My recollection is that we prohibit worker access to cookies for exactly this reason (WorkerGlobalScope does not expose a "cookies" attribute).<div><br></div><div>-atw<br><br><div class="gmail_quote">On Wed, Aug 26, 2009 at 2:05 PM, Jens Alfke <span dir="ltr"><<a href="mailto:snej@google.com">snej@google.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div style="word-wrap:break-word"><div>I know that one of the design issues with worker threads and local storage has been how to resolve concurrency issues, and that for this reason, in the current spec worker threads can't access local storage.</div>
<div><br></div><div>However, there's a scenario under the current spec that <i>doesn't</i> involve local storage, whereby a worker thread can deadlock the browser. This is because access to cookies, by workers or the browser itself, is also subject to that global mutex.</div>
<div><br></div><div>Consider these steps:</div><div>1. A worker thread accesses "document.cookie". This causes it to acquire the mutex (sec. 3.1.3).</div><div>2. The thread now performs some long-lasting operation without exiting. In the simplest case it just goes into an infinite loop.</div>
<div>3. Meanwhile, the user loads a new web page in the browser.</div><div>4. The resulting HTTP response contains a Cookie: header. The spec requires that the browser's loader temporarily acquire the mutex while updating the cookie (sec. 2.6, item 4).</div>
<div>5. The page-load blocks indefinitely because the worker thread still has the mutex and never lets go of it.</div><div><br></div><div>The result is that the browser becomes incapable of loading any web pages that use cookies. Assuming the worker thread never exits, the only way to recover from this is to quit the browser. A worker thread like this could very easily be created by a malicious website, resulting in a DoS attack on the browser. And of course, a merely poorly-written script could create the same effect without intending to.</div>
<div><br></div><div>I honestly can't think of any safe way of tweaking the semantics of the existing 'document.cookie' API to make it transactional. :(</div><div><br></div><div>Has anyone implemented this portion of the spec yet?</div>
<div><br></div><font color="#888888"><div>—Jens</div><div><br></div></font></div></blockquote></div><br></div>