Security/Features

This page lists the security features under development and our plans for deployment.

Status Overview

Feature	Goals	Design	Discussion	Review & Standards	Prototype	Implementation
Sec-From	Done	Done	In Progress
CSP	Done (2/2009)	Done (5/2009)	In Progress		In Progress	In Progress
ForceTLS	Done	In Progress	Done (5/2009)		Done (6/2009)	In Progress
Process Isolation	Done	In Progress	In Progress		In Progress

Projects

This is intended to summarize the status and basic goals of each project, and not serve as an ultimate authority on each of the features.

Origin Header / Sec-From

Beginning as an Security/Origin header that aimed to prevent clickjacking as well as CSRF and JSON data theft, this feature has evolved into Security/Sec-From that will not prevent clickjacking, but can be compatible with various other specifications for similar HTTP request headers.

Design: Done (6/18/2009)

Discussion over the behavior and uses of Sec-From has been ongoing, but has merged with the Internet Draft spec proposed by Adam Barth et. al [1].

Header is also mentioned in HTML 5 [2].

Goals:

• Provide a reliably present "referrer" that
  • has minimal potential for privacy leak
  • reflects all redirects participating in the request
• aid in detecting CSRF attempts
• aid in preventing JSON data theft

Discussion: In Progress

We've synced up with Adam Barth and settled on a design. He is working with the CORS folks to see if his proposal can be unified with the Origin header they send.

http://lists.w3.org/Archives/Public/public-webapps/2009JanMar/0057.html

discussion about renaming from "Origin"

Review and Standardization: In Progress. ETA: ?

Prototype: Not Started. ETA: Q4 2009

Implementation: Not Started. ETA: ?

Content Security Policy

Design: In Progress. ETA: Q3 2009

Content Security Policy is intended to mitigate a large class of Web Application Vulnerabilities including Cross Site Scripting.

The CSP spec has been iterated upon many times and is approaching a stable configuration.

Goals

• (Primary) Mitigate Cross Site Scripting (XSS)
• Mitigate Clickjacking
• Mitigate Packet Sniffing Attacks
• Backward Compatibility with sites not employing CSP

Discussion: In Progress.

Public discussion of the CSP design and specification has taken place in mozilla.dev.security. CSP is generally discussed as a good idea, and the discussion has evolved into a compatibility, deployment and small edge-case discussion.

Review and Standardization: In Progress. ETA: ?

Appropriate paths for standardization and external review are being explored.

Prototype: Done. (8/2008)

Prototype implementation was completed in August 2008. It implements an old version of CSP and does not provide the base restrictions.

Implementation: In Progress. ETA: Q3 2009 CSP as specified is being implemented on mozilla-central and is aimed for landing in Q3 2009. It can be followed in bug 493857.

ForceTLS

Design: Done (6/18/2009)

Goals

Discussion: ?

Review and Standardization: In Progress. ETA: ?

Prototype: Not Started. ETA: Q4 2009

Implementation: Not Started. ETA: ?

Process Isolation

Design: Done (6/18/2009)

Goals

Discussion: ?

Review and Standardization: In Progress. ETA: ?

Prototype: Not Started. ETA: Q4 2009

Implementation: Not Started. ETA: ?