1815738 - Add telemetry to record the type of resource that requests auth

Status: RESOLVED FIXED

(Core :: Networking: HTTP, enhancement, P2)

Description

[Hannah Peuckmann]

As a follow up of Bug 791594 - 401 password prompt spoofing thing we would like to get telemetry on what resources request http authentication, special attention will go to top level requests from a cross domain resource because this will be the case that the patch applies to. Also, subresource cross domain requests are interesting, to see if it would be beneficial to apply the auth spoofing protections to those as well.
Our idea is to enable AUTH_DIALOG_STATS_3 again and adjust it so that it also catches the top level cross domain requests.

Comment 1

[Hannah Peuckmann]

Attachment: Bug 1815738 - record type of 401 request.r=pbz!

Comment 2

[Hannah Peuckmann]

Attachment: data_rewiew_request.md

Comment 3

[Will Kahn-Greene [:willkg] ET needinfo? me]

Comment on attachment 9318140 [details]
data_rewiew_request.md

For a renewal, we need the links to the original data review. So I think either someone needs to find links or we need to do a full data review request.

Comment 4

[Hannah Peuckmann]

Attachment: data_review_request.md

Comment 5

[Hannah Peuckmann]

Thank you, I filled out a request for a full data review now.

Comment 6

[Will Kahn-Greene [:willkg] ET needinfo? me]

Comment on attachment 9318986 [details]
data_review_request.md

Data Review Form

1. Is there or will there be documentation that describes the schema for the ultimate data set in a public, complete, and accurate way?

Yes. The metrics are documented in toolkit/components/telemetry/Histograms.json .

2. Is there a control mechanism that allows the user to turn the data collection on and off?

Standard Telemetry mechanisms.

3. If the request is for permanent data collection, is there someone who will monitor the data over time?

N/A

4. Using the category system of data types on the Mozilla wiki, what collection type of data do the requested measurements fall under?

Category 1.

5. Is the data collection request for default-on or default-off?

Standard Telemetry default-on.

6. Does the instrumentation include the addition of any new identifiers (whether anonymous or otherwise; e.g., username, random IDs, etc. See the appendix for more details)?

No.

7. Is the data collection covered by the existing Firefox privacy notice?

Yes.

8. Does the data collection use a third-party collection tool?

No.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5912bbda2937
record type of 401 request.r=necko-reviewers,pbz,valentin

Comment 8

[Serban Stanca [:SerbanS]]

Backed out for causing xpcshell failures in netwerk/test/unit/test_auth_dialog_permission.js.

• Backout link
• Push with failures
• Failure Log
• Failure line 1: TEST-UNEXPECTED-FAIL | netwerk/test/unit/test_auth_dialog_permission.js | xpcshell return code: -11
• Failure line 2: PROCESS-CRASH | netwerk/test/unit/test_auth_dialog_permission.js | application crashed [@ RefPtr<mozilla::dom::WindowContext>::get() const]

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c3df33bafd47
record type of 401 request.r=necko-reviewers,pbz,valentin

Comment 10

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/c3df33bafd47

Comment 11

[Andrej (:aglavic)]

(In reply to Pulsebot from comment #9)

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c3df33bafd47
record type of 401 request.r=necko-reviewers,pbz,valentin

== Change summary for alert #37539 (as of Mon, 06 Mar 2023 20:51:06 GMT) ==

Improvements:

Ratio	Test	Platform	Options	Absolute values (old vs new)
12%	perf_reftest_singletons style-attr-1.html	windows10-64-shippable-qr	e10s fission stylo webrender	3.22 -> 2.83

For up to date results, see: https://treeherder.mozilla.org/perfherder/alerts?id=37539