Introduce SameOrigin and SameAgentCluster for [Serializable]

[annevk]

Useful for WebAssembly.Module and RTCCertificate. SharedArrayBuffer can reuse the underlying infrastructure.

Fixes #4939. Helps with #4920.

---

/structured-data.html ( diff )

[annevk]

(I don't understand how both commits passed Travis whereas for the first commit PR Preview pointed out that there was an xref problem the second commit addresses.)

[annevk]

A better design might be allowing either SameOrigin or SameOriginAndAgentCluster as that's the end goal. I.e., we don't really want folks setting SameAgentCluster as proposed without also setting SameOrigin. That would require @dtapuska weighing in and allowing some more time for objections though, as it'd immediately affect SharedArrayBuffer.

[domenic]

Great stuff.

A better design might be allowing either SameOrigin or SameOriginAndAgentCluster as that's the end goal. I.e., we don't really want folks setting SameAgentCluster as proposed without also setting SameOrigin.

Right. Maybe we should land this with a warning and issue link, stating that we are actively investigating removing just-SameOrigin, and specs should strongly consider using only =(SameOrigin,SameAgentCluster) or =SameOrigin.

[domenic]

Another thing I realized we do not handle is inheritance. The spec text says

Platform objects can be serializable objects if they implement only interfaces decorated with the [Serializable] IDL extended attribute

kind of implying that you should put it on everything in the inheritance chain, but we don't handle that really. And if we were to handle it we'd need to handle it for the SameOrigin/SameAgentCluster things as well.

My proposal is that we:

• Change the above sentence to talk about the primary interface.
• Check the primary interface in the processing model (for SameOrigin/SameAgentCluster, and also we could fix the current text which says "the appropriate serialization steps" to say "value's primary interface's serialization steps").
• Add a restriction that [Serializable] that it not be used on interfaces that inherit.
• Add a note saying that we could allow that in the future so let us know if you have a use case.

Also a lot of this applies to [Transferable] too.

Because all of this has the feeling of uncovering tech debt, I'll do a pull request for most of it separately, which this can then be based on.

[annevk]

I wonder if @tabatkins thought about exporting syntax for this meanwhile, but we could also export this later.

[annevk]

So going through the WebRTC use case again it seems that SameOrigin might not be adequate.

In particular, partly due to document.domain / agent cluster key, replacing their setup with SameOrigin would mean two changes:

1. It's now restricted to same-site + same-scheme, not same-origin.
2. Messaging cross-origin creates a messageerror (this is likely compatible and perhaps still worth doing, but if 1 is a problem you cannot get rid of the [[Origin]] slot).

cc @jan-ivar

[domenic]

I'm confused, why does SameOrigin give same-site + same-scheme, not same-origin? Should we rename it?

[tabatkins]

I wonder if @tabatkins thought about exporting syntax for this meanwhile, but we could also export this later.

I'm not sure I quite understand what's being discussed here. If you'd like something in Bikeshed, mind opening an issue on me explaining it in a little more detail?

[annevk]

@domenic for serialization and deserialization it is same-origin, but due to document.domain the object could still be shared with another origin. I attempted to explain the implications of this in w3c/webrtc-pc#2343. It might be that we'd have to remove the SameOrigin value if it's not adopted anywhere in the end (I still hope WebAssembly.Module will use it and SharedArrayBuffer will use the underlying model, but I'm no longer as sure that it's a good fit for RTCCertificate other than signaling intent).

@tabatkins I filed speced/bikeshed#1544.

[domenic]

I think we may want to add a note or example explaining that limitation in some detail. (Assuming this ends up being something we want to merge.) I'm happy to help draft that if you'd prefer. But for now I'll wait until we have a clearer signal that this would be used by other specs.

[annevk]

I've updated the note. Here's how I see this go down:

1. SameAgentCluster is important and needed for SharedArrayBuffer (infrastructure only)/WebAssembly.Module. Need beyond that is unclear at this point.
2. RTCCertificate would experiment with SameOrigin.
3. SharedArrayBuffer (infrastructure only)/WebAssembly.Module ideally adopt SameOrigin, but this is not yet finalized.
4. If 3 happens, we rename SameAgentCluster to SameAgentClusterAndOrigin (or equivalent) and disallow a list of identifiers.

Pushing for 2 and 3 might be harder if the infrastructure is not formalized, but perhaps workable if it's essentially guaranteed to land if the experiments work out.

[annevk]

I'm convinced this kind of fake restriction isn't worth it. Change agent cluster keying or bust.