1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
---
title: Secure contexts
slug: Web/Security/Secure_Contexts
translation_of: Web/Security/Secure_Contexts
---
<p><span class="seoSummary"><strong>安全上下文</strong>是 <code>Window</code> 与 <code>Worker</code> 中的概念</span>满足了最低标准的身份验证和机密性<span class="seoSummary">.</span> 许多Web APIs的访问仅能在安全上下文中. 安全上下文的主要目标是防止 {{interwiki("wikipedia", "man-in-the-middle attack", "MITM attackers")}} 强大的APIs被坏人利用.</p>
<h2 id="为什么要限制某些功能">为什么要限制某些功能?</h2>
<p>有些APIs是非常强大的, 能给攻击者更强的能力以及更多的操作:</p>
<ul>
<li>侵犯用户隐私.</li>
<li>获得对用户计算机的低级访问权限.</li>
<li>获得对数据的访问权限，例如用户凭证.</li>
</ul>
<h2 id="When_is_a_context_considered_secure">When is a context considered secure?</h2>
<p>A context is considered secure when it meets certain minimum standards of authentication and confidentiality defined in the <a href="https://w3c.github.io/webappsec-secure-contexts/">Secure Contexts</a> specification. A particular document is considered to be in a secure context when it is the <a href="https://html.spec.whatwg.org/multipage/browsers.html#active-document">active document</a> of a <a href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context">top-level browsing context</a> (basically, a containing window or tab) that is a secure context.</p>
<p>For example, even for a document delivered over TLS within an {{HTMLElement("iframe")}}, its context is <strong>not</strong> considered secure if it has an ancestor that was not also delivered over TLS.</p>
<p>However, it’s important to note that if a non-secure context causes a new window to be created (with or without specifying <a href="/en-US/docs/Web/API/Window/open#noopener">noopener</a>), then the fact that the opener was insecure has no effect on whether the new window is considered secure. That’s because the determination of whether or not a particular document is in a secure context is based only on considering it within the top-level browsing context with which it is associated — and not whether a non-secure context happened to be used to create it.</p>
<p>Locally-delivered resources such as those with <em>http://127.0.0.1</em> URLs, <em>http://localhost</em> URLs (under certain conditions), and <em>file://</em> URLs are also considered to have been delivered securely.</p>
<p>Resources that are not local, to be considered secure, must meet the following criteria:</p>
<ul>
<li>must be served over <em>https://</em> or <em>wss://</em> URLs</li>
<li>the security properties of the network channel used to deliver the resource must not be considered deprecated</li>
</ul>
<h2 id="Feature_detection">Feature detection</h2>
<p>Pages can use feature detection to check whether they are in a secure context or not by using the {{domxref("WindowOrWorkerGlobalScope.isSecureContext", "isSecureContext")}} boolean, which is exposed on the global scope.</p>
<pre class="brush: js notranslate">if (window.isSecureContext) {
// Page is a secure context so service workers are now available
navigator.serviceWorker.register("/offline-worker.js").then(function () {
...
});
}</pre>
<h2 id="Specifications">Specifications</h2>
<table class="standard-table">
<tbody>
<tr>
<td>Specification</td>
<td>Status</td>
<td>Comment</td>
</tr>
<tr>
<td>{{SpecName('Secure Contexts')}}</td>
<td>{{Spec2('Secure Contexts')}}</td>
<td>Editor’s Draft</td>
</tr>
</tbody>
</table>
<h2 id="See_also">See also</h2>
<ul>
<li><a href="/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts">Platform features restricted to secure contexts</a> — a list of the features available only in secure contexts</li>
<li>{{domxref("Window.isSecureContext")}}</li>
<li><a href="https://permission.site">https://permission.site</a> — A site that allows you to check what API permission checks your browser employs, over HTTP and HTTPS</li>
<li><a href="/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security">Strict-Transport-Security</a> HTTP header</li>
</ul>
<div>{{QuickLinksWithSubpages("/en-US/docs/Web/Security")}}</div>
|
