1744611 - HTTP Response Header: `Clear-Site-Data: "cache"` should flush in-page assets (JS/CSS) from the cache

Status: RESOLVED FIXED

(Toolkit :: Data Sanitization, enhancement, P3)

Description

[stephen.cunliffe]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0

Steps to reproduce:

In trying to overcome an unrelated aggressive caching bug in a competitor browser I created a test page to send an HTTP Response Header: Clear-Site-Data: "cache" to flush the cache in the end user's browser (while maintaining cookies to keep a session alive)

This works fine in Chromium based browsers, but doesn't flush in-page assets (JS/CSS) from the cache in Firefox. (Works as expected in Chrome/Chromium Edge)

Actual results:

Requests to clear the site data cache were not honored, sub-content on the page (JS/CSS) continued to pull from the cache vs. fetch new resources.

Expected results:

HTTP cache for the specified domain should have been cleared (cookies, localStorage, etc. to remain untouched)

Comment 1

[stephen.cunliffe]

Composing a minimal test case to exhibit this bug, will upload shortly.

Comment 2

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Toolkit::Data Sanitization' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 3

[stephen.cunliffe]

Attachment: PHP simplest test case firefox-cache-clear-bug-1744611.zip

Load the attached test case index.php file in the browser on localhost AND/OR an HTTPS server.

With the attached test case, you can reload the page several times via the link or "Reload Page" button. Note that the server time reported (in the yellow box) remains the same from when it was loaded vs. the "executed" time that update to whenever the page is loaded.

Now press the "Reload Page (and FORCE CACHE CLEAR)" button... the page will reload with an extra param that sets the Clear cache header... then does a 302 redirect to load the page clean (w/o the param)

The browser should reload the linked JavaScript file from the server (after wiping the cache) and thus the server time should update to "now".

Test in Chromium: Works
Test in Firefox: Fails

Comment 4

[Emma Zühlcke [:emz]]

Bug 1671182 disabled cache clearing via the Clear-Site-Data header.

Comment 5

[Manuel Bucher [:manuel]]

Restoring bug due to plan to restore Clear-Site-Data: cache header support.

Comment 6

[Manuel Bucher [:manuel]]

This should take Bug 1730197 into consideration when implementing.

Comment 7

[Manuel Bucher [:manuel]]

Attachment: Bug 1744611 - Clear-Site-Data: "cache": Also clear CSS and Image cache

This changes the "ClearByPrincipal" of caches to the way it is used in
the Clear-Site-Data: "cache" code path for networking cache.

Same site (same origin attributes) and same origin.

Could warant IsSamePartitionAndOrigin function in nsIPrincipal. If so,
could be done in a follow-up.

Comment 8

[Manuel Bucher [:manuel]]

Pernosco session used to debug (+print debugging): https://pernos.co/debug/5A3ixkTk_VXfoht9I1vg2g/index.html

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8f7333075d1c
https://hg.mozilla.org/integration/autoland/rev/def0d97874c0
Clear-Site-Data: "cache": Also clear CSS and Image cache r=emilio,anti-tracking-reviewers,timhuang

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0dbb349df4bb
https://hg.mozilla.org/integration/autoland/rev/4521b7fbd3f6
Revert "Bug 1744611 - Clear-Site-Data: "cache": Also clear CSS and Image cache r=emilio,anti-tracking-reviewers,timhuang" for causing bc failures @ browser_css_cache.js

Comment 11

[Sandor Molnar[:smolnar]]

Backed out for causing bc failures @ browser_css_cache.js

Backout link: https://hg.mozilla.org/integration/autoland/rev/4521b7fbd3f63095991089c84fa318eef45078d9

Push with failures

Failure log -> TEST-UNEXPECTED-FAIL | toolkit/components/cleardata/tests/browser/browser_css_cache.js | https://example.com is not cached - Got true, expected false

Comment 12

[Manuel Bucher [:manuel]]

Related test cases need to be adjusted.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/9f4ee9a5c0e5
https://hg.mozilla.org/integration/autoland/rev/470a75f966da
Clear-Site-Data: "cache": Also clear CSS and Image cache r=emilio,anti-tracking-reviewers,timhuang

Comment 14

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/470a75f966da