1557346 - Experiment limit `referer` header length

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement)

Description

[Thomas Nguyen (:tnguyen)]

Chrome shipped referrer size limitation to 4k now but ideally, we should bring it down to 2k. I am going to create a pref here and choose referrer limitation then we could do more experiments.

Comment 1

[Thomas Nguyen (:tnguyen)]

The percentiles look like:

• 25.00% 27.53
• 50.00% 44.76
• 75.00% 79.71
• 95.00% 263.3
• 99.00% 986.5
• 99.50% 1232
• 99.90% 1956
• 99.99% 4162

And Chrome decided to use 4k

Comment 2

[Thomas Nguyen (:tnguyen)]

Attachment: Bug 1557346 - Limit referer header length

Comment 3

[Chris Mills [:cmills]]

We probably ought to mention this in the docs once implemented.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9ba600ae3c02
Limit referer header length r=ckerschb

Comment 5

[Raul Gurzau (:RaulG)]

Backed out changeset 9ba600ae3c02 (bug 1557346) for eslint failure at netwerk/test/unit/test_referrer.js on a CLOSED TREE.

Backout link: https://hg.mozilla.org/integration/autoland/rev/450801fafd10d18e6fce669408c551593b2028a7

**Push with failures:**https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&resultStatus=testfailed%2Cbusted%2Cexception&revision=9ba600ae3c02a21a273596f2c98a2c47b0ee7c6e&selectedJob=255495683

Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=255495683&repo=autoland&lineNumber=232

Log snippet: [task 2019-07-09T14:51:19.253Z] eslint installed successfully!
[task 2019-07-09T14:51:19.253Z]
[task 2019-07-09T14:51:19.253Z] NOTE: Your local eslint binary is at /builds/worker/checkouts/gecko/node_modules/.bin/eslint
[task 2019-07-09T14:51:19.253Z]
[task 2019-07-09T15:12:48.647Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/netwerk/test/unit/test_referrer.js:220:16 | Replace getTestReferrer(server_uri,?referer_uri),?"http://foo.example.com/" with ?????getTestReferrer(server_uri,?referer_uri),?????"http://foo.example.com/"??? (prettier/prettier)
[taskcluster 2019-07-09 15:12:49.045Z] === Task Finished ===
[taskcluster 2019-07-09 15:12:49.802Z] Unsuccessful task run with exit code: 1 completed in 1496.032 seconds

Comment 6

[Thomas Nguyen (:tnguyen)]

I forgot rebasing with our codebase. Updated

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5fb0a623158e
Limit referer header length r=ckerschb

Comment 8

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/5fb0a623158e

Comment 9

[Kohei Yoshino]

Posted site compatibility note: https://www.fxsitecompat.dev/en-CA/docs/2019/referer-header-size-is-now-limited-to-4-kb/

Comment 10

[Florian Scholz (Open Web Docs)]

https://wiki.developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer#Browser_compatibility
https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/70#HTTP