1585417 - Allow to add exceptions to spoofSource network user pref

Status: UNCONFIRMED

(Core :: DOM: Security, enhancement, P5)

Description

[u601362]

+++ This bug was initially created as a clone of Bug #1578015 +++

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

Enable the user_pref "network.http.referer.spoofSource" (set to true)
Login to Google Mail which redirects to accounts.google.com.
Google sends a login request to your registered devices (when you set them up to use for 2 factor authentication).

Actual results:

Immediately after the login page of Google in my Firefox tab sends the login request and it appears on my device, an error popup appears on the login page inside firefox.
This does not occur anymore when I set network.http.referer.spoofSource to "false" again.

Expected results:

I want to be able to specify a list of FQDNs for which the network.http.referer.spoofSource setting will not be applied, for example, accounts.google.com

Comment 1

[Christoph Kerschbaumer [:ckerschb}]

Potentially we could do that. Thomas what do you think?

Comment 2

[Thomas Nguyen (:tnguyen)]

(In reply to sunrisechain from comment #0)

I want to be able to specify a list of FQDNs for which the network.http.referer.spoofSource setting will not be applied, for example, accounts.google.com

I am not quite sure if there's a strong purpose doing that, am I missing anything? Mostly the prefs are used to study how the web reacts with different referrers and see the rate of breakages. Why we should add a whitelist of "broken website" when trying to see how many breakages.
Besides, nowadays the pref is not used widely. The pref is to send a fake referrer (using target uri), but people more often to remove referrer completely (cross-origin with XOriginPolicy or completely with sendRefererHeader).

Comment 3

[u601362]

I don't understand what you mean by "Why we should add a whitelist of "broken website" when trying to see how many breakages."

There should just be an easy way to fix the broken "tap on your phone" 2-step verification mechanism on accounts.google.com. As it was broken by the spoofSource property, I just think its straight forward to disable the "cause" for the malfunction with an exception while keeping up spoofing the source for all other web pages which I potentially distrust.

". but people more often to remove referrer completely (cross-origin with XOriginPolicy or completely with sendRefererHeader)."

I don't understand how I would set this up and whether this gives me complete privacy as well and what other side effects may have.

Comment 4

[Daniel Veditz [:dveditz]]

The hidden spoofSource preference is not a supported option in Firefox. It's a developer/debugging tool with rough edges that works "well enough" that we can't dedicate work to embellish. This is something the open source community will have to contribute if it's wanted.

Comment 5

[u601362]

What exactly doe you think is needed?

Would you accept just the exceptional part or would you require the community to cut off these "rough edges" first?

Comment 6

[u601362]

Ping