1724376 - Add a privileged non-document requestStorageAccess API for Shims

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, enhancement, P1)

Description

[Johann Hofmann [:johannh]]

As a way of mitigating some of the breakage we've seen with dFPI without compromising on user privacy or giving websites unfair advantages, we want to write shims that call the Storage Access API on behalf of a website. To avoid some of the complexity of creating a third-party iframe and modifying the site's UI, we'd like to create a new API only accessible to privileged WebExtensions. The function signature could look something like this:

document.requestStorageAccessForOrigin(String origin) -> Promise

where origin would be the origin of the third party, which would then request access for the top-level BC of document. In the regular web-exposed rSA, document belongs to the third-party iframe. We don't want that here since this API is expected to be most frequently called outside of the correct iframe.

Note that this is just a hand-wavy suggestion from me, there might be reasons for the API to e.g. not live on the document or have another shape. It shouldn't really matter as long as we meet the requirements outlined here :)

Besides this special signature, this API should still enforce the same requirements such as user interaction and the automatic grant for up to 5 first-party origins before prompting.

Comment 1

[Tim Huang[:timhuang]]

Attachment: WIP: Bug 1724376 - Part 1: Add a new storage access grant reason for the privilege API. r?dimi

To differentiate the privilege API calls, we need to add a new grant
reason for it.

Comment 2

[Tim Huang[:timhuang]]

Attachment: WIP: Bug 1724376 - Part 2: Add a RejectForeignAllowList::Check() for principal. r?dimi

Depends on D123799

Comment 3

[Tim Huang[:timhuang]]

Attachment: WIP: Bug 1724376 - Part 3: Add ContentBlocking::CheckTrackerForPrincipal(). r?dimi

We add a ContentBlocking::CheckTrackerForPrincipal() which checks
whether a principal belongs to a tracker.

Depends on D123800

Comment 4

[Tim Huang[:timhuang]]

Attachment: WIP: Bug 1724376 - Part 4: Add a ContentBlocking::AsyncShouldAllowAccessFor(). r?dimi

Depends on D123801

Comment 5

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 1: Add a new storage access grant reason for the privilege API. r?dimi!,pbz!

To differentiate the privilege API calls, we need to add a new grant
reason for it.

Comment 6

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 2: Add a RejectForeignAllowList::Check() for principal. r?dimi!,pbz!,sstreich!

Depends on D123803

Comment 7

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 3: Add ContentBlocking::CheckTrackerForPrincipal(). r?dimi!,pbz!

We add a ContentBlocking::CheckTrackerForPrincipal() which checks
whether a principal belongs to a tracker.

Depends on D123804

Comment 8

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 4: Add a ContentBlocking::AsyncShouldAllowAccessFor(). r?dimi!,pbz!

Depends on D123805

Comment 9

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 5: Add support of calling ContentBlocking::AllowAccessFor() for the privilege request storage access API. r?dimi!,pbz!

Depends on D123806

Comment 10

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 6: Implement StorageAccess::AsyncStorageDisabledByAntiTracking(). r?dimi,pbz!

Depends on D123807

Comment 11

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 7: Implement Document::RequestStorageAccessForOrigin() r?pbz,dimi

Depends on D123808

Comment 12

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 8: Use the given origin of the privilege API as the third-party origin in the storage access prompt. r?pbz

Depends on D123809

Comment 13

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 9: Add a test for the privilege storage access API. r?pbz

Depends on D123810

Comment 14

[Tim Huang[:timhuang]]

Attachment: Bug 1724376 - Part 10: Only expose the privilege SSA to system prinicpal and content scripts of webcompt extension. r?dimi

This patch changes the way how we decide to expose the privilege SSA to
document interface. We will expose the interface for system principal
and the content script of the webcompat extension only.

Depends on D123811

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6aad4b4f5657
Part 1: Add a new storage access grant reason for the privilege API. r=dimi,pbz
https://hg.mozilla.org/integration/autoland/rev/aa49afe2bc68
Part 2: Add a RejectForeignAllowList::Check() for principal. r=dimi,pbz,ckerschb
https://hg.mozilla.org/integration/autoland/rev/4ae2f9a20a08
Part 3: Add ContentBlocking::CheckTrackerForPrincipal(). r=dimi,pbz
https://hg.mozilla.org/integration/autoland/rev/339baf19d3c6
Part 4: Add a ContentBlocking::AsyncShouldAllowAccessFor(). r=dimi,pbz
https://hg.mozilla.org/integration/autoland/rev/4676337166a2
Part 5: Add support of calling ContentBlocking::AllowAccessFor() for the privilege request storage access API. r=dimi,pbz
https://hg.mozilla.org/integration/autoland/rev/2231210a2556
Part 6: Implement StorageAccess::AsyncStorageDisabledByAntiTracking(). r=dimi,pbz
https://hg.mozilla.org/integration/autoland/rev/a0dd38e4d95e
Part 7: Implement Document::RequestStorageAccessForOrigin() r=dimi,edgar
https://hg.mozilla.org/integration/autoland/rev/85856ecdc954
Part 8: Use the given origin of the privilege API as the third-party origin in the storage access prompt. r=pbz
https://hg.mozilla.org/integration/autoland/rev/a46e077a1ab9
Part 9: Add a test for the privilege storage access API. r=pbz
https://hg.mozilla.org/integration/autoland/rev/569bb2f56d66
Part 10: Only expose the privilege SSA to system prinicpal and content scripts of webcompt extension. r=dimi,edgar

Comment 16

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/6aad4b4f5657
https://hg.mozilla.org/mozilla-central/rev/aa49afe2bc68
https://hg.mozilla.org/mozilla-central/rev/4ae2f9a20a08
https://hg.mozilla.org/mozilla-central/rev/339baf19d3c6
https://hg.mozilla.org/mozilla-central/rev/4676337166a2
https://hg.mozilla.org/mozilla-central/rev/2231210a2556
https://hg.mozilla.org/mozilla-central/rev/a0dd38e4d95e
https://hg.mozilla.org/mozilla-central/rev/85856ecdc954
https://hg.mozilla.org/mozilla-central/rev/a46e077a1ab9
https://hg.mozilla.org/mozilla-central/rev/569bb2f56d66