Remove <head> requirement for <meta name=referrer>
Categories
(Core :: DOM: Security, defect, P3)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox91 | --- | fixed |
People
(Reporter: annevk, Assigned: n.goeggi)
Details
(Whiteboard: [domsecurity-active])
Attachments
(1 file)
As discussed in bug 1698580 Chrome and Safari violate the specification by not enforcing the "in <head>" requirement for this feature. While in that case the site got patched, this might not always happen and the path of least resistance is to change Firefox and the HTML Standard so we should do that.
If whoever takes this bug could also patch the HTML Standard that would be grand, but I'm also happy to help.
|
Reporter | |
Comment 1•5 years ago
|
||
(Moving to DOM: Security as I suppose this code is owned by that team given the other bug.)
|
||
Comment 2•5 years ago
|
||
Anne: is there a github issue or PR for the spec change you can link to in the See Also? You're probably right we should follow Chrome because sites like the one in bug 1698580 are even more likely to rely on full referrers for deep-link protection when 3rd party cookies are dead in chrome. But I don't want to just do it if the spec isn't going to change.
|
|
Reporter | |
Comment 3•5 years ago
|
||
As Chrome and Safari agree there should be no problem getting a PR and tests accepted. I was hoping that whoever fixes this might also want to take that on to get some experience with the standardization process.
|
||
Comment 4•5 years ago
|
||
I am taking this one on because I think it's worth fixing to avoid web combat issues, though it might take some time till I get to it.
|
||
Comment 7•5 years ago
|
||
| bugherder | ||
Description
•