1340654 - service workers should set referrer policy based on script headers

Status: RESOLVED FIXED

(Core :: DOM: Service Workers, defect)

Description

[Ben Kelly [:bkelly, not reviewing]]

We now set CSP based on service worker script headers, but we still don't set referrer policy.  We should fix that.

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

Related to this we don't apply the referrer policy header to other worker scripts correctly.  We currently do this on importScripts() in addition to the main worker script.  That appears to be incorrect.

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P2 Test that nested referrer policy from an importScripts() has no effect. r=baku

This tests the issue referenced in comment 1.

Comment 3

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P2 Test that nested referrer policy from an importScripts() has no effect. r=baku

Update wpt manifest.

Comment 4

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P3 Test referrer-policy in service workers. r=baku

Partial patch that converts some of the fetch referrer-policy tests to also run in service workers.

Comment 5

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P1 Set referrer policy in service workers. r=baku

Work-in-progress patch to fix the problem.  Does not address comment 1 yet.

Comment 6

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P1 Set referrer policy in service workers. r=baku

I believe this addresses all the problems in this bug.  I want to fix up the tests a bit more before flagging for review, though.

Comment 7

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P3 Test referrer-policy in service workers. r=baku

Comment 8

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P2 Test that nested referrer policy from an importScripts() has no effect. r=baku

Comment 9

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P1 Set referrer policy in service workers. r=baku

Comment 10

[Ben Kelly [:bkelly, not reviewing]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1a9c83f07ab9a48d6719423a400ae84fcff9b61e

Comment 11

[Ben Kelly [:bkelly, not reviewing]]

Comment on attachment 8839524 [details] [diff] [review]
P1 Set referrer policy in service workers. r=baku

This patch makes us apply the referrer-policy header to the WorkerPrivate for service workers coming out of CacheStorage in addition to the nsIChannel path.

It also only sets the referrer-policy if we are operating on the main script.  Previously we were incorrectly overriding the referrer-policy if an importScripts() had the header.

Comment 12

[Ben Kelly [:bkelly, not reviewing]]

Comment on attachment 8839521 [details] [diff] [review]
P2 Test that nested referrer policy from an importScripts() has no effect. r=baku

This verifies that the nested importScripts() with a referrer-policy header does not affect the worker.

Comment 13

[Ben Kelly [:bkelly, not reviewing]]

Comment on attachment 8839519 [details] [diff] [review]
P3 Test referrer-policy in service workers. r=baku

This expands the fetch tests to verify the referrer-policy works in service workers.

Note, I had to adjust some of the URLs in the test files to account for the tests being run from an https origin in service worker tests vs an http origin in the other tests.

Comment 14

[Andrea Marchesini [:baku]]

Comment on attachment 8839519 [details] [diff] [review]
P3 Test referrer-policy in service workers. r=baku

Review of attachment 8839519 [details] [diff] [review]:
-----------------------------------------------------------------

::: testing/web-platform/meta/fetch/api/policies/referrer-origin-service-worker.https.html.ini
@@ +1,5 @@
> +[referrer-origin-service-worker.https.html]
> +  type: testharness
> +  [Cross-origin referrer is overridden by client origin]
> +    expected: FAIL
> +

Do we have a follow up for this? Can we write the bug ID in case?

Comment 15

[Ben Kelly [:bkelly, not reviewing]]

(In reply to Andrea Marchesini [:baku] from comment #14)
> Do we have a follow up for this? Can we write the bug ID in case?

Yes, I think its covered by both bug 1341223 and bug 1298823.

Comment 16

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P3 Test referrer-policy in service workers. r=baku

Comment 17

[Ben Kelly [:bkelly, not reviewing]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3e13b1c4286591585296a2dd116e37fa84045b37

Comment 18

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a02f3229c14c
P1 Set referrer policy in service workers. r=baku
https://hg.mozilla.org/integration/mozilla-inbound/rev/b8ae4c3de328
P2 Test that nested referrer policy from an importScripts() has no effect. r=baku
https://hg.mozilla.org/integration/mozilla-inbound/rev/88206a320746
P3 Test referrer-policy in service workers. r=baku

Comment 19

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/a02f3229c14c
https://hg.mozilla.org/mozilla-central/rev/b8ae4c3de328
https://hg.mozilla.org/mozilla-central/rev/88206a320746