1508292 - Implement Sec-Fetch-* (was: Sec-MetaData)

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P2)

Description

[Christoph Kerschbaumer [:ckerschb]]

We should consider implementing Sec-Metadata; for more info see:
https://github.com/mikewest/sec-metadata

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1508292: Implement Sec-Fetch-*. r=baku

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a0508ae6c037
Implement Sec-Fetch-*. r=baku

Comment 4

[Cristian Brindusan [:cbrindusan]]

Backed out changeset a0508ae6c037 (Bug 1508292) for sm bustage.
https://hg.mozilla.org/integration/autoland/rev/e492baeecfa8694b1bdabff3d8ab507382733a81

Push with failures:
https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedJob=293181508&resultStatus=pending%2Crunning%2Csuccess%2Ctestfailed%2Cbusted%2Cexception&revision=a0508ae6c037928981ac2733860b6ec84d7069ec

Failure log:
https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=293181508&repo=autoland&lineNumber=35252

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5bcb1cba1a89
Implement Sec-Fetch-*. r=baku

Comment 6

[Cristian Brindusan [:cbrindusan]]

Sorry for the backout, my mistake, I've relanded the patch.

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/5bcb1cba1a89

Comment 9

[Andrei Oprea [:andreio]]

Hey, will there be follow up work regarding the regressions or will the pref be turned off by default?

Comment 10

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Andrei Oprea [:andreio] from comment #9)

Hey, will there be follow up work regarding the regressions or will the pref be turned off by default?

The pref will remain false at least until we have resolved performance impact (Bug 1623053, Bug 1623850) and also have implemented the missing spec bits, which are Sec-Fetch-User (Bug 1621987).

Comment 11

[Daniel Veditz [:dveditz]]

The Push regressions (bug 1623400) turned out to be our push server having an implementation limit on the number of headers it expected. Adding three additional Sec-Fetch- headers exceeded that limit by one. Maybe the other regressions are similar, especially on sites that work in Chrome so we know it's not specifically Sec-Fetch- (I believe Chrome sends slightly fewer/smaller headers than we do).