1800990 - Incorrect Origin after scheme upgrade (UIR/HSTS/extension upgradeToSecure), breaks non-wildcard CORS checks

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Rob Wu [:robwu]]

After an (internal) scheme upgrade (whether HSTS or upgrade-insecure-request or internal upgradeToSecure in extensions), Firefox sends Origin: null but internally uses the original origin for CORS access checks. Consequently, the CORS check fails and the request is blocked. The only available work-around is for the server to respond with a wildcard (ACAO: *), but this fails when wildcards are not allowed, e.g. when a request includes credentials.

STR:

1. Visit https://jsfiddle.net/0kq28zgj/1/. This page sets up automatic upgrades from http to https via UIR, and then triggers a cross-origin request to a destination that mirrors the Origin request header back in the Access-Control-Allow-Origin response header. The relevant code is:

   m = document.createElement("meta");
   m.httpEquiv="Content-Security-Policy";
   m.content="upgrade-insecure-requests";
   document.head.append(m);
   // send request to server that mirrors Origin in Access-Control-Allow-Origin
   fetch("http://polished-glitter-21ad.hvfcetgxgijelkmhxy.workers.dev/", {credentials:"include"})
   .then(() => "CORS request succeeded", () => "CORS request failed")
   .then(result => { document.body.textContent = result; });
   

Expected:

• The request should succeed (and get the 404 status that the test server sends).

Actual:

• The request fails. Firefox sends Origin: null, the server reflects it back as Access-Control-Allow-Origin: null, and Firefox then rejects the request with:

  Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://polished-glitter-21ad.hvfcetgxgijelkmhxy.workers.dev/. (Reason: CORS header ‘Access-Control-Allow-Origin’ does not match ‘null’).

• The allowedOriginHeader.Equals(origin) check fails at https://searchfox.org/mozilla-central/rev/d7d2cc647772de15c4c5aa47f74d25d0e379e404/netwerk/protocol/http/nsCORSListenerProxy.cpp#642. I patched a local build of Firefox and printed the two:

  • with allowedOriginHeader being null (taken from Access-Control-Allow-Origin)
  • and origin being https://example.com (from mOriginHeaderPrincipal, from the constructor, ultimately triggeringPrincipal, i.e. the principal of the document from where fetch is called)

For comparison, Safari and Chrome send the original origin (not null), and the request succeeds.

The behavior for this scenario is not in any standard, but I have filed a report at https://github.com/w3c/webappsec-upgrade-insecure-requests/issues/32

Comment 1

[Kershaw Chang [:kershaw] PTO until Jan 2]

Hi Tom,

Since you have been working on origin header, you might be the best one to have a look here.
What do you think? Feel free to bounce back if you don't have time. Thanks.

Comment 2

[Tom Schuster (MoCo)]

This is caused by redirect tainting in Firefox (tested by disabling network.http.origin.redirectTainted). I guess we could extend bug 1781772 to also cover redirects caused by upgrade-insecure-requests.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1605305

Comment 4

[Rob Wu [:robwu]]

When this bug is fixed, please update the test expectation at https://searchfox.org/mozilla-central/rev/6e6332bbd3dd6926acce3ce6d32664eab4f837e5/toolkit/components/extensions/test/xpcshell/test_ext_dnr_without_webrequest.js#260-263 with r=robwu.

Comment 5

[Kershaw Chang [:kershaw] PTO until Jan 2]

Attachment: Bug 1800990 - Don't taint redirected channel for HSTS upgrade, r=freddyb,robwu

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8c1071a3eae0
Don't taint redirected channel for HSTS upgrade, r=robwu,necko-reviewers,tschuster

Comment 7

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/8c1071a3eae0

Comment 8

[Ciprian Georgiu, Desktop QA]

I have reproduced this issue with STR from comment 0, on an affected Nightly build (2022-11-16) running macOS 11.

The issue is verified as fixed on Beta 109.0b5 across OSes: Win 10 x64, macOS 11 and Ubuntu 18.04 x64.