1301523 - Add a test that checks HTTP auth is isolated by first party domain (Tor 13900)

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Arthur Edelstein [:arthur]]

When privacy.firstparty.isolate is true, we should isolate the HTTP Auth token storage by first party domain.

For Tor Browser, we introduced a patch that prevents 3rd-party HTTP Auth altogether:
https://torpat.ch/13900

But proper isolation based on Origin Attributes would be better.

Comment 1

[Tanvi Vyas[:tanvi]]

(In reply to Arthur Edelstein [:arthuredelstein] from comment #0)
> But proper isolation based on Origin Attributes would be better.

I agree.

Comment 2

[Tanvi Vyas[:tanvi]]

This needs testing and a link to the HTTP Auth code.

Comment 3

[Honza Bambas (:mayhemer)]

This is WORKSFORME, according https://dxr.mozilla.org/mozilla-central/rev/955840bfd3c20eb24dd5a01be27bdc55c489a285/netwerk/protocol/http/nsHttpAuthCache.cpp#26

We isolate http authentication credentials also by origin attributes suffix, so when first party domain is added to origin attributes, it will automatically work.

If this only needs automated tests, then let's turn this bug accordingly.

Tanvi, is this OK?

Comment 4

[Tanvi Vyas[:tanvi]]

Yes, lets convert this to a testing bug.  Thanks Honza!

Comment 5

[Jonathan Hao (inactive) [:jhao]]

Attachment: Add a test that checks HTTP auth is isolated by first party domain.

Hi Honza, would you review this test, please?

This uses the IsolationTestTool.runTest.  In each subtest, the tool opens two tabs with several kinds of combinations of containers and first party domain, and compare the result gotten from `getResult`.


Arthur, could you take a look, too?

Comment 6

[Honza Bambas (:mayhemer)]

Comment on attachment 8797996 [details] [diff] [review]
Add a test that checks HTTP auth is isolated by first party domain.

Review of attachment 8797996 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM

Comment 7

[Arthur Edelstein [:arthur]]

Comment on attachment 8797996 [details] [diff] [review]
Add a test that checks HTTP auth is isolated by first party domain.

Review of attachment 8797996 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me too. Thanks, Jonathan!

Comment 8

[Jonathan Hao (inactive) [:jhao]]

Honza and Arthur, thank you.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=c4f3acbe15e4

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e7939844b393
Add a test that checks HTTP auth is isolated by first party domain. r=mayhemer, r=arthuredelstein

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e7939844b393