1837585 - Page is not loading inside Iframe showing block page issue

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Sudhakar]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/113.0

Steps to reproduce:

When I load an iframe with credentialless enabled using origin trials, then the same domain pages are blocked in iframe

This is the URL where you can reproduce the issue.

https://staging-player.performedia.com/test-all-demo-player/test-gallery-view-for-zoom/?coors-strategy=3

This is the Url which I am adding inside Iframe

https://staging-player.performedia.com/test-all-demo-player/ask-a-question/?&email=[e-mail]&fn=test&ln=last&pmtoken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InBtX3JhZ2hhdkBwZXJmb3JtZWRpYS5jb20iLCJyb2xlIjoidXNlciIsInJvb20iOiI1IiwiZXhwIjoxNjg2MzI5ODUwLCJpYXQiOjE2ODYzMDEwNTB9.9zi47NsScEDijq8d8hoxNRPCz8QkyUtjj8DBzV-eq8g&zoomcomp=yes

Expected results:

Inside the Iframe page should work fine

Comment 1

[Alice0775 White]

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=b588738152848ba9b11bea6ef6d4bca411710e56&tochange=6c46f6f471fb8924d9e50c64e09a1349bb891a95

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

:sefeng, since you are the author of the regressor, bug 1731778, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Sean Feng [:sefeng][PTO, back July 1st]]

Looks like the request of the subdocument caused an redirect, and we blocked the redirect request due to missing COEP headers. Hmm, I think I know what to fix and we need to have a test for this.

Comment 4

[Sean Feng [:sefeng][PTO, back July 1st]]

Attachment: Bug 1837585 - Make the COEP:Credentialless check ignores the subdocument request if it's a redirect r=valentin

We shouldn't block the iframe if the initial request doesn't have valid
headers, we should only check the final request.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1731778

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f1fb26526a2e
Make the COEP:Credentialless check ignores the subdocument request if it's a redirect r=valentin,necko-reviewers

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/40568 for changes under testing/web-platform/tests

Comment 8

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f1fb26526a2e

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:sefeng, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox115 to wontfix.

For more information, please visit BugBot documentation.

Comment 11

[Sean Feng [:sefeng][PTO, back July 1st]]

Comment on attachment 9338353 [details]
Bug 1837585 - Make the COEP:Credentialless check ignores the subdocument request if it's a redirect r=valentin

Beta/Release Uplift Approval Request

• User impact if declined: Websites which have enabled Origin Trial for COEP:Credentialless may not function correctly if they load redirected credentialless iframes.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Not risky because COEP: Credentialless is only behind Origin Trial and the change itself is trivial.
• String changes made/needed:
• Is Android affected?: Yes

Comment 12

[Donal Meehan [:dmeehan]]

Comment on attachment 9338353 [details]
Bug 1837585 - Make the COEP:Credentialless check ignores the subdocument request if it's a redirect r=valentin

Approved for 115.0b7.

Comment 13

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/bc951e896e0c