HTML5: Insecure Cross-Origin Opener Policy

Python

Abstract

このプログラムは、過度に許容的な Cross-Origin Opener Policy (COOP) を定義します

Explanation

Spectre や Meltdown などの脆弱性に起因するサイドチャネル攻撃により、特定の Web ドキュメントのデータプライバシーを強化することが重要になっています。Cross-Origin Opener Policy (COOP) は、サイドチャネル攻撃による機密情報の漏洩を防ぐために作成されました。具体的には、COOP は、ポップアップなどの他の外部ドキュメントに関して、ドキュメントのブラウジングコンテキストグループの分離を強制できます。

例 1: 次のコードは、Django フレームワークにおける安全でない COOP 設定「unsafe-none」を示しています。これにより、サイドチャネル攻撃が発生したときに、外部ドキュメントがソースドキュメントのブラウジングコンテキストグループのプライベートデータにアクセスできてしまう場合があります。


SECURE_CROSS_ORIGIN_OPENER_POLICY = 'unsafe-none'

References

[1] Eiji Kitamura, Domenic Denicola Why you need "cross-origin isolated" for powerful features

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3.0

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.0

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 3

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[6] Standards Mapping - Common Weakness Enumeration CWE ID 346

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001368, CCI-001414

[8] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[9] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1)

[10] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement

[11] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[12] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[13] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[14] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.5.3 Token-based Session Management (L2 L3), 5.3.6 Output Encoding and Injection Prevention Requirements (L1 L2 L3), 14.5.2 Validate HTTP Request Header Requirements (L1 L2 L3), 14.5.3 Validate HTTP Request Header Requirements (L1 L2 L3)

[16] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[24] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective C.3.6 - Web Software Attack Mitigation

[25] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[39] Standards Mapping - Web Application Security Consortium Version 2.00 Abuse of Functionality (WASC-42)

desc.structural.python.html5_insecure_cross_origin_opener_policy