1984973 - Enable Integrity-Policy header by default on release

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Description

[Tom Schuster (MoCo)]

It's currently only enabled in Nightly.

Comment 1

[Tom Schuster (MoCo)]

Seems like Chrome and Safari are shipping/shipped this. We probably want to do the same now. This means we sadly won't have support for the Reporting API.

Comment 2

[Tom Schuster (MoCo)]

Attachment: Bug 1984973 - Enable Integrity-Policy header by default on release. r?simonf

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/038c7bcfe697
https://hg.mozilla.org/integration/autoland/rev/15939356d7a9
Enable Integrity-Policy header by default on release. r=simonf

Comment 4

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/15939356d7a9

Comment 5

[Pascal Chevrel:pascalc]

Tom, do we want to mention that change into our release notes? Thanks

Comment 6

[Tom Schuster (MoCo)]

Release Note Request (optional, but appreciated)
[Why is this notable]: A new HTTP security header.
[Affects Firefox for Android]: yes
[Suggested wording]: Firefox now partially supports the new Integrity-Policy header, which is used to enforce subresource integrity for scripts.
[Links (documentation, blog post, etc)]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Integrity-Policy

Comment 7

[Pascal Chevrel:pascalc]

Note added to our nightly release notes with this wording:

Firefox now partially supports the new Integrity-Policy header, which is used to enforce sub-resource integrity for scripts.

I am keeping the relnote-firefox set to ? until we integrate this note into our final 145 release notes, thanks.

Comment 8

[Hamish Willee]

FF145 MDN docs work for this can be tracked in https://github.com/mdn/content/issues/41511

Hi Tom, Just to be precise, can you please confirm:

• This only enables the headers for use with scripts (not styles)
• Support is partial in that the reporting API is not integrated: reporting endpoints are ignored and violations are logged to console.

Comment 9

[Tom Schuster (MoCo)]

This only enables the headers for use with scripts (not styles)

Correct only scripts. (Style isn't supported anywhere by default, controlled by security.integrity_policy.stylesheet.enabled)

Support is partial in that the reporting API is not integrated: reporting endpoints are ignored and violations are logged to console.

Yes. Unfortunately the only way to know if something was blocked is by looking at the web console.

Comment 10

[Pascal Chevrel:pascalc]

Added to our final 145 release notes.