1680844 - requestStorageAccess grants for cross-site iframes should give out storageAccessAPI permissions

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, enhancement, P2)

Description

[Johann Hofmann [:johannh]]

Safari will renew user interaction if the storage access API was used successfully, see https://github.com/privacycg/storage-access/issues/5

We should also do this to avoid purging "legitimate" 3rd party storage from parties without first party interaction.

To avoid introducing a loophole for redirect trackers obtaining unjustified interaction, we need to ensure that the permissions is only given out if a cross-site frame is granted access, not a same-site frame or a top-level document.

Comment 1

[Johann Hofmann [:johannh]]

Steve remarked correctly that this should be cross-site not cross-origin to avoid gaming the thing with subdomains.

Comment 2

[Ethan Tseng [:ethan]]

The definition of "storageAccessAPI permission:"

• Has the user interacted with the website?
• storageAccessAPI permissions record every site that the user interacted with and thus mirror history quite closely.

The variable name should be: hasUserEverInteractedWithSiteInFirstPartyContext.

Comment 3

[Benjamin VanderSloot [:bvandersloot]]

Attachment: Bug 1680844 - requestStorageAccess grants for cross-site iframes should give out storageAccessAPI permissions, r=#anti-tracking-reviewers

• Add observation of user interaction (for purpose of handing out storageAccessAPI permission) during grants of requestStorageAccess
  • This will not observe user interaction when a page requests the permission when they already have it, by design
  • This should also not observe user interaction when the grant is due to a heuristic.
• Add tests that verify adding user interaction on grant and autogrant. Plus one more test to verify that we do not add user interaction on deny

Depends on D132024

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fdf5c7623701
requestStorageAccess grants for cross-site iframes should give out storageAccessAPI permissions, r=anti-tracking-reviewers,pbz

Comment 5

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/fdf5c7623701