1731778 - Implement COEP: credentialless

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement)

Description

[Arthur Sonzogni]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36

Steps to reproduce:

Explainer:
https://github.com/WICG/credentiallessness

Filling implementation bug, in order to land spec PR:

• https://github.com/whatwg/html/pull/6638
• https://github.com/whatwg/fetch/pull/1229

Warning. Before implementing COEP:credentialless, you should evaluate the security guarantees hold. In particular, this may be dependant on:

• Private Network Request
• ORB

Actual results:

N/A This is a feature request. Not a bug.

Expected results:

N/A This is a feature request. Not a bug.

Comment 1

[Sean Feng [:sefeng]]

Added bug 1652926 as a dependency due to reporting-navigation.https.window.js test requires that.

Comment 2

[Sean Feng [:sefeng]]

Attachment: Bug 1731778 - Implement COEP: credentialless r=smaug

Spec: https://html.spec.whatwg.org/multipage/#coep:coep-credentialless

Credentialless is a new cross-origin embedder policy which allows us
to not enforcing CORP when loading cross-origin resources while
providing SharedArrayBuffer.

There are two main things involved here:

1. Fetching cross-origin no-CORS resources omits credentials
   • This is done by applying LOAD_ANONYMOUS flag to the request
2. Other requests sent with credentials require the server's explicit
   permission through the CORS protocol or the CORS header
   • This is done by expanding ProcessCrossOriginResourcePolicyHeader
     function to apply the necessary checks.

Comment 3

[Sean Feng [:sefeng]]

Attachment: Bug 1731778 - Implement COEP: credentialless for cache storage r=edenchuang,smaug

Spec: https://fetch.spec.whatwg.org/#ref-for-cross-origin-resource-policy-internal-check

This purpose of this patch is just to implement the spec.

One noticeable thing I did in the patch is I made CacheResponse to
include the credentials mode of the initial request. Consider the
below scenario:

1. Create a fetch request with a URL and a specific credential_mode, and put it into cache
2. Call cache.match by using a URL, but without credential_mode
3. cache.match() result should be filtered according to the initial request's credential_mode

When applying the response’s request-includes-credentials is true
check, the initial request's credential_mode is needed because
request-includes-credentials is judged by the credential_mode.

The rest of the changes are just normal spec alignments.

Comment 4

[Bobby Holley (:bholley)]

We did some analysis in the fall and settled on gating this on ORB but not PNA. Updating the dependencies to reflect that.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fea9b21d8efe
Implement COEP: credentialless r=smaug,necko-reviewers,kershaw
https://hg.mozilla.org/integration/autoland/rev/2510b654e8f2
Implement COEP: credentialless for cache storage r=edenchuang

Comment 6

[Narcis Beleuzu [:NarcisB]]

Backed out for wpt failures on embedding.tentative.https.window.html

Backout link: https://hg.mozilla.org/integration/autoland/rev/14532cf1f7121078abc709d9ad007f48e532cd24
Log link: https://treeherder.mozilla.org/logviewer?job_id=382043695&repo=autoland&lineNumber=2166

Comment 7

[Sean Feng [:sefeng]]

Attachment: Bug 1731778 - Expect some anonymous iframe tests to fail r=smaug

Looks like with the COEP:credentialless implementation, some anonymous
iframe tests start to fail. I didn't investigate this because we don't
support anonymous iframe at the moment, so it's not worth to look into
it.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7c14fa8a4804
Implement COEP: credentialless r=smaug,necko-reviewers,kershaw
https://hg.mozilla.org/integration/autoland/rev/0eec19308453
Implement COEP: credentialless for cache storage r=edenchuang
https://hg.mozilla.org/integration/autoland/rev/c30f5751d54c
Expect some anonymous iframe tests to fail r=smaug

Comment 9

[Iulian Moraru]

Backed out for causing COEP related failures on embedding.tentative.https.window.html.

Push with failures

Failure log

Backout link

[task 2022-06-22T18:08:26.427Z] 18:08:26     INFO - TEST-START | /html/anonymous-iframe/embedding.tentative.https.window.html?9-10
[task 2022-06-22T18:08:26.436Z] 18:08:26     INFO - Closing window 4973c4ff-e5a4-4e4d-adfe-8e06bde00472
[task 2022-06-22T18:08:26.448Z] 18:08:26     INFO - PID 7744 | [Child 2072, Main Thread] WARNING: '!CanHandleWith(aPresContext)', file /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:498
[task 2022-06-22T18:08:26.501Z] 18:08:26     INFO - PID 7744 | [Child 2072, Main Thread] WARNING: '!CanHandleWith(aPresContext)', file /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:498
[task 2022-06-22T18:08:26.678Z] 18:08:26     INFO - PID 7744 | [Child 2072, Main Thread] WARNING: '!CanHandleWith(aPresContext)', file /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:498
[task 2022-06-22T18:08:26.743Z] 18:08:26     INFO - PID 7744 | [Child 2072, Main Thread] WARNING: '!CanHandleWith(aPresContext)', file /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:498
[task 2022-06-22T18:08:26.816Z] 18:08:26     INFO - PID 7744 | [Child 2072, Main Thread] WARNING: '!CanHandleWith(aPresContext)', file /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:498
[task 2022-06-22T18:08:26.842Z] 18:08:26     INFO - PID 7744 | [Parent 7028, Main Thread] WARNING: 'aOwner->IsDiscarded()', file /builds/worker/workspace/obj-build/dist/include/mozilla/dom/SyncedContextInlines.h:95
[task 2022-06-22T18:08:26.853Z] 18:08:26     INFO - PID 7744 | [Parent 7028, Main Thread] WARNING: 'aOwner->IsDiscarded()', file /builds/worker/workspace/obj-build/dist/include/mozilla/dom/SyncedContextInlines.h:95
[task 2022-06-22T18:08:26.978Z] 18:08:26     INFO - PID 7744 | 1655921306992	Marionette	WARN	Ignoring event 'pageshow' because document has an invalid readyState of 'uninitialized'.
[task 2022-06-22T18:08:27.003Z] 18:08:27     INFO - PID 7744 | [Parent 7028, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/dom/base/ThirdPartyUtil.cpp:421
[task 2022-06-22T18:08:27.031Z] 18:08:27     INFO - PID 7744 | 1655921307036	Marionette	WARN	Ignoring event 'pageshow' because document has an invalid readyState of 'uninitialized'.
[task 2022-06-22T18:08:27.038Z] 18:08:27     INFO - PID 7744 | [Parent 7028, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/dom/base/ThirdPartyUtil.cpp:421
[task 2022-06-22T18:08:27.833Z] 18:08:27     INFO - PID 7744 | ### XPCOM_MEM_BLOAT_LOG defined -- logging bloat/leaks to C:\Users\task_165591913118257\AppData\Local\Temp\tmp6x6ubnp9\runtests_leaks_5864_tab_pid2520.log
[task 2022-06-22T18:08:27.840Z] 18:08:27     INFO - PID 7744 | [2520, Main Thread] WARNING: XPCOM_MEM_BLOAT_LOG is set, disabling native allocations.: file /builds/worker/checkouts/gecko/tools/profiler/core/platform.cpp:339
[task 2022-06-22T18:08:41.556Z] 18:08:41     INFO - PID 7744 | [Child 2072, Main Thread] WARNING: IPC message 'PSessionStore::Msg_SessionStoreUpdate' discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:509
[task 2022-06-22T18:08:46.516Z] 18:08:46     INFO - PID 7744 | [Child 8184, Main Thread] WARNING: '!CanHandleWith(aPresContext)', file /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:498
[task 2022-06-22T18:08:46.540Z] 18:08:46     INFO - 
[task 2022-06-22T18:08:46.551Z] 18:08:46     INFO - TEST-UNEXPECTED-FAIL | /html/anonymous-iframe/embedding.tentative.https.window.html?9-10 | COOP:same-origin + COEP:credentialless embeds same-origin anonymous iframe - assert_equals: expected "load" but got "block"
[task 2022-06-22T18:08:46.551Z] 18:08:46     INFO - embeddingTest/<@https://web-platform.test:8443/html/anonymous-iframe/resources/embedding-test.js:70:18
[task 2022-06-22T18:08:46.552Z] 18:08:46     INFO - .
[task 2022-06-22T18:08:46.552Z] 18:08:46     INFO - TEST-OK | /html/anonymous-iframe/embedding.tentative.https.window.html?9-10 | took 20125ms

Comment 10

[Sean Feng [:sefeng]]

Attachment: Bug 1731778 - Wrap the test method into window.onload in script.https.window.js r=smaug

When running the test against the Firefox ASAN builds, sometimes the
test fails because document.body is null. So we wrap the test method
into window.onload to fix that.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0a6f568535df
Implement COEP: credentialless r=smaug,necko-reviewers,kershaw
https://hg.mozilla.org/integration/autoland/rev/923a9ea4733e
Implement COEP: credentialless for cache storage r=edenchuang
https://hg.mozilla.org/integration/autoland/rev/6a467758975a
Expect some anonymous iframe tests to fail r=smaug
https://hg.mozilla.org/integration/autoland/rev/6c46f6f471fb
Wrap the test method into window.onload in script.https.window.js r=smaug

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/34609 for changes under testing/web-platform/tests

Comment 13

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/0a6f568535df
https://hg.mozilla.org/mozilla-central/rev/923a9ea4733e
https://hg.mozilla.org/mozilla-central/rev/6a467758975a
https://hg.mozilla.org/mozilla-central/rev/6c46f6f471fb

Comment 14

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot