1750706 - Links with fragments break Referer header in request

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Scott Macpherson]

Following a link which contains a fragment causes the "Referer" header to be omitted when reloading the page.

Steps to replicate

(I've used python.org as an accessible example, not because this is an issue with python.org.)

1. Open "Network" pane of developer tools
2. Visit https://docs.python.org
3. Select the "modules" link in the header bar
4. Confirm that the resulting network request includes a "Referer" header, set to something like "https://docs.python.org/3/index.html"
5. Reload the page (F5/command-R or window.location.reload();)
6. Confirm that the network request still has the "Referer" header
7. Select one of the alphabetical jump-links at the top of the page
   These use fragments to jump to other elements on the already-loaded page
8. Reload the page
9. Observe that network request no longer contains the "Referer" header

The same issue also occurs when following a link to a new page which also contains a fragment. e.g. following a link to example.com/#foo results in an initial request that contains Referer, but the header is omitted when reloading the page.

Comment 1

[Valentin Gosu [:valentin] (he/him) {{ FYI: OOO 14 June - 4 August }}]

I think this should is coming from here:

https://searchfox.org/mozilla-central/rev/66d0e3cac02896d0249c6077742411722e6333f0/dom/security/ReferrerInfo.cpp#1260

already_AddRefed<nsIReferrerInfo> ReferrerInfo::CreateForFetch(

If I'm not mistaken, we can just compare the URIs without looking at the ref, and that would be OK?

Comment 2

[Manuel Bucher [:manuel]]

Note that aPrincipal->EqualsURI actually compares the URIs without Ref: Bug 1865119

Comment 3

[Frederik Braun [:freddy]]

Mh, maybe the ReferrerInfo::CreateForFetch() should call a comparison of URIs rather than Principals?
At least, if it wants to include the ref....

Comment 4

[Frederik Braun [:freddy]]

Malte, do you think you could take a look at this one?

Comment 5

[Malte Jürgens [:maltejur]]

Sure

Comment 6

[Malte Jürgens [:maltejur]]

Attachment: Bug 1750706 - Copy referrer info to new session history entry during fragment navigation r?freddyb

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1c2a0facd686
Copy referrer info to new session history entry during fragment navigation r=freddyb

Comment 8

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/1c2a0facd686