1618113 - Allow 'secure' cookies when set by localhost

Status: RESOLVED FIXED

(Core :: Networking: Cookies, task)

Description

[Andrea Marchesini [:baku]]

Localhost is considered a trusted origin in many APIs and contexts but not by our cookie service. For instance, localhost is allowed to use SecureContext-only API even if not in https.

 9.   If the scheme component of the request-uri does not denote a
        "secure" protocol (as defined by the user agent), and the
        cookie's secure-only-flag is true, then abort these steps and
        ignore the cookie entirely.

By RFC6525, the definition of 'secure' protocol is defined by the user-agent. I propose to unify the implementations and use nsMixedContentBlocker::IsPotentiallyTrustworthyOrigin() instead of a simple "https" scheme check.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: Bug 1618113 - Allow 'secure' cookies when set by localhost, r?ehsan

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c4d13b3ca1e2
Allow 'secure' cookies when set by localhost, r=Ehsan

Comment 3

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/c4d13b3ca1e2