@@ -161,6 +161,14 @@ Origin: An origin in browser products is the compound of the scheme, host and po
Same-origin policy: A security model in browser products used to determine whether assets and state should be shared or not between web page execution contexts.
Powerful Web Platform Feature: A web platform feature (usually an API) the web browser provides to a website that directly exposes: video capture, audio capture, location information, filesystem contents, clipboard contents, the host operating system, external applications, screen contents, system notifications, connected peripherals, local network services, Personally Identifiable Information, or other such highly sensitive data or capabilities.
Secure Context: As defined by http://w3c.github.io/webappsec-secure-contexts/
<mark>Editor's note: What constitutes a secure context is pretty nuanced, so ideally we'd be able to reference this spec. The definition is used in [REQ-PWR-INT-2]</mark>
Browser Profile: private browsing sessions, temporary guest profiles, or profiles that may be used for separating principals or use-cases.
## 3.2 Symbols
For the purposes of the present document, the [following] symbols [given in ... and the following] apply:
@@ -436,6 +444,10 @@ Example: The extension execution process runs with the least amount of operating
<mark>Editor's note: Content scripts can be run in different ways, eg Chrome's isolated worlds vs Firefox's xray-vision. Open question if text change needed due to different ways of handling this where "isolated" maybe isn't the all encompassing term.</mark>
**[REQ-PWR-SBD-1]** Web browsers shall provide a mechanism for users to select the default behaviour when a webpage wishes to use a given Powerful Web Platform Feature, which shall at least include denying by default.
**[REQ-PWR-SBD-2]** The web browser may support enterprise or parental policy controls that allow administrators to alter how access to Powerful Web Platform Features is controlled.
## 5.4 Secure Updates
Proposed ESR code: SU
@@ -489,6 +501,10 @@ Example: Web pages may load images from other origins, message using `window.pos
<mark>Editor's note: need to add examples for cross domain storage access is allowed, etc.</mark>
**[REQ-PWR-AAC-1]** The web browser shall require express user permission before exposing data via Powerful Web Platform Features.
**[REQ-PWR-AAC-2]** The web browser shall allow the user to limit the grant of a Powerful Web Platform Feature to the current browsing session. The web browser may allow the user to persist the user's decision for future browsing sessions.
## 5.6 Confidentiality
Proposed ESR code: CON
@@ -544,6 +560,10 @@ Note: TLS-related clauses contribute to integrity.
**[REQ-EXT-INT-1]**: The product shall cryptographically verify extensions before installation and update.
**[REQ-PWR-INT-1]** The web browser shall protect permission prompts against manipulation by the webpage.
**[REQ-PWR-INT-2]** The web browser shall only enable Powerful Web Platform Features to Secure Contexts.
## 5.8 Data Minimisation
Proposed ESR code: DM
@@ -552,6 +572,13 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
Note: TLS-related clauses contribute to data minimization.
**[REQ-PWR-DM-1]** Powerful Web Platform Feature permissions shall be origin-scoped by default, with broader scoping permitted only via express user action (e.g. in settings), or opt-in by the origins.
**[REQ-PWR-DM-2]** Powerful Web Platform Feature permissions decisions shall apply to each Browser Profile separately.
**[REQ-PWR-DM-3]** Web browsers shall provide users with the ability to grant granular permission to Powerful Web Platform Features.
Note: This shall not prevent web browsers from bundling permission prompts when appropriate (e.g. video and microphone when used by a video conferencing website).
## 5.9 Availability Protection
@@ -585,6 +612,8 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
<mark>Editor's note: Discussion around this was not concluded. HAS did not like asking for technical docs. Sam raised asking for user docs instead. Andrew suggested that in some circumstances it's not needed at all, eg explicit cooperation between client and server. Daniel E had concerns about lowering the bar even in cooperation contexts.</mark>
**[REQ-PWR-IM-1]** The web browser shall implement a permissions policy framework that allows a top-level website to selectively limit or delegate to embedded iframes the Powerful Web Platform Features it has been granted access to.
## 5.11 Minimisation of Attack Surfaces
Proposed ESR code: MAS
@@ -648,6 +677,8 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
**[REQ-STORE-LOG-1]** The product shall provide an interface for viewing information about stored data at a granularity of site or narrower (e.g., origin).
**[REQ-PWR-LOG-1]** The web browser shall provide a user interface listing the Powerful Web Platform Features granted or denied to the web page being displayed.
## 5.14 Data Removal and Transparency
Proposed ESR code: DRT
@@ -665,6 +696,8 @@ Applicability: Web browsers which allow changing TLS-related settings.
**[REQ-STORE-DRT-3]** The product shall have an interface for deleting storage at a granularity of site or narrower (e.g., origin).
**[REQ-PWR-DRT-1]** The web browser shall provide a user interface allowing revocation of previously granted permissions for Powerful Web Platform Features.
## 5.15 Vulnerability Handling
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 2.
