1525036 - Implement Cross-Origin header (requiring CORS for subresources)

Status: RESOLVED FIXED

(Core :: Networking, enhancement, P2)

Description

[Nika Layzell [:nika] (ni? for response)]

GitHub Spec Issue: https://github.com/whatwg/html/issues/4175

Comment 1

[Neha Kochar [:neha]]

https://gist.github.com/annevk/17f580379c45802d5c3aef5a8fd53c7d

Comment 2

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1525036 - Add Test for Cross-Origin header policy r=nika!

Comment 3

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1525036 - Respect CrossOriginPolicy in nsHttpChannel r=nika!

Depends on D21414

Comment 4

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1525036 - Respect CrossOriginPolicy in Fetch r=nika!

Depends on D21415

Comment 5

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1525036 - Add pref for Cross-Origin policy r=nika!

Depends on D21416

Comment 6

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1525036 - Add CrossOriginPolicy to the browsing context r=nika!

Depends on D21417

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6391f42aaa6d
Add Test for Cross-Origin header policy r=nika
https://hg.mozilla.org/integration/autoland/rev/fa0363d33dbd
Respect CrossOriginPolicy in nsHttpChannel r=nika
https://hg.mozilla.org/integration/autoland/rev/502b0bb796cd
Respect CrossOriginPolicy in Fetch r=nika
https://hg.mozilla.org/integration/autoland/rev/0c05686bd62a
Add pref for Cross-Origin policy r=nika
https://hg.mozilla.org/integration/autoland/rev/6717beb3ac53
Add CrossOriginPolicy to the browsing context r=nika

Comment 8

[Natalia Csoregi [:nataliaCs]]

Backed out for /browser_httpCrossOriginHeader.js failures

backout: https://hg.mozilla.org/integration/autoland/rev/9da6e8f78737fbde6a11da1c0b002719b86dbbd5

failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=232785449&repo=autoland&lineNumber=6642

task 2019-03-08T22:33:23.200Z] 22:33:23 INFO - Navigated to: https://example.com/browser/toolkit/components/remotebrowserutils/tests/browser/cross_origin_header.sjs
[task 2019-03-08T22:33:23.201Z] 22:33:23 INFO - Buffered messages finished
[task 2019-03-08T22:33:23.203Z] 22:33:23 INFO - TEST-UNEXPECTED-FAIL | toolkit/components/remotebrowserutils/tests/browser/browser_httpCrossOriginHeader.js | false == true - JS frame :: chrome://mochitests/content/browser/toolkit/components/remotebrowserutils/tests/browser/browser_httpCrossOriginHeader.js :: test_policy/< :: line 41
[task 2019-03-08T22:33:23.205Z] 22:33:23 INFO - Stack trace:
[task 2019-03-08T22:33:23.207Z] 22:33:23 INFO - chrome://mochitests/content/browser/toolkit/components/remotebrowserutils/tests/browser/browser_httpCrossOriginHeader.js:test_policy/<:41
[task 2019-03-08T22:33:23.208Z] 22:33:23 INFO - resource://testing-common/BrowserTestUtils.jsm:withNewTab:111
[task 2019-03-08T22:33:23.209Z] 22:33:23 INFO - chrome://mochitests/content/browser/toolkit/components/remotebrowserutils/tests/browser/browser_httpCrossOriginHeader.js:test_policy:21
[task 2019-03-08T22:33:23.210Z] 22:33:23 INFO - chrome://mochitests/content/browser/toolkit/components/remotebrowserutils/tests/browser/browser_httpCrossOriginHeader.js:test_enabled:65
[task 2019-03-08T22:33:23.211Z] 22:33:23 INFO - chrome://mochikit/content/browser-test.js:Tester_execTest/<:1106
[task 2019-03-08T22:33:23.211Z] 22:33:23 INFO - chrome://mochikit/content/browser-test.js:Tester_execTest:1134
[task 2019-03-08T22:33:23.212Z] 22:33:23 INFO - chrome://mochikit/content/browser-test.js:nextTest/<:995
[task 2019-03-08T22:33:23.213Z] 22:33:23 INFO - chrome://mochikit/content/tests/SimpleTest/SimpleTest.js:SimpleTest.waitForFocus/waitForFocusInner/focusedOrLoaded/<:803
[task 2019-03-08T22:33:23.214Z] 22:33:23 INFO - GECKO(11134) | Waiting for browser load
[task 2019-03-08T22:33:23.215Z] 22:33:23 INFO - GECKO(11134) | Saw state f0001 and status 0
[task 2019-03-08T22:33:23.216Z] 22:33:23 INFO - Console message: [JavaScript Warning: "Loading failed for the <script> with source “chrome://browser/content/aboutNetError.js”." {file: "about:neterror?e=blockedByPolicy&u=https%3A//example.com/browser/toolkit/components/remotebrowserutils/tests/browser/cross_origin_header.sjs&c=UTF-8&f=regular&d=Your%20organization%20has%20blocked%20access%20to%20this%20page%20or%20website." line: 187}]
[task 2019-03-08T22:33:23.217Z] 22:33:23 INFO - GECKO(11134) | Saw state c0010 and status 0
[task 2019-03-08T22:33:23.218Z] 22:33:23 INFO - GECKO(11134) | Browser loaded https://example.com/browser/toolkit/components/remotebrowserutils/tests/browser/cross_origin_header.sjs?anonymous
[task 2019-03-08T22:33:23.219Z] 22:33:23 INFO - Test tab ready: https://example.com/browser/toolkit/components/remotebrowserutils/tests/browser/cross_origin_header.sjs?anonymous

Comment 9

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/214ce4ef682a
https://hg.mozilla.org/mozilla-central/rev/fb2aeeed63c7
https://hg.mozilla.org/mozilla-central/rev/b77be7643141
https://hg.mozilla.org/mozilla-central/rev/e8c317d99a99

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/214ce4ef682ae8e113c3f5604770f05fb2fbb231
https://hg.mozilla.org/integration/autoland/rev/fb2aeeed63c7148e203528b929ff44b121b0f010
https://hg.mozilla.org/integration/autoland/rev/b77be7643141a8f3646257e599b38a3be862e6e0
https://hg.mozilla.org/integration/autoland/rev/e8c317d99a9981648624d28f9bac5dd6fc7b1ad0

Comment 11

[Chris Mills [:cmills]]

Note to MDN writers:

I've added a note to the Fx67 rel notes about this:
https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/67#HTTP

The header still needs documenting, and BCD filling in.

Comment 12

[Anne (:annevk)]

Is it clear to the MDN audience that it's not shipping? We'll also likely tweak the design a bit given ongoing discussion with other implementers.

Comment 13

[Chris Mills [:cmills]]

(In reply to Anne (:annevk) from comment #12)

Is it clear to the MDN audience that it's not shipping? We'll also likely tweak the design a bit given ongoing discussion with other implementers.

Ooops, I missed the bit about the pref! Thanks for the heads up :annevk; I've removed it from the release notes, and instead added an entry to https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Experimental_features#Security to cover it (see the bottom of the table).