Closed Bug 1399780 Opened 8 years ago Closed 8 years ago

Preloads ignore referrer polices

Categories

(Core :: DOM: Security, enhancement, P2)

Product:
Core
Component:
DOM: Security
Type:
enhancement

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla58
Tracking Flags:
Tracking Status
firefox58 --- fixed

People

(Reporter: franziskus, Assigned: tnguyen)

References

(Blocks 1 open bug)

Details

(Keywords: privacy, testcase-wanted, Whiteboard: [domsecurity-active])

Attachments

(1 file)

Bug 1399780 - Add a test that referrerpolicy attributes are honoured correctly in speculative loading
59 bytes, text/x-review-board-request
ckerschb
: review+
Details
In bug 1397064 we learned that Firefox preloads ignore referrer policies when set as attributes. This shouldn't happen. Referrer policies set in attributes or in the header should be used when performing preloads. Referrer policies set in the meta tag are ignored by preloads.
Group: core-security → dom-core-security
See Also: → 1384493
(In reply to Franziskus Kiefer [:fkiefer or :franziskus] from comment #0) > In bug 1397064 we learned that Firefox preloads ignore referrer policies > when set as attributes. This shouldn't happen. > Referrer policies set in attributes or in the header should be used when > performing preloads. Referrer policies set in the meta tag are ignored by > preloads. I guess you are talking about preload in speculative parser/loading (1) (not <link rel="preload" (2)), bug 1384493 fixed one of (1) for link, but I guess we already supported for image and script. It seems we still don't support (2) and I don't know if there's any explicit spec about that
The document referrer policy should apply to all loads triggered by the document unless overridden by a referrerpolicy attribute on a specific element (in which case that one applies). We need testcases for this so we know what's broken. P2 for the testcase; we can decide the priority for fixing them after that (but probably P3).
Group: dom-core-security
Keywords: sec-low → privacy, testcase-wanted
Priority: -- → P2
Assignee: nobody → tnguyen
Whiteboard: [domsecurity-active]
Status: NEW → ASSIGNED
Referrerpolicy attr is honoured correctly in speculative loading of img and style. We also support referrer policy in rel=preload, but we are missing a test case of that. I would like to file a new bug (Bug 1408347) to add a rel=preload test, because rel=preload seems to be ignored in speculative loading at the moment Bug 1393540.
(In reply to Thomas Nguyen[:tnguyen] ni? plz from comment #3) > Created attachment 8918716 [details] > Bug 1399780 - Add a test that referrerpolicy attributes are honoured > correctly in speculative loading > > Review commit: https://reviewboard.mozilla.org/r/189518/diff/#index_header > See other reviews: https://reviewboard.mozilla.org/r/189518/ Christoph, could you please take a look at the patch? Thanks
Comment on attachment 8918716 [details] Bug 1399780 - Add a test that referrerpolicy attributes are honoured correctly in speculative loading https://reviewboard.mozilla.org/r/189518/#review195284 thanks, r=me, but please remove the meta referrer policy from top ::: dom/base/test/file_bug704320_preload_attr.html:9 (Diff revision 1) > +Test whether the speculative parser should use the referrerpolicy attribute > +https://bugzilla.mozilla.org/show_bug.cgi?id=1399780 > +--> > +<head> > + <meta charset="utf-8"> > + <meta name="referrer" content="unsafe-url"> please remove that meta tag.
Attachment #8918716 - Flags: review?(ckerschb) → review+
Pushed by tnguyen@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/5fdebd6d25a5 Add a test that referrerpolicy attributes are honoured correctly in speculative loading r=ckerschb
https://hg.mozilla.org/mozilla-central/rev/5fdebd6d25a5
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
status-firefox58: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
Blocks: 1409600
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: