639533 - Request for CSP policy-uri or report-uri doesn't show up in Web Console

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect, P3)

Description

[Brandon Sterne (:bsterne)]

The request for the policy-uri should show up in Web Console so authors can inspect and debug.

Steps to reproduce:
1. open Web Console
2. load http://people.mozilla.org/~bsterne/content-security-policy/tests/policy-uri-test.cgi
3. observe request for page and script file, but no policy-uri

Comment 1

[Brandon Sterne (:bsterne)]

Hey Dave, is there an easy way we can make this request show up on the Web Console:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/CSPUtils.jsm#381

Comment 2

[Brandon Sterne (:bsterne)]

ddahl, ping.

Comment 3

[David Dahl :ddahl]

(In reply to comment #1)
> Hey Dave, is there an easy way we can make this request show up on the Web
> Console:
> http://mxr.mozilla.org/mozilla-central/source/content/base/src/CSPUtils.jsm#381

There must be a way - right now our http listener will just drop this request before logging a page's requests as it cannot identify which document it belongs to.

Here is our httpobserver:
http://mxr.mozilla.org/mozilla-central/source/toolkit/components/console/hudservice/HUDService.jsm?force=1#2147

here is where we try to id the parent window:

http://mxr.mozilla.org/mozilla-central/source/toolkit/components/console/hudservice/HUDService.jsm?force=1#2168

Ccing Jason Duell for advice

Comment 4

[David Dahl :ddahl]

If we have to special case CSP requests, it should be easy to do. I imagine we could add a property to the request like CSP: [OuterWindowID] and sniff for it in our observer.

Comment 5

[Brandon Sterne (:bsterne)]

Jason, any thoughts on this?  This is quite a bad bug for people trying to debug CSP violations, who are forced to use an external HTTP proxy app.  This is doubly hard for HTTPS pages, because Nightly doesn't seem to allow us to add exceptions anymore for the MITM SSL cert.

Comment 6

[Brandon Sterne (:bsterne)]

(In reply to comment #3)
> There must be a way - right now our http listener will just drop this
> request before logging a page's requests as it cannot identify which
> document it belongs to.

I looked at your observer code and it's not clear to me what properties you aren't able to find when the request is dropped.  Could you explain that a bit more, and maybe I can do a better job of annotating the policy-uri and report-uri requests when I send them out?

Comment 7

[Brandon Sterne (:bsterne)]

(In reply to comment #5)
> This is doubly hard for HTTPS pages, because Nightly doesn't seem to allow
> us to add exceptions anymore for the MITM SSL cert.

Ignore this. My profile was screwed up. You can still add an SSL exception for the proxy cert.

Comment 8

[Tanvi Vyas[:tanvi]]

Hey David and Sid,
This bug hasn't been updated in a while and it came up in the devtools work week.  Do we have a hook into the report-uri so that we can surface errors and warnings to the webconsole?

Comment 9

[Sid Stamm [:geekboy or :sstamm]]

I don't know how to add stuff to the web console manually, but here's the code that causes reports to get sent out:

http://mxr.mozilla.org/mozilla-central/source/content/base/src/contentSecurityPolicy.js#257

This bug is about making the requests show up, right, not CSP errors?  If it's about putting CSP warnings and errors in the web console, we can add it inside CSPWarn and CSPError in CSPUtils.jsm.

Comment 10

[Josh Matthews [:jdm]]

The trick for getting messages into the web console is to change http://mxr.mozilla.org/mozilla-central/source/content/base/src/CSPUtils.jsm#90 to use initWithWindowID (http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/idl/nsIScriptError.idl#112). Granted, that requires obtaining the window ID.

Comment 11

[Tanvi Vyas[:tanvi]]

(In reply to Sid Stamm [:geekboy] from comment #9) 
> This bug is about making the requests show up, right, not CSP errors?

Yes you are right Sid.  There might be another but for CSP errors/warnings.  Will look for that, and if it doesn't exist I'll file one.

Comment 12

[Sid Stamm [:geekboy or :sstamm]]

With the new CSP backend, we set the load groups for violation reports and they show up not in the messages of the web console but in the network pane of the web console.  This seems to work.