Security/Features: Difference between revisions

= Status Overview =

= Projects =

This is intended to summarize the status and basic goals of each project, and not serve as an ultimate authority on each of the features.   

== Origin Header / Sec-From ==

Beginning as an [[Security/Origin]] header that aimed to prevent clickjacking as well as CSRF and JSON data theft, this feature has evolved into [[Security/Sec-From]] that will not prevent clickjacking, but can be compatible with various other specifications for similar HTTP request headers.

* {{done|get feedback (rinse, repeat) until comments are trivial}}

* {{done|come to decision about whether or not to support meta tags (not supporting)}}

'''Review and Standardization''': In Progress.  ETA: ?

* {{done|make patch to report policy violations}}

* {{done|make patch to implement base restriction enforcements}}

* {{ok|create document explaining how to write a good policy}}

* {{ok|create document explaining how to convert a site to support CSP}}

Tasks:

'''Prototype''': Done.  (6/2009)

* {{done|submit to AMO for screening and public dissemination}}

Tasks:

== Process Isolation ==

'''Design''': In Process.

''Goals''

* Create infrastructure to allow process separation within Firefox

* Create separate content processes for stability and performance reasons

* Implemented isolated processes to reduce the damage for various types of vulnerabilities

* {{done|[[Electrolysis#Phase_I:_Bootstrap|Phase 1 (bootstrap)]]}}

* {{done|[[IPC_Protocols]] design}}

* {{ok|[[Electrolysis#Phase_IV:_Multiple_content_processes|Phase 4 (Multiple content processes)]]}}

* {{done|Develop [[Security/ProcessIsolation/ThreatModel|threat model]]}}

'''Prototype''': In Process.

* [[Content_Processes/Build|Build Instructions for Prototype]]