638574 - Prevent cache-related false positive/negative results on CSP demo site

Status: NEW

(Core :: DOM: Core & HTML, enhancement, P5)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

We did not notice that one of the CSP demos broke recently because the browser had cached some resources that caused the broken demo to function correctly. We should ensure that we are getting accurate results. E.g. make all resources in the demo uncacheable using Cache-Control headers, or add a note to the main CSP demo site that instructs the user to clear the cache and refresh.

Comment 1

[Brandon Sterne (:bsterne)]

Good call.  I'm hacking the demo pages at the moment anyway (adding a policy-uri and policy-uri-fails test) so I can add cache-control: no-cache to all those resources.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Or put an appropriate Vary header on the resources?

Comment 3

[Brandon Sterne (:bsterne)]

This should be fixed.  I put:

Header unset ETag
Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
Header set Pragma "no-cache"
Header set Expires "Tue, 01 Jan 1980 06:00:00 GMT"

in the .htaccess for all of the tests and subresources.  Brian, since you filed this bug do you want to test the demo and close the bug if it seems right to you?

http://people.mozilla.org/~bsterne/content-security-policy/demo.cgi

Comment 4

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.