1839233 - Firefox not sending a referer header for a logo img while Chrome and Safari do

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P5)

Description

[Thomas Wisniewski [:twisniewski]]

The logo at https://lutheransforlife-canada.ca/ does not load in Firefox, because Firefox is not sending a referer header, and the site expects one. As Chrome and Safari do send the header, this is a webcompat issue (as reported at https://github.com/webcompat/web-bugs/issues/123583)

Comment 1

[Daniel Veditz [:dveditz]]

According to DevTools, the Referrer Policy is the standard strict-origin-when-cross-origin, and we think the request is same-origin (Sec-Fetch-Site: same-origin) so we should definitely be sending a referrer. As far as I can tell Referrer Policy is doing the right thing so maybe there's something going on in Networking?

Comment 2

[Valentin Gosu [:valentin] {{ IETF until 25 July - PTO until 3 August }}]

As far as I can tell, the Favicon loader is correctly setting a policy but the computed referrer is empty, so we return early here.

I believe this has something to do with the content-security-policy upgrade-insecure-requests; on the main document response, as ComputeReferrer fails on this line

Comment 3

[Frederik Braun [:freddy] (OOO - back August 10th)]

Indeed, it looks like either ReferrerInfo doesn't take any upgrading into account or it just happens to early?
However, this should also be fixed when we update the logo due to upgrading of passive mixed content.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:freddy, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Calin Tanase]

Attachment: image.png

The issue is no longer reproducing, the logo loads correctly.

Environment:
Operating system: Windows 10
Browser tested: Firefox Nightly 128.0a1 (2024-05-30) / Firefox Release 126