WEB / WEB-11.S02

CORS, framing and cross-window message validation

Why are response exposure, embedding and Window replies different approvals?

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Valid message

Pending read
Atlas parent retains preview-A and pending read-7. Tea & Bread is already available at the preview; this branch makes no API GET. No Window reply has yet been prepared or delivered to the parent.
Atlas parent
read-7 pending; no title
Book preview
Preview-A; title ready
Owned API
No request; no read
Reply prepared
The preview prepares a fixed title reply for the exact parent origin; this is not an HTTP request.
Atlas parent
read-7 pending; no title
Book preview
Reply read-7 ready; exact target
Owned API
No request; no read
Message task arrival
The queued Window task has been delivered; origin and source are not yet approved.
Atlas parent
Message event arrived; checks pending
Book preview
Reply read-7 ready; exact target
Owned API
No request; no read
Local identity gate
Declared event.origin and the retained preview reference match in these two selected rows.
Atlas parent
Origin/source matched; data pending
Book preview
Reply read-7 ready; exact target
Owned API
No request; no read
Local schema/transaction
Closed kind/version/title schema and pending request ID are separate; a stale read is not the current read.
Atlas parent
Schema valid; read-7 matched
Book preview
Reply read-7 ready; exact target
Owned API
No request; no read
Local display outcome
Origin/source, title schema and read-7 matched; Tea & Bread was bound as literal text. Acceptance grants no HTML interpretation; this branch sent no request or read to the API.
Atlas parent
Literal Tea & Bread; read-7
Book preview
Reply read-7 ready; exact target
Owned API
No request; no read

Stale reply

Pending read
Atlas parent awaits read-7 from preview-A. This branch later selects read-6 from the same preview; matching origin and source do not make that older transaction current. No parent message receipt has occurred yet.
Atlas parent
read-7 pending; no title
Book preview
Preview-A; title ready
Owned API
No request; no read
Reply prepared
The preview prepares a fixed title reply for the exact parent origin; this is not an HTTP request.
Atlas parent
read-7 pending; no title
Book preview
Reply read-6 ready; exact target
Owned API
No request; no read
Message task arrival
The queued Window task has been delivered; origin and source are not yet approved.
Atlas parent
Message event arrived; checks pending
Book preview
Reply read-6 ready; exact target
Owned API
No request; no read
Local identity gate
Declared event.origin and the retained preview reference match in these two selected rows.
Atlas parent
Origin/source matched; data pending
Book preview
Reply read-6 ready; exact target
Owned API
No request; no read
Local schema/transaction
Closed kind/version/title schema and pending request ID are separate; a stale read is not the current read.
Atlas parent
Schema valid; read-6 stale denied
Book preview
Reply read-6 ready; exact target
Owned API
No request; no read
Local display outcome
The message event reached the parent and origin/source passed; read-6 failed pending read-7, leaving the title unchanged. Message receipt is not transaction acceptance, and this branch performed no API read.
Atlas parent
Title unchanged; stale ignored
Book preview
Reply read-6 ready; exact target
Owned API
No request; no read

CORS read denied

Normal read intent
Atlas browser wants Tea & Bread from api.example.org. The selected GET uses include mode and the response uses ACAO *; exposure is decided only after response arrival. No API request or server read has occurred yet.
Atlas parent
read-7 pending; no title
Book preview
Preview-A; title ready
Owned API
No request; no read
GET prepared
A fixed GET is prepared in credentials mode include; no actual cookie or connection is used.
Atlas parent
GET request ready; mode=include
Book preview
Preview-A; title ready
Owned API
No request; no read
API received request
The normal GET has arrived at the API; CORS exposure cannot undo server receipt.
Atlas parent
GET request ready; mode=include
Book preview
Preview-A; title ready
Owned API
GET arrived; public read pending
Local public response
The server declares the public read allowed and prepares ordinary JSON with wildcard ACAO.
Atlas parent
GET request ready; mode=include
Book preview
Preview-A; title ready
Owned API
JSON response ready; ACAO=*
Response at browser
The response arrives; status/content availability and CORS script exposure remain distinct.
Atlas parent
Response arrived; exposure pending
Book preview
Preview-A; title ready
Owned API
JSON response ready; ACAO=*
Local CORS gate
Include-mode wildcard exposure is rejected while the declared server-read result remains.
Atlas parent
Script read blocked; server read allowed
Book preview
Preview-A; title ready
Owned API
JSON response ready; ACAO=*

Ancestor denied

Policy fixture ready
The preview response has enforced frame-ancestors allowing the Atlas origin. The selected chain has reader.example.net above the immediate Atlas parent; the later local gate evaluates the whole chain. No resource download or API read occurs.
Atlas parent
read-7 pending; no title
Book preview
Preview-A; title ready
Owned API
No request; no read
Local response policy
Header-enforced frame-ancestors takes the parent allowlist from the protected preview.
Atlas parent
read-7 pending; no title
Book preview
Header policy; all ancestors pending
Owned API
No request; no read
Local ancestor gate
The immediate Atlas parent is allowed, but a different outer ancestor rejects this selected chain.
Atlas parent
read-7 pending; no title
Book preview
Outer ancestor denied; no embedding
Owned API
No request; no read
Local UI consequence
The parent sees declared embedding denial, not an API-permission or CORS-denial result.
Atlas parent
Embedding unavailable; title unchanged
Book preview
Outer ancestor denied; no embedding
Owned API
No request; no read
Local explanatory state
The immediate Atlas parent is allowed, but outer reader.example.net is absent from the ancestor list; embedding was denied. The UI shows that policy reason without adding an API-read or CORS-denial result.
Atlas parent
Ancestor policy explanation ready
Book preview
Outer ancestor denied; no embedding
Owned API
No request; no read

ACTORS · STATE · DATA FLOW

What does CORS expose?

Reading the Tea & Bread title from Atlas’s owned API concerns resource-server permission to expose a response to a browser origin. Session/object policy is separate. A simple GET can reach the server and receive a normal response while CORS prevents script access to its content; that does not prove absence of server effects. Credentials mode include requires an exact ACAO origin and ACAC true; wildcard ACAO does not allow exposure in that mode, even if no cookie actually exists. Actual credential attachment still depends on SameSite and storage policy. Method/header/value conditions can introduce a preflight before the normal exchange; its permission is not object authorization.

Framing policy belongs to the response owner

A book-preview document limits its embedders with response-header CSP frame-ancestors. The parent’s frame-src instead limits child resource loading; these control opposite directions. frame-ancestors checks the whole ancestor chain, not just the immediate parent, has no default-src fallback and is ignored in meta delivery. An enforced directive overrides X-Frame-Options in supporting browsers. XFO DENY/SAMEORIGIN supplies legacy compatibility; current SAMEORIGIN requires all ancestors to match, while RFC7034 records historical implementation variation. Obsolete ALLOW-FROM is not a modern allowlist solution. Framing denial is a UI-embedding boundary, not a DOM-read or server-permission decision.

A Window message passes four gates

Atlas retains the preview-A WindowProxy reference and a pending read-7 transaction. A harmless reply contains kind=book-title, version=1, requestId=read-7 and title=Tea & Bread, queued for the exact parent targetOrigin. The receiver checks event.origin against the expected sender origin, event.source against its retained preview reference, data against a closed schema and requestId against the pending transaction. event.origin reflects send time; the document can later navigate while its WindowProxy reference remains. Payload origin/source strings do not replace browser event identity. Structured cloning copies data without establishing trust or ordering independent async replies. A transferred MessagePort is a separate capability/channel contract, not an assumption that every port message exposes Window origin/source.

Read every scenario without motion

Read and framing

Server read and exposure
serverReadAllowed stays true in the CORS rows. Include wildcard has expectedExposed false; a server returning public data does not imply script-readable body.
Capability ledger
Server read true / include wildcard exposed false
Policy boundary review
Not yet evaluated
Acceptance outcome
Not yet evaluated
Positive CORS controls
Include with exact Atlas ACAO and lowercase true is readable, as is the omit-mode public wildcard. Credentials mode and response contract are evaluated together.
Capability ledger
Server read true / include wildcard exposed false
Policy boundary review
Exact include true / public omit true
Acceptance outcome
Not yet evaluated
Framing is another question
owned-chain passes enforced frame-ancestors with two Atlas ancestors. This capability is not script-read or business-action authority; framePolicyGrantsRead is false.
Capability ledger
Server read true / include wildcard exposed false
Policy boundary review
Exact include true / public omit true
Acceptance outcome
Embedding allowed ≠ body readable
Outer ancestor difference
frame-denied includes a reader.example.net ancestor alongside an Atlas parent. Every ancestor is evaluated; validating only the nearest parent cannot establish chain permission.
Capability ledger
Outer reader ancestor / frame denied
Policy boundary review
Exact include true / public omit true
Acceptance outcome
Embedding allowed ≠ body readable
CSP and XFO delivery
With supported enforced frame-ancestors in a header, owned-chain is allowed despite XFO DENY. Report-only supplies no enforced ancestor permission and remains denied by XFO DENY.
Capability ledger
Outer reader ancestor / frame denied
Policy boundary review
Enforce CSP precedence / report XFO deny
Acceptance outcome
Embedding allowed ≠ body readable
Do not merge three permissions
Read, embed and action have separate policies. CORS exposure is not framing permission, and frame-ancestors is not CSRF/action-intent control; the normal title example keeps these boundaries narrow.
Capability ledger
Outer reader ancestor / frame denied
Policy boundary review
Enforce CSP precedence / report XFO deny
Acceptance outcome
Exposure/framing/action policies separate

Stale message

Current request binding
The parent expects book-title version 1 for read-7 from preview-A. Exact targetOrigin is Atlas, and title Tea & Bread is a string in the normal schema.
Capability ledger
preview-A / read-7 / version1
Policy boundary review
Not yet evaluated
Acceptance outcome
Not yet evaluated
Stale requestId
stale-message has correct origin and source but carries read-6. It is rejected for not matching current work; a trusted sender can return stale results in ordinary async lifecycle.
Capability ledger
preview-A / read-7 / version1
Policy boundary review
Correct sender / read-6 rejected
Acceptance outcome
Not yet evaluated
Reference difference
wrong-reference comes from preview-B at the same origin and is rejected. Origin equality alone does not identify the replying WindowProxy instance.
Capability ledger
preview-A / read-7 / version1
Policy boundary review
Correct sender / read-6 rejected
Acceptance outcome
Same origin / preview-B rejected
Shape control
shape-denied carries null title and fails the string/maxTitle 80 contract. Correct origin/source does not supply type, version or closed-key validation.
Capability ledger
title null / shape rejected
Policy boundary review
Correct sender / read-6 rejected
Acceptance outcome
Same origin / preview-B rejected
Clone is not trust
Copied message data does not replace WindowProxy identity. Normal acceptance belongs to title text only; messageAcceptedPermitsHTML is false and grants no HTML/code interpretation.
Capability ledger
title null / shape rejected
Policy boundary review
Accepted title text ≠ HTML/code permission
Acceptance outcome
Same origin / preview-B rejected
Bounded effect of acceptance
Readonly title is accepted when source, origin, schema and pending request pass together. This decision is not expanded to API object authority, framing or complete event-lifecycle success.
Capability ledger
title null / shape rejected
Policy boundary review
Accepted title text ≠ HTML/code permission
Acceptance outcome
Correlated readonly result / separate server policy

ASSUMPTION · BOUNDARY · CONTROL

Response reading, embedding and business actions differ

A title read, preview embedding and reply delivery require different capabilities. The broken assumption is that one origin-allow decision authorizes all of them. Generic CORS origin reflection or incorrect credentials-mode handling changes script exposure, whose impact depends on returned data and real object policy. Missing framing policy can permit relevant action UI inside another context; clickjacking additionally requires deceptive user interaction and applicable UI/action conditions. CORS headers are not framing policy, and frame-ancestors does not replace action-intent/CSRF controls. The artifact uses a benign GET and ordinary ancestor matrix, with no overlay, exploit form or third-party request.

A trusted sender can still return stale or malformed data

A matching origin can still belong to another preview reference, and matching origin/source can still return read-6 after the UI has moved to read-7. Missing titles, extra fields and incorrect versions fail a separate schema gate. These failures also occur during normal multi-window and async lifecycle behavior. The receiver does not use domain-suffix matching or treat payload source aliases as browser identity. Accepted titles remain ordinary h2 text data; message acceptance is not permission to interpret HTML/code. Receiver-handler exceptions do not return synchronous success/failure to the sender of a queued reply. Retained references, expected kinds/types and pending-operation correlation are controls, alongside the sender’s exact targetOrigin privacy boundary.

Read every scenario without motion

Matrix controls

CORS matrix
corsRows retains API response predicates and expected browser exposure; framing.rows retains resource ancestor policy; messageRows retains parent-receiver acceptance predicates. These are supplied example records. normal/stale-message use a Window task without reaching the API; cors-denied carries a GET to the API, while frame-denied is only local policy evaluation. A title observed in correlation-gap cannot establish which path executed. Explicit include and public omit expose true, while include wildcard and wrong-origin expose false. serverReadAllowed and expectedExposed remain distinct fields.
Capability records
Two exposure allows / two exposure denies
Evidence comparison
Not yet evaluated
Review result
Not yet evaluated
Ancestor matrix
owned-chain is true and outer-reader frame-denied false. Enforced header CSP, legacy XFO SAMEORIGIN and report-only with XFO DENY are evaluated in separate branches.
Capability records
Two exposure allows / two exposure denies
Evidence comparison
Complete chain / CSP vs XFO fallback
Review result
Not yet evaluated
Message matrix
Normal read-7 is accepted; stale id, wrong reference, wrong origin and null title are rejected separately. Each negative probes a different condition rather than one undifferentiated denial.
Capability records
Two exposure allows / two exposure denies
Evidence comparison
Complete chain / CSP vs XFO fallback
Review result
One normal / four independent message rejects
Evidence source
Browser exposure, protected headers/ancestor chain and receiver acceptance are different observation points. Server audit knows its own read/action, not the whole browser chain.
Capability records
Browser/response/receiver/server scopes distinct
Evidence comparison
Complete chain / CSP vs XFO fallback
Review result
One normal / four independent message rejects
Minimal comparison fields
Origin-match, source-match, schema-valid and transaction-match can be correlated without a raw private message body. Aliases and comparison results explain this read-only example.
Capability records
Browser/response/receiver/server scopes distinct
Evidence comparison
Comparison results / no raw private body
Review result
One normal / four independent message rejects
Regression scope
Finite typed rows compare policy decisions. Without actual CORS, CSP/XFO or postMessage enforcement, local outcomes establish neither browser compatibility nor production-event success.
Capability records
Browser/response/receiver/server scopes distinct
Evidence comparison
Comparison results / no raw private body
Review result
Finite matrices known / browser runtime separate

Correlation gap

One title observation
corsRows retains API response predicates and expected browser exposure; framing.rows retains resource ancestor policy; messageRows retains parent-receiver acceptance predicates. These are supplied example records. normal/stale-message use a Window task without reaching the API; cors-denied carries a GET to the API, while frame-denied is only local policy evaluation. A title observed in correlation-gap cannot establish which path executed. The review sees only displayed Tea & Bread, without API exposure, ancestor chain or accepted-reply records. The same title can result from different local or remote paths.
Capability records
Title known / three capability records missing
Evidence comparison
Not yet evaluated
Review result
Not yet evaluated
Visible frame is insufficient
A visible frame is neither script-body exposure nor message acceptance. A parent heading alone does not prove exact-target delivery or receiver schema validation.
Capability records
Title known / three capability records missing
Evidence comparison
Visible frame/title ≠ capability proof
Review result
Not yet evaluated
Retain three unknowns
Exposure, framing-policy decision and current-message acceptance remain UNKNOWN for this incomplete event. True normal-matrix rows do not fill missing event fields.
Capability records
Title known / three capability records missing
Evidence comparison
Visible frame/title ≠ capability proof
Review result
Exposure/framing/acceptance UNKNOWN
Required correlation
Request mode/ACAO/ACAC, response policy delivery/chain and message origin/source/schema/requestId are gathered separately and associated with the same read-only work and current display.
Capability records
Needed: exposure/chain/message correlations
Evidence comparison
Visible frame/title ≠ capability proof
Review result
Exposure/framing/acceptance UNKNOWN
Schema versus identity
Cloning a plain object does not verify the sender WindowProxy. A missing source reference is not invented as event identity, and accepted data remains in text context.
Capability records
Needed: exposure/chain/message correlations
Evidence comparison
Copied data ≠ sender identity
Review result
Exposure/framing/acceptance UNKNOWN
Report the review boundary
New evidence must answer the three capability questions separately. This event retains the observed title without adding server authority or browser-enforcement success.
Capability records
Needed: exposure/chain/message correlations
Evidence comparison
Copied data ≠ sender identity
Review result
Retain title / collect scoped capability evidence

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Observe evidence where each control executes

corsRows retains API response predicates and expected browser exposure; framing.rows retains resource ancestor policy; messageRows retains parent-receiver acceptance predicates. These are supplied example records. normal/stale-message use a Window task without reaching the API; cors-denied carries a GET to the API, while frame-denied is only local policy evaluation. A title observed in correlation-gap cannot establish which path executed. Record request origin, credentials mode, explicit ACAO/ACAC and exposure result with the response source; server read permission and browser exposure are separate fields. If responses vary by explicit origin, relevant caches need Vary: Origin, which is not itself permission checking. Framing review collects the protected response header, enforce/report disposition and complete ancestor chain rather than counting meta/default-src as protection. Message logs separate origin/source/schema/transaction matches and reasons without logging secrets or full bodies. Browser diagnostics know their network/CORS results and server audit knows its own action; one surface cannot certify the whole chain.

Keep the matrices separate

Regression expects blocked script access for credentials mode include with wildcard ACAO; uncredentialed public wildcard and explicit approved origins follow their own policies. The ancestor matrix separates an owned chain from a different outer origin above an owned immediate parent, and distinguishes enforced CSP from legacy XFO fallback. Window checks independently cover same origin with wrong reference, valid reference with stale transaction and invalid schema. Opaque origins or intentional port transfer require different product contracts rather than silently joining this exact tuple-origin Window profile. Native structuredClone only verifies copied ordinary data, not browser event identity, CORS or framing enforcement. Product policy retains text rendering and server action gates independently from these transport/result controls.

NOW APPLY IT TO THE CASE

Are CORS, framing and message acceptance one permission?

Atlas wants to read the API body, embed the preview and accept a title reply for read-7. An include-mode wildcard response is unreadable; another origin in the ancestor chain can change framing. A read-6 reply from the correct origin does not complete current read-7 work.

Which relationship does the case’s browser policy control? Explain exposure, destination or framing decisions separately from server object permission.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Exposure, ancestor and Window-message ledger

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "profile": {
    "parentOrigin": "https://atlas.example.org",
    "previewOrigin": "https://preview.example.org",
    "previewReference": "preview-A",
    "pendingRequestId": "read-7",
    "apiOrigin": "https://api.example.org",
    "title": "Tea & Bread",
    "actualBrowser": false,
    "actualMessage": false,
    "actualRequest": false,
    "actualFraming": false
  },
  "corsRows": [
    {
      "case": "explicit",
      "requestOrigin": "https://atlas.example.org",
      "credentialsMode": "include",
      "acao": "https://atlas.example.org",
      "acac": "true",
      "serverReadAllowed": true,
      "expectedExposed": true
    },
    {
      "case": "cors-denied",
      "requestOrigin": "https://atlas.example.org",
      "credentialsMode": "include",
      "acao": "*",
      "acac": "true",
      "serverReadAllowed": true,
      "expectedExposed": false
    },
    {
      "case": "public-wildcard",
      "requestOrigin": "https://atlas.example.org",
      "credentialsMode": "omit",
      "acao": "*",
      "acac": null,
      "serverReadAllowed": true,
      "expectedExposed": true
    },
    {
      "case": "wrong-origin",
      "requestOrigin": "https://atlas.example.org",
      "credentialsMode": "omit",
      "acao": "https://reader.example.net",
      "acac": null,
      "serverReadAllowed": true,
      "expectedExposed": false
    }
  ],
  "framing": {
    "resourceOrigin": "https://preview.example.org",
    "rows": [
      {
        "case": "owned-chain",
        "ancestors": [
          "https://atlas.example.org",
          "https://atlas.example.org"
        ],
        "cspDelivery": "header",
        "cspDisposition": "enforce",
        "allowedOrigins": [
          "https://atlas.example.org"
        ],
        "xfo": "DENY",
        "expectedAllowed": true
      },
      {
        "case": "frame-denied",
        "ancestors": [
          "https://reader.example.net",
          "https://atlas.example.org"
        ],
        "cspDelivery": "header",
        "cspDisposition": "enforce",
        "allowedOrigins": [
          "https://atlas.example.org"
        ],
        "xfo": "DENY",
        "expectedAllowed": false
      },
      {
        "case": "legacy-own",
        "ancestors": [
          "https://preview.example.org"
        ],
        "cspDelivery": null,
        "cspDisposition": null,
        "allowedOrigins": [],
        "xfo": "SAMEORIGIN",
        "expectedAllowed": true
      },
      {
        "case": "report-only",
        "ancestors": [
          "https://atlas.example.org"
        ],
        "cspDelivery": "header",
        "cspDisposition": "report",
        "allowedOrigins": [],
        "xfo": "DENY",
        "expectedAllowed": false
      }
    ],
    "allAncestorsChecked": true,
    "defaultSrcFallback": false,
    "metaEnforcesFrameAncestors": false,
    "actualHeaders": false
  },
  "messageSchema": {
    "keys": [
      "kind",
      "version",
      "requestId",
      "title"
    ],
    "kind": "book-title",
    "version": 1,
    "maxTitle": 80
  },
  "messageRows": [
    {
      "case": "normal",
      "origin": "https://preview.example.org",
      "sourceReference": "preview-A",
      "targetOrigin": "https://atlas.example.org",
      "data": {
        "kind": "book-title",
        "version": 1,
        "requestId": "read-7",
        "title": "Tea & Bread"
      },
      "expected": true
    },
    {
      "case": "stale-message",
      "origin": "https://preview.example.org",
      "sourceReference": "preview-A",
      "targetOrigin": "https://atlas.example.org",
      "data": {
        "kind": "book-title",
        "version": 1,
        "requestId": "read-6",
        "title": "Tea & Bread"
      },
      "expected": false
    },
    {
      "case": "wrong-reference",
      "origin": "https://preview.example.org",
      "sourceReference": "preview-B",
      "targetOrigin": "https://atlas.example.org",
      "data": {
        "kind": "book-title",
        "version": 1,
        "requestId": "read-7",
        "title": "Tea & Bread"
      },
      "expected": false
    },
    {
      "case": "wrong-origin",
      "origin": "https://reader.example.net",
      "sourceReference": "preview-A",
      "targetOrigin": "https://atlas.example.org",
      "data": {
        "kind": "book-title",
        "version": 1,
        "requestId": "read-7",
        "title": "Tea & Bread"
      },
      "expected": false
    },
    {
      "case": "shape-denied",
      "origin": "https://preview.example.org",
      "sourceReference": "preview-A",
      "targetOrigin": "https://atlas.example.org",
      "data": {
        "kind": "book-title",
        "version": 1,
        "requestId": "read-7",
        "title": null
      },
      "expected": false
    }
  ],
  "boundaries": {
    "corsExposureGrantsAction": false,
    "framePolicyGrantsRead": false,
    "originMatchProvesSchema": false,
    "clonedDataTrusted": false,
    "messageAcceptedPermitsHTML": false
  }
}

corsRows: Browser exposure differs from server read permission.
framing: Response-owned ancestor/XFO matrix uses a selected support profile.
messageSchema: Expected fields/types for a closed harmless title reply.
messageRows: Event-identity aliases, target and pending transaction are separate.
profile: Reserved example origins and no-actual-execution scope.

Typed inert rows; sourceReference is not an actual WindowProxy. No CORS, CSP/XFO or browser postMessage executes.

Two reality checks

A blocked CORS response means the server never received the request.

A normal simple request may have reached the server; script exposure is separate.

A matching event.origin makes a message safe to use.

Validate source reference, schema and pending transaction separately and keep output as text.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

The reply origin and sourceReference match, but requestId=read-6 while read-7 is pending. Is the title accepted?

No. stale-message has expected=false.
Yes. The correct origin makes every title message acceptable.

Read the explained answer

No. stale-message has expected=false. — Correct origin/source do not make an old reply current. The pending requestId must match too.

Both rows include XFO DENY. In the supporting-browser profile, why is owned-chain allowed while report-only is denied?

Selected lesson artifact fields; teaching example

framing.rows[0]: {"case":"owned-chain","ancestors":["https://atlas.example.org","https://atlas.example.org"],"cspDelivery":"header","cspDisposition":"enforce","allowedOrigins":["https://atlas.example.org"],"xfo":"DENY","expectedAllowed":true}
framing.rows[3]: {"case":"report-only","ancestors":["https://atlas.example.org"],"cspDelivery":"header","cspDisposition":"report","allowedOrigins":[],"xfo":"DENY","expectedAllowed":false}
framing.allAncestorsChecked: true

An allowed immediate parent automatically approves every ancestor and XFO.
Enforced frame-ancestors overrides XFO; report-only does not.

Read the explained answer

Enforced frame-ancestors overrides XFO; report-only does not. — The owned chain has every ancestor on the allowlist. The enforced header takes precedence in a supporting browser; XFO DENY applies to the report-only row.

Wildcard ACAO denies exposure in include mode. Why are that result, framing and an accepted postMessage not server-action permission?

Read the explained answer

CORS determines script exposure, not server-action permission. Frame policy constrains ancestors that may embed; it does not grant DOM read. Messages require exact origin/source, schema and the pending transaction. An accepted title remains data, not permission for HTML interpretation or API access. These tables predict defined conditions rather than executing real browser enforcement.

□ I explained CORS, framing and message checks separately.

□ I did not treat browser outcomes as server-action or HTML-sink permission.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

MDN — CORS configurationRequests with credentials; Preflight requests and credentials; Credentialed requests/wildcards · Access-Control-Allow-Origin: explicit single origin and Vary: Origin
W3C CSP Level 3 — Working Draft 16 September 2026§6.4.2 frame-ancestors; all ancestors, no meta/default-src fallback; §6.4.2.2 XFO precedence
MDN — X-Frame-OptionsDirectives DENY/SAMEORIGIN/all ancestors; obsolete ALLOW-FROM; header not meta
RFC 7034 — legacy informational XFO§2.1 DENY/SAMEORIGIN and documented historical implementation variations; not current ALLOW-FROM recommendation
WHATWG HTML — cross-document messaging§9.3.2.1 expected origin/data validation; §9.3.3 queued task/targetOrigin/source/structured clone · §9.4.1 channel messages and transferred port capability distinction
MDN — Window postMessageParameters targetOrigin/transfer; Dispatched event origin-at-send/source; Security concerns exact origin/source/data shape
WHATWG Fetch Living Standard — official fetch.bs sourceCORS check algorithm (#cors-check), source lines 6553–6581: credentials-mode include, byte-serialized origin and ACAC true · HTTP fetch CORS response-tainting check, source lines 5312–5321: response network error on failed CORS check

YOUR NOTES / THIS BROWSER

CORS, framing and cross-window message validation

1. Core · Mechanism

Valid message

Stale reply

CORS read denied

Ancestor denied

What does CORS expose?

Framing policy belongs to the response owner

A Window message passes four gates

2. Red · Trust & Impact

Read and framing

Stale message

Response reading, embedding and business actions differ

A trusted sender can still return stale or malformed data

3. Blue · Secure development & defense

Matrix controls

Correlation gap

Observe evidence where each control executes

Keep the matrices separate

Are CORS, framing and message acceptance one permission?

Two reality checks

The reply origin and sourceReference match, but requestId=read-6 while read-7 is pending. Is the title accepted?

Both rows include XFO DENY. In the supporting-browser profile, why is owned-chain allowed while report-only is denied?

Wildcard ACAO denies exposure in include mode. Why are that result, framing and an accepted postMessage not server-action permission?

Sources and scope