692843 - Need a way to mark a redirection as "safe" for CORS

Status: NEW

(Core :: Networking: HTTP, defect, P5)

Description

[Giorgio Maone [:ma1]]

Some extensions (e.g. HTTPS Everywhere and NoScript) need to transparently redirect channels, and this is broken by CORS when it happens cross-site (e.g. if a HTTP URI is redirected to its HTTPS counterpart), see  https://bugzilla.mozilla.org/show_bug.cgi?id=677643#c65

We need to mark some redirects as "safe" so CORS let them happen without complaints.

Since these redirects already pass nsIChannelEventSink.REDIRECT_INTERNAL flag to nsIChannelEventSink.asyncOnChannelRedirect(), this might be used as a marker requiring no change in the clients. 

If this is deemed unsafe/unpractical, a new eventsink or load flag may be introduced.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Jonas, last time we talked about this you objected to having REDIRECT_INTERNAL without a URI check being treated as OK by CORS.  So I assume you want a new flag?

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Hmm.. I don't really remember my reasoning. It seems like it would be ok to use the REDIRECT_INTERNAL flag here.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Well, there are some REDIRECT_INTERNAL redirects (e.g. .url files) where it's not clear what we really want to do with CORS...

The current code was added in bug 464954, which is sadly light on discussion.  :(

Comment 4

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258