1457204 - CSP: Implement "resource hint" blocking (previously prefetch-src)

Status: NEW

(Core :: DOM: Security, task, P3)

Description

[Yoav Weiss]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36

Steps to reproduce:

In order to block potential data leaks through prefetch requests, it was decided [1] that a `prefetch-src`CSP directive would be added and control such requests, and that prefetch requests would have their own `Request.initiator` and an empty string destination[2].

[1] https://github.com/w3c/webappsec-csp/issues/107
[2] https://github.com/whatwg/fetch/pull/659




Actual results:

Going to http://w3c-test.org/content-security-policy/prefetch-src/ the tests fail


Expected results:

They should pass

Comment 1

[Hamish Willee]

FWIW it looks like the spec no longer suggests using prefetch-src. If you follow the Chromium implementation bug they used least restrictive - which is in spec here: https://w3c.github.io/webappsec-csp/#does-resource-hint-violate-policy

Comment 2

[Tom Schuster (MoCo)]

Attachment: WIP: Bug 1457204 - CSP: Implement "resource hint" blocking for explicit <link rel=prefetch>

Depends on D197153