1738694 - Sec-Fetch-User header is missing when opening a link in a new window

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[xPaw]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36

Steps to reproduce:

1. Open https://lab.xpaw.me/headers.php
2. Right click on 'random link' and 'open link in new window'

Also missing when opening in new private window.

Actual results:

"HTTP_SEC_FETCH_USER ?1" header is not sent.

Expected results:

Sec-Fetch-User should be sent as it is a user navigation. It works in Chrome. It works when opening in a new tab.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Networking' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Dragana Damjanovic [:dragana]]

Christoph, can some from your team take a look at this?

Comment 3

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Dragana Damjanovic [:dragana] from comment #2)

Christoph, can some from your team take a look at this?

Niklas, can you take a look?

Comment 4

[Daniel Veditz [:dveditz]]

Confirming: opening in a new TAB is fine, but it's missing in a new WINDOW (private or not). It's also missing if you open a link in a new Container tab (requires installing the Multi-Account Containers web extension to enable).

Comment 5

[Niklas]

Attachment: Bug 1738694: Add sec-fetch tests for openening new windows. r=ckerschb!

Comment 6

[Niklas]

Attachment: Bug 1738694: Assume user activation in _handleURIToLoad() r=ckerschb!,edgar

Comment 7

[Daniel Veditz [:dveditz]]

ni? Christoph to figure out priority of Niklas's bugs

Comment 8

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Daniel Veditz [:dveditz] from comment #7)

ni? Christoph to figure out priority of Niklas's bugs

Tom, is this something you feel comfortable fixing? Would be nice to have.

Comment 9

[Tom S. (please needinfo tschuster)]

Sure, but not immediately.

Comment 10

[Tom Schuster (MoCo)]

Attachment: Bug 1738694 - Use openLinkIn instead of loadURI. r?gijs

Comment 11

[Tom Schuster (MoCo)]

Attachment: Bug 1738694 - Pass around hasValidUserGestureActivation and fromExternal when opening links from the UI or command-line. r?gijs!,edgar!

There are probably more places that we want to annotate with hasValidTransientUserGestureActivation = true, for
example openUILink. This is more of a POC.

Depends on D147514

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/50101abad25f
Use openLinkIn instead of loadURI. r=Gijs
https://hg.mozilla.org/integration/autoland/rev/c8109d217385
Pass around hasValidUserGestureActivation and fromExternal when opening links from the UI or command-line. r=Gijs,edgar
https://hg.mozilla.org/integration/autoland/rev/0fcc34c4614e
Add sec-fetch tests for openening new windows. r=ckerschb

Comment 13

[bszekely]

https://hg.mozilla.org/mozilla-central/rev/50101abad25f
https://hg.mozilla.org/mozilla-central/rev/c8109d217385
https://hg.mozilla.org/mozilla-central/rev/0fcc34c4614e