Skip to main content

Restrictions for providers

The provider objects (e.g. window.ethereum, window.braveSolana and window.cardano) are not provided in all contexts.

Historically the web has had a notion of “powerful" APIs like geolocation and camera/microphone, which are subject to additional security restrictions. See for instance https://www.w3.org/TR/secure-contexts/.

Because they allow websites to request access to user funds, new web3 APIs like window.ethereum and window.braveSolana are subject to the same restrictions as other powerful APIs like geolocation in Brave. As a rule of thumb, if a context is not allowed to request access to geolocation, window.ethereum and window.braveSolana are undefined in the same contexts.

Provider objects are not accessible in private and Tor window.

Restrictions until a wallet is created​

Starting in Brave 1.95, no provider object is injected until the user has created a Brave Wallet. Until then window.ethereum, window.braveEthereum, window.braveSolana, window.solana and window.cardano are all undefined, and there is no way for a site to prompt the user to set up the wallet.

Before Brave 1.95, window.braveEthereum, window.braveSolana, window.solana and window.cardano were injected even with no wallet created (as was window.ethereum, when no MetaMask was installed), and requesting permissions from a site would open the wallet onboarding page.

This means detection code must tolerate a missing provider rather than assume one is present. See the detection pages for Ethereum, Solana and Cardano.

Restrictions for insecure contexts​

Only “secure origins" as defined in https://www.chromium.org/Home/chromium-security/prefer-secure-origins-for-powerful-new-features/#definitions have access to window.ethereum and window.braveSolana. This can be checked using window.isSecureContext, including inside iframes. Secure contexts include sites that are served from HTTPS but also HTTP localhost.

Restrictions in iframes​

By default the provider objects are not exposed to 3p iframes. Brave exposes 2 new feature policies for Ethereum and Solana named ethereum and solana respectively.

window.ethereum and window.braveSolana are blocked in an iframe if window.isSecureContext is false in that iframe.

In addition:

  1. If the iframe is third party to the top-level origin, it will be blocked UNLESS the iframe has the allow="{solana/ethereum}" attribute (where “solana" and “ethereum" values control the corresponding API permissions).
  2. If the iframe is first party to the top-level origin AND the sandbox attribute is set on the iframe, it will be blocked UNLESS sandbox="allow-same-origin" is set. Note "allow-same-origin"` does nothing if the iframe is third-party.
  3. For security-conscious users, we add a setting to block both window.ethereum and window.solana in ALL iframes, regardless of origin or attributes. This matches the default behavior on iOS.

iOS​

Currently on iOS, window.ethereum and window.braveSolana are both undefined in all iframes.

Example cases​

In all these cases, the window.ethereum or window.braveSolana request is coming from the innermost iframe.

  • Top level http://a.com -> blocked (insecure)
  • Top level https://a.com -> allowed
  • Top level https://a.com with <iframe src="http://a.com/"> -> blocked (insecure/3p)
  • Top level http://a.com with <iframe src="https://a.com/"> -> blocked (insecure/3p)
  • Top level https://a.com with <iframe src="https://a.com"> -> allowed
  • Top level https://a.com with <iframe src="https://b.com"> -> blocked (3p)
  • Top level https://b.com with <iframe src="http://a.com/"> with <iframe src="https://b.com"> -> blocked (insecure)
  • Top level https://b.com with <iframe src="https://a.com"> with <iframe src="https://b.com"> -> blocked (3p)
  • Top level https://a.com with <iframe src="https://b.a.com"> -> blocked (3p)
  • Top level https://a.com with <iframe src="https://b.a.com" allow="ethereum"> -> ethereum allowed, solana blocked
  • Top level https://a.com with <iframe src="https://b.com" allow="ethereum"> -> ethereum allowed, solana blocked
  • Top level https://a.com with <iframe src="https://b.a.com" allow="ethereum; solana"> -> ethereum allowed, solana allowed
  • Top level https://a.com with <iframe src="https://a.com" sandbox> -> blocked (sandbox)
  • Top level https://a.com with <iframe src="https://a.com" sandbox="allow-same-origin allow-scripts"> -> allowed (but note this case is discouraged in https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox because it’d allow the iframe to remove its own sandbox attribute)
  • Top level data://foo with <iframe src="data://bar"> -> blocked (insecure)
  • Top level file://foo with <iframe src="file://bar"> -> blocked (3p)
  • Top level https://a.com with <iframe src="https://b.com" sandbox="allow-same-origin allow-scripts"> -> blocked (3p)
  • Top level https://a.com with <iframe src="https://b.com" sandbox="allow-scripts" allow="ethereum; solana"> -> ethereum allowed, solana allowed