1670820 - HSTS cache not working for subresources when privacy.partition.network_state=true

Status: RESOLVED FIXED

(Core :: Networking, defect, P2)

Description

[Arthur Edelstein [:arthur]]

I ran into a possible incorrect behavior when I tried to test HSTS isolation when privacy.partition.network_state is enabled:

Steps to reproduce

• Open a new Firefox Nightly profile. Ensure that privacy.partition.network_state is set to true
• Visit https://arthuredelstein.net/hsts-test1.html. An HSTS header should be received in the image subresource loaded from https://hsts.arthuredelstein.net/set_hsts.png
• Visit https://arthuredelstein.net/hsts-test2.html.

Expected result

The image, http://hsts.arthuredelstein.net/test_hsts.png, should be upgraded to HTTPS and successfully loaded.

Actual result

The image fails to load because the load is not upgraded to HTTPS. Somehow the HSTS state for hsts.arthuredelstein.net is not being respected for subresources under the same first party (arthuredelstein.net).

Comment 1

[Tim Huang[:timhuang]]

Attachment: Bug 1670820 - Part 1: Add a test case to ensure the HSTS of subresources is partitioned. r?baku

Comment 2

[Tim Huang[:timhuang]]

Attachment: Bug 1670820 - Part 2: Use the StoragePrincipalHelper::GetOriginAttributesForHSTS() to get the OA when checking the HSTS for http channels. r?baku

The partitionKey for HSTS is always set with 'http' scheme. So, we
should also use 'http' when checking the HSTS for http channels.

Depends on D93392

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/aa0bd6004405
Part 1: Add a test case to ensure the HSTS of subresources is partitioned. r=baku
https://hg.mozilla.org/integration/autoland/rev/a5eee5b5c9e6
Part 2: Use the StoragePrincipalHelper::GetOriginAttributesForHSTS() to get the OA when checking the HSTS for http channels. r=baku,necko-reviewers,dragana

Comment 4

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/aa0bd6004405
https://hg.mozilla.org/mozilla-central/rev/a5eee5b5c9e6

Comment 5

[Tim Huang[:timhuang]]

Comment on attachment 9181341 [details]
Bug 1670820 - Part 1: Add a test case to ensure the HSTS of subresources is partitioned. r?baku

Beta/Release Uplift Approval Request

• User impact if declined: The HSTS won't work on subresources in early beta because we have enabled the network partitioning in early beta.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): It's just a one-line change. And we have a test for it. So, the risk should be low.
• String changes made/needed:

Comment 6

[Pascal Chevrel (relman team) -> :pascalc]

Comment on attachment 9181341 [details]
Bug 1670820 - Part 1: Add a test case to ensure the HSTS of subresources is partitioned. r?baku

P2, low risk, EARLY_BETA only and has tests, approved for 83 beta 84, thanks.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/ea98cc694c97
https://hg.mozilla.org/releases/mozilla-beta/rev/641938902e14