WW-5085: Add Cross-Origin Opener Policy (COOP) and Cross-Origin Embedder Policy (COEP) support #432
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello Struts Devs!
This PR adds Cross-Origin Opener Policy (COOP) and Cross-Origin Embedder Policy (COEP) support for Struts2. Two very popular mitigations that aim to make a website cross-origin isolated.
COOP is a security mitigation that lets developers isolate their resources against side-channel attacks and information leaks. COEP prevents a document from loading any non-same-origin resources which don't explicitly grant the document permission to be loaded. Both COOP and COEP require adding headers to the response object.
COOP and COEP are independent mechanisms and they can be enabled, tested and deployed separately. Using COEP and COOP together allows developers to safely use powerful features such as
SharedArrayBuffer
,performance.measureMemory()
, and the JS Self-Profiling API. COOP and COEP are now supported by all major browsers. See https://web.dev/why-coop-coep/ for reference.Here's a summary of the changes made:
CoopInterceptor
andCoepInterceptor
, that handle adding the response headers for the respective security mitigation. Both were added in the default stack ofstruts-default.xml
CoopInterceptor
, developers have the ability to choose the policy they want COOP to operate with (same-origin
,same-origin-allow-popups
, orunsafe-none
), set tosame-origin
by default. An exception is thrown if another policy other than the specified 3 is chosenCoepInterceptor
, developers have the ability to choose between the two modes they want COEP to operate under: enforcing mode (header set asCross-Origin-Embedder-Policy
) which blocks resources and reports violation, and reporting mode (header set asCross-Origin-Embedder-Policy-Report-Only
) which only reports the violation without blocking resources.Here is how developers can customize the interceptors in
struts.xml
: