1592651 - Disable Pref respect_document_nosniff for Firefox 71

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P1)

Description

[Sebastian Streich [:sstreich]]

Firefox 71 was supposed to support X-Content-Type-Options Nosniff for Document Loads by default. The 71 Nightly cycle we noticed some major breakage with a few sites (e.g. Bug 1582671 ) which was caused because of our implementation being to strict.
Currently we have agreed to soften our implementation and observe potential breakage in Bug 1591932, which would ship in 72.
So there is no use in the strict implementation to be enabled for ff 71.

Comment 1

[Sebastian Streich [:sstreich]]

Attachment: Bug 1592651 Disable Pref respect_document_nosniff for Firefox 71 r=ckerschb

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e66da643d9bc
Disable Pref respect_document_nosniff for Firefox 71 r=ckerschb

Comment 3

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/e66da643d9bc

Comment 4

[Sebastian Streich [:sstreich]]

Comment on attachment 9105281 [details]
Bug 1592651 Disable Pref respect_document_nosniff for Firefox 71 r=ckerschb

Beta/Release Uplift Approval Request

• User impact if declined: Currently on beta Pages with Content-Type: "none"/ "*" and X-Content-Type-Options: Nosniff
  are broken. This Patch disables the No-sniff Code which is responsible.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Low as we're just flipping the pref to disable nosniff, as we did in ff 70.
• String changes made/needed:

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9105281 [details]
Bug 1592651 Disable Pref respect_document_nosniff for Firefox 71 r=ckerschb

Disables a feature which isn't ready to ship yet in 71. Approved for 71.0b7.

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/8d80490b3d4b

Comment 7

[Kohei Yoshino [:kohei]]

Updated the site compatibility note.

Comment 8

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e66da643d9bc