Skip to content

Use environments for blob URL access checks #225

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shannonbooth wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Use environments for blob URL access checks #225

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1537,12 +1537,12 @@ an [=empty host=], and a [=url/path=] consisting of one element itself also a [=

<div algorithm="obtainBlobObject">
To <dfn export id=blob-url-obtain-object>obtain a blob object</dfn> given a [=blob URL entry=]
|blobUrlEntry| and an [=environment settings object=], "`top-level-navigation`", or
|blobUrlEntry| and an [=/environment=], "`top-level-navigation`", or
"`top-level-self-fetch`" |environment|, perform the following steps. They return an
[=blob URL entry/object=].

1. Let |isAuthorized| be true.
1. If |environment| is an [=environment settings object=], then set |isAuthorized| to the result of
1. If |environment| is an [=/environment=], then set |isAuthorized| to the result of
[=checking for same-partition blob URL usage=] with |blobUrlEntry| and |environment|.
1. If |isAuthorized| is false, then return failure.
1. Return |blobUrlEntry|'s [=blob URL entry/object=].
Expand Down Expand Up @@ -1626,11 +1626,11 @@ observable though, since a revoked blob URL can't be resolved/fetched anymore an
### Access restrictions on blob URLs ### {#partitioningOfBlobUrls}

<a>Blob URLs</a> can only be fetched from environments where the [=storage key=] matches that of
the environment where the <a>blob URL</a> was created. <a>Blob URL</a> navigations are not subject
to this restriction.
the environment where the <a>blob URL</a> was created. Top-level <a>blob URL</a> navigations are
not subject to this restriction.

<div algorithm="checkForSamePartitionBlobUrlUsage">
To <dfn>check for same-partition blob URL usage</dfn> given a [=blob URL entry=] |blobUrlEntry| and an [=environment settings object=] |environment|, perform the following steps. They return a boolean.
To <dfn>check for same-partition blob URL usage</dfn> given a [=blob URL entry=] |blobUrlEntry| and an [=/environment=] |environment|, perform the following steps. They return a boolean.

1. Let |blobStorageKey| be the result of [=obtaining a storage key for non-storage purposes=] with |blobUrlEntry|'s [=blob URL entry/environment=].
1. Let |environmentStorageKey| be the result of [=obtaining a storage key for non-storage purposes=] with |environment|.
Expand Down