1276836 - Implement same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Thomas Nguyen (:tnguyen)]

According to [1], same-origin policy specifies a full URL referrer information is sent when making same-origin requests and no referrer information is sent when making cross-origin requests
[1] https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-same-origin

Comment 1

[Thomas Nguyen (:tnguyen)]

Update title.
There're 2 news policies which have added to Referrer-Policy spces last week : strict-origin and strict-origin-when-cross-origin. Implementing (and also testing) the support of same-origin, strict-origin and strict-origin-when-cross-origin are quite similar. I would like to fix them all in this bug.

Comment 2

[Thomas Nguyen (:tnguyen)]

The 3 policies are only applied to Referrer-Policy header and meta referrer. As [1], the new policies are still not applied to referrer policy element attribute.
[1] https://html.spec.whatwg.org/multipage/infrastructure.html#referrer-policy-attribute
I will keep my eye on the specs to update.

Comment 3

[Thomas Nguyen (:tnguyen)]

Attachment: Implement same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

MozReview-Commit-ID: 2yIV2zfMABJ

Comment 4

[Thomas Nguyen (:tnguyen)]

Attachment: Update and add tests for same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

MozReview-Commit-ID: 9ISKTDHBSHP

Comment 5

[Thomas Nguyen (:tnguyen)]

Comment on attachment 8772328 [details] [diff] [review]
Implement same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

Hi Patrick,
There're several changes in netwerk, such as adding new referrer policy to nsIHttpChannel.idl and handling policy in HttpBaseChannel.cpp.
Could you please take a look on that?
Thank you very much

Comment 6

[François Marier [:francois]]

(In reply to Thomas Nguyen[:tnguyen] (use ni? plz) from comment #2)
> The 3 policies are only applied to Referrer-Policy header and meta referrer.
> As [1], the new policies are still not applied to referrer policy element
> attribute.
> [1]
> https://html.spec.whatwg.org/multipage/infrastructure.html#referrer-policy-
> attribute

That's on my TODO list (https://github.com/w3c/webappsec-referrer-policy/issues/50#issuecomment-230202635). I will be submitting a patch to the HTML spec soon (hopefully this week).

Comment 7

[Thomas Nguyen (:tnguyen)]

Great, just checked specs and they are added to HTML specs today. In term of implementation, that's enough to resolve this bug. 
We still need to add the specs to Fetch's spec ( [1] I filed an issue for that and probably could help sometime). And we could add that change to bug 1264792 or bug 1184549 which track changes of fetch according to new referrer policy API
[1] https://github.com/whatwg/fetch/issues/342

Comment 8

[Thomas Nguyen (:tnguyen)]

Great, just checked specs and the 3 policies are added to HTML specs today. In term of implementation, that's enough to resolve this bug. 
We still need to add the specs to Fetch's spec ( [1] I filed an issue for that and probably could help sometime). And we could add that change to bug 1264792 or bug 1184549 which track changes of fetch according to new referrer policy API
[1] https://github.com/whatwg/fetch/issues/342
Thanks Francois for the help

Comment 9

[Thomas Nguyen (:tnguyen)]

Attachment: Implement same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

MozReview-Commit-ID: LdJtoM0JI8H

Comment 10

[Thomas Nguyen (:tnguyen)]

Updated, carried r+ necko reviewed

Comment 11

[Thomas Nguyen (:tnguyen)]

Attachment: Update and add tests for same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

MozReview-Commit-ID: 9ISKTDHBSHP

Comment 12

[Thomas Nguyen (:tnguyen)]

Updated test case, add the new policies to old test case. :)
Beside necko team, I still need a little review on this. Hi Josh, could you please look into this?
Thanks for your help

Comment 13

[Josh Matthews [:jdm]]

Comment on attachment 8775432 [details] [diff] [review]
Update and add tests for same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

Review of attachment 8775432 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/base/test/test_anchor_area_referrer_invalid.html
@@ +62,5 @@
>           SCHEME_FROM: 'https',
>           SCHEME_TO: 'http',
>           DESC: "origin-when-cross-origin (anchor) with origin in meta",
> +         RESULT: 'origin'},
> +        {ATTRIBUTE_POLICY: 'strict-origin-when-cross-origin',

I'm not sure that this is a useful test to add here. This file has evolved from its original purpose (verify that invalid referrer-policy attributes did the right thing) since bug 1178337, so these tests seem like they're just duplicating cases we have in other files at this point.

::: dom/base/test/test_iframe_referrer_invalid.html
@@ +70,5 @@
>          {NAME: 'no-referrer-in-meta',
>           META_POLICY: 'no-referrer',
>           DESC: "no-referrer in meta",
> +         RESULT: 'none'},
> +        {ATTRIBUTE_POLICY: 'strict-origin-when-cross-origin',

I have the same concern in this test file as the other one.

::: dom/base/test/test_referrer_policy_header.html
@@ +1,5 @@
> +<!DOCTYPE HTML>
> +<html>
> +<head>
> +  <meta charset="utf-8">
> +  <title>Test same-origin, strict-origin, strict-origin-when-cross-origin referrer policy header for Bug 1276836</title>

Rather than creating this new test from scratch (which only tests the new header values, not the old ones), why don't we update the existing Referrer-Policy header tests that exist in web-platform-tests instead?

Comment 14

[Thomas Nguyen (:tnguyen)]

Thanks Josh,
Just found that our web-platform-test is synced to [1] and many new same-origin policy tests are added last 2 weeks. I will update our web-platform-test meta according to that.

[1] https://github.com/w3c/web-platform-tests/tree/master/referrer-policy


(In reply to Josh Matthews [:jdm] from comment #13)
> Rather than creating this new test from scratch (which only tests the new
> header values, not the old ones), why don't we update the existing
> Referrer-Policy header tests that exist in web-platform-tests instead?

I would like to add more test cases for strict-policy* similar to same-origin and others policies, because we have tools/generate.py and templates to do that. It may increase the number of adding file in the patch :)

Comment 15

[Thomas Nguyen (:tnguyen)]

Should be better to fix in github web-platform-tests and sync to mozilla-central later.
Link:
https://github.com/w3c/web-platform-tests/issues/3436

Comment 16

[Thomas Nguyen (:tnguyen)]

Thanks Josh for looking into https://github.com/w3c/web-platform-tests/issues/3436

Hi James
We have new strict-origin* referrer policy web platform tests are added to github. Could we sync the new web-platform-tests from github sooner?
Thanks

Comment 17

[James Graham [:jgraham]]

This is ongoing, but for various reasons (PTO + etc.) is taking a little longer than normal. I have a not-quite green try run now, so with a little more metadata adjustment we should get there.

Comment 18

[Thomas Nguyen (:tnguyen)]

Thanks James, I see the tests are synced.
Updated web-platform tests, but I would like to wait for landing Bug 1292299 to rebase.

Comment 19

[Thomas Nguyen (:tnguyen)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=674c2c6b06e0

Comment 20

[Thomas Nguyen (:tnguyen)]

Attachment: Update web-platform-test same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

MozReview-Commit-ID: 9jhqm4cmQIn

Comment 21

[Thomas Nguyen (:tnguyen)]

Attachment: Update web-platform-test same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

MozReview-Commit-ID: Gl8rxMM0eRP

Comment 22

[Thomas Nguyen (:tnguyen)]

Attachment: Update and add tests for same-origin, strict-origin, strict-origin-when-cross-origin referrer policy

MozReview-Commit-ID: 9ISKTDHBSHP

Comment 23

[Thomas Nguyen (:tnguyen)]

Rebased and updated web-platform-tests.
Hi Josh, could you please take a look at this?
Thanks

Comment 24

[Thomas Nguyen (:tnguyen)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b8b807cd5887

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/890c2d9417c5
Implement same-origin, strict-origin, strict-origin-when-cross-origin referrer policy. r=mcmanus,jdm
https://hg.mozilla.org/integration/mozilla-inbound/rev/3500d2927d52
Update and add tests for same-origin, strict-origin, strict-origin-when-cross-origin referrer policy. r=jdm
https://hg.mozilla.org/integration/mozilla-inbound/rev/63454fe35579
Update web-platform-test same-origin, strict-origin, strict-origin-when-cross-origin referrer policy. r=jdm

Comment 26

[Iris Hsiao [:ihsiao]]

https://hg.mozilla.org/mozilla-central/rev/890c2d9417c5
https://hg.mozilla.org/mozilla-central/rev/3500d2927d52
https://hg.mozilla.org/mozilla-central/rev/63454fe35579

Comment 27

[Florian Scholz (Open Web Docs)]

https://developer.mozilla.org/en-US/Firefox/Releases/52#HTTP
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy