla.org/docs/Web/HTTP/CORS CORS: Cross Origin Resource Sharing]

@@ Line 13: / Line 13: @@
 * [https://developer.mozilla.org/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP) CORP: Cross Origin Resource Policy]
 * [https://developer.mozilla.org/docs/Web/HTTP/CORS CORS: Cross Origin Resource Sharing]
-* [https://www.chromium.org/Home/chromium-security/corb-for-developers CORB: Cross Origin Read Blocking] which (2022) is being replaces the ORB = Opaque Response Blocking.For more information please see https://www.chromium.org/Home/chromium-security/corb-for-developers.
+* [https://www.chromium.org/Home/chromium-security/corb-for-developers CORB: Cross Origin Read Blocking] which (2022) is being replaces by ORB = Opaque Response Blocking.For more information please see https://www.chromium.org/Home/chromium-security/corb-for-developers.
 * Sandbox is an iFrame attribute that contains the properties listed below.
 * Same Domain policy, as used above, has been replaced by policy on the same  [https://javascript.info/cross-window-communication origin and site]. A domain is the part after the scheme e,g, www.example.com.