Hacker News new | ask | show | jobs
by icefox 3087 days ago
In Chrome's implementation are the cache, cookiejar, and history all kept completely separate? For example if I go to foo.com and inside that it loads a facebook script in an iframe could it get all the normal facebook cookies or would it be blank? Which "site" would the iframe be?

Back in the day (Around when I ported chrome to Linux for a time context) I wrote up a spec and implemented a browser that did site data compartmentalization. Data leaks from cookies, history and especially cache were not possible because the data just wasn't there to be leaked. It was a pretty cool design that along with per site settings and split view search was definitely ahead of its time. Alas I was forbidden from working on it by my employer at the time and have been watching for some of the features to appear in other browsers since.

https://benjamin-meyer.blogspot.com/2009/08/next-generation-...

1 comments

The three data sources you mention are kept in the browser process (which is the privileged singleton process that spawns the sandboxed child processes that actually parse and execute web content). However the child processes can query and mutate them (to support e.g document.cookie). Those JS apis do work in iframes. In your example, we would create a facebook.com subframe process separate from the foo.com process for the main document.

You can see your example in action by enabling site isolation, visiting a page with a FB like button, and opening Chrome's task manager. You can even kill the subframe process, and it shouldn't take down the whole tab.