v157 · security · practical + failure modes
Opt-in handshake lab
The spec's §4 example, served for real by this site's own Deno handler: a widget framed under a genuine connectionallowlist requirement, answering with a genuinely-sent Connection-Allowlist that satisfies it, a genuine Allow-Connection-Allowlist-From naming the embedder, or deliberately neither. The widget reports the headers it was actually served with and runs two real same-origin fetches — one to a path a scoped allowlist covers, one to a path it does not.
Honest baseline: this browser (probing). Where the attribute is inert, every scenario loads and both fetches succeed — that observed result is the real, unrestricted baseline this feature exists to change, and the table labels the per-spec enforcing-browser outcome separately. Nothing below fakes a block.
Pick a scenario
Embedder requirement set on the iframe (for real):
Pick a scenario above.
Observed here vs. specified under enforcement
| scenario | observed in THIS browser (live) | specified under enforcement |
|---|---|---|
| A · satisfying allowlist | not run yet | frame loads; requirement + asserted allowlist both apply; fetch to a non-matching path is blocked |
| B · Allow-…-From opt-in | not run yet | frame loads; the embedder's requirement applies to the widget's connections |
| C · neither header | not run yet | frame is BLOCKED — a document that does not opt in does not load |
| D · report-only | not run yet | report-only never blocks and does not satisfy by itself → same as C for loading; violations would be reported, not blocked |
Inspect the widget's real response headers
Same-origin, so fetch() can read them directly — this is the live proof the headers above are genuinely sent, not narrated.
the handshake, as served here
<!-- embedder (this page) -->
<iframe connectionallowlist='("https://good.example" response-origin)'
src="../widget?optin=satisfy"></iframe>
# an enforcing UA adds to the widget's navigation request:
Sec-Required-Connection-Allowlist: ("https://good.example" response-origin)
# the widget's server (v157/connection-allowlists-embedded-enforcement/_server.ts)
# genuinely answers, depending on the scenario:
Connection-Allowlist: ("https://good.example" response-origin) # A — satisfies
Allow-Connection-Allowlist-From: <this origin> # B — names embedder
(neither) # C — blocked if enforced
Connection-Allowlist-Report-Only: (…) # D — reports, never blocks