1742784 - After a redirect from .onion domain, the Origin header should be null

Status: RESOLVED FIXED

(Core :: Networking, defect, P3)

Description

[Kershaw Chang [:kershaw]]

See https://github.com/whatwg/fetch/pull/1351#discussion_r755751704

Comment 1

[François Marier [:francois]]

See the very last test case at the bottom of http://ixrdj3iwwhkuau5tby5jh3a536a2rdhpbdbu6ldhng43r47kim7a3lid.onion/referrer/onion.html:

Check referrer after a cross-origin POST navigation ending up in a same-origin redirect.

Comment 2

[Kershaw Chang [:kershaw]]

Hi Tom,

Not sure if this bug is still important. Tom, what do you think?
If yes, do you probably have time to fix this?

Thanks.

Comment 3

[Tom Schuster (MoCo)]

Check referrer after a cross-origin POST navigation ending up in a same-origin redirect.

I think this was fixed by the tainting for cross-origin redirects, which of course also applies to cross-origin .onion URLs.

We also have the pref network.http.referer.hideOnionSource.

Comment 4

[Kershaw Chang [:kershaw]]

(In reply to Tom Schuster (MoCo) from comment #3)

Check referrer after a cross-origin POST navigation ending up in a same-origin redirect.

I think this was fixed by the tainting for cross-origin redirects, which of course also applies to cross-origin .onion URLs.

We also have the pref network.http.referer.hideOnionSource.

Thanks, I'll close this bug.