Merge branch 'req-storage' into 'main_publish'

<mark>Editor's Note: Proposal to put together a common term sheet for all verticals developed in CYBER-EUSR.</mark>

browser profiles: private browsing sessions, temporary guest profiles or user managed profiles that may be used for separating principals or use-cases

effective Top-Level Domain: a domain suffix, under which independent tenants may register subdomains

public suffix list: list of all eTLDs

registrable domain: subdomain exactly one level below an eTLD, such that the domain and all further sub-domains are registered to a single tenant

site: logical security boundary defined by scheme and registrable domain

third-party cookies: cookies keyed to a site other than the top-level site

Origin: An origin in browser products is the compound of the scheme, host and port of a web resource. When a web resource defined as valid in the user documentation cannot be formed into a meaningful combination of host, scheme and port, the product constructs a synthetic origin uniquely identifying the resource.

Same-origin policy: A security model in browser products used to determine whether assets and state should be shared or not between web page execution contexts.

`CRA   Cyber Resilience Act`  

`CVE   Common Vulnerabilities and Exposures`  

`DB    Database`  

`eTLD  Effective Top-level Domain`

`EDR   Endpoint Detection and Response`  

`DHCP  Dynamic Host Configuration Protocol`  

`GDPR  General Data Protection Regulation`  

- Professionals in all fields of work

- Workers in critical infrastructure

- Users with accessibility needs

## 4.6 Use Cases

### 4.6.1 Standalone browser use cases

**[REQ-EXT-SU-1]**: The product shall support automatic updates of extensions, and before installing an update shall cryptographically verify the update.

**[REQ-STORE-SU-1]** The product shall maintain the validity of data stored to disk across updates.

**[REQ-STORE-SU-2]** The product shall update the Public Suffix List regularly.

## 5.5 Authentication and access control

Proposed ESR code: AAC

**[REQ-EXT-AAC-6]**: The product shall ensure isolation between the execution and data contexts of different extensions.

**[REQ-STORE-ACC-1]** The product shall store data and enforce access according to the Same Origin Policy.

**[REQ-STORE-ACC-2]** The product shall not share or make data available across browser profiles.

**[REQ-SOP-AAC-1]**: The product shall deny access in one origin to all parts of another origin, except as defined in the user documentation.

Example: Web pages may load images from other origins, message using `window.postMessage` and may access limited properties such as `Location`. Web pages may not access the document object model or global Window scope from scripts of other origins. The user documentation references industry standards with implementation recommendations and additinal examples.

**[REQ-EXT-CON-1]**: The product shall prevent secrets stored by extensions from being read by other extensions or by web content.

**[REQ-STORE-CON-1]** The product shall not send third-party cookies by default. They may be supported consistent with the `Partitioned` attribute.

NOTE: The product can provide users the ability to share third-party cookies, whether on a case-by-case basis through interaction as in Storage Access API or throughout their browser profile through configuration.

**[REQ-STORE-CON-2]** The product shall make use of OS access control, encryption methods or other mechanisms to ensure confidentiality of disk-stored data.

**[REQ-STORE-CON-3]** The product shall store browser cache data such that they are keyed to both top-level site and resource.

**[REQ-SOP-CON-1]**: The product shall only allow scripts to access the body of a cross-origin HTTP response where the source origin has opted to allow access by the requesting origin.

Example: Implementation of Cross-Origin Resource Sharing (CORS)

<mark>Editor's note: Need conclusion wrt this being about page state such as scroll position, form data or storage or unspecific or more specific.</mark>

**[REQ-STORE-AVA-1]** The product shall retain data stored to disk in case of a crash and make it available upon browser restart.

## 5.10 Impact Minimisation

Proposed ESR code: IM

**[REQ-EXT-LOG-1]**: The product shall provide the user the ability to identify running extensions, and to observe their activity.

**[REQ-STORE-LOG-1]** The product shall provide an interface for viewing information about stored data at a granularity of site or narrower (e.g., origin).

## 5.14 Data Removal and Transparency

Proposed ESR code: DRT

**[REQ-EXT-DRT-1]**: The product shall enable the removal of individual extensions, which shall delete all data associated with the extension, and revoke all permissions granted to it.

**[REQ-STORE-DRT-1]** The product shall ensure when storage data is deleted, it uses appropriate APIs that ensure the data is deleted from the underlying storage device.

**[REQ-STORE-DRT-2]** The product shall provide reset functionality that removes all stored data across all sites and browser profiles.

**[REQ-STORE-DRT-3]** The product shall have an interface for deleting storage at a granularity of site or narrower (e.g., origin).

## 5.15 Vulnerability Handling

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 2.