1851143 - Enable ORB by default

Status: RESOLVED FIXED

(Core :: DOM: Networking, task, P1)

Description

[Hsin-Yi Tsai (she/her) [:hsinyi]]

ORB has been enabled in nightly/early-beta for several versions.
This bug is to turn ORB on by default in all channels.

Comment 1

[Sean Feng [:sefeng]]

Attachment: Bug 1851143 - Enable OpaqueResponseBlocking in all channels r=farre,smaug

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b080cc5e0239
Enable OpaqueResponseBlocking in all channels r=smaug

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/b080cc5e0239

Comment 4

[Sean Feng [:sefeng]]

Comment on attachment 9351217 [details]
Bug 1851143 - Enable OpaqueResponseBlocking in all channels r=farre,smaug

Beta/Release Uplift Approval Request

• User impact if declined: Release of ORB will miss its target
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This patch enables ORB in everywhere. We have been experimenting ORB for a while, even with a fraction of Release users, so we think it's ready to be shipped.
• String changes made/needed:
• Is Android affected?: No

Comment 5

[Pascal Chevrel:pascalc]

Comment on attachment 9351217 [details]
Bug 1851143 - Enable OpaqueResponseBlocking in all channels r=farre,smaug

Approved for 118.0b6, thanks.

Comment 6

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/22c628190283

Comment 7

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/22c628190283

Comment 8

[Sean Feng [:sefeng]]

Release Note Request (optional, but appreciated)
[Why is this notable]: This is a rather big change that has potential web compatibility risks
[Affects Firefox for Android]: No
[Suggested wording]: OpaqueResponseBlocking is now enabled by default.
[Links (documentation, blog post, etc)]: https://github.com/annevk/orb

The Intent to Ship email might be helpful for drafting the wording: https://groups.google.com/a/mozilla.org/g/dev-platform/c/ROU9eDb8alY

I guess if we want the wording to be more specific and descriptive, we could say "The responses of no-cors cross origin requests might be block to prevent attackers from reading them"?

This should goes to 118 release note.

Comment 9

[Pascal Chevrel:pascalc]

Note Added 10 118 beta