89995 - WRMB: http referrer from https should be supplied when target is same secure server

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[Stephane Saux]

see bug 82479. We made sure that we would not send the referrer from https to
http but the implementation also removed the referrer in the case when the
request is to the same encrypted server. This is unnecessary broad.

Comment 1

[Stephane Saux]

t->2.1

Comment 2

[Stephane Saux]

*** Bug 89243 has been marked as a duplicate of this bug. ***

Comment 3

[David P. Drinan]

Attachment: Patch for review.

Comment 4

[Darin Fisher]

ddrinan:

you should really use SchemeIs in place of GetScheme/strcmp.

Comment 5

[Bradley Baetz (:bbaetz)]

You should be using strcasecmp to compare the schemes and the hosts, since both
of those are case insensitive, according to the appropriate RFCs.

Comment 6

[Stephane Saux]

adding patch keyword.

Comment 7

[David P. Drinan]

Attachment: Updated patch.

Comment 8

[Bradley Baetz (:bbaetz)]

r=bbaetz. The spec says (RFC2616, 15.1.3):

"  Clients SHOULD NOT include a Referer header field in a (non-secure)
   HTTP request if the referring page was transferred with a secure
   protocol."

Should we check ports as well, or let it through anyway?

Comment 9

[Darin Fisher]

ddrinan, sr=darin provided you fix the indentation to make it consistent with the
rest of nsHttpChannel.cpp (4 spaces of indentation).

Comment 10

[John Unruh]

Mass assigning QA to ckritzer.

Comment 11

[David P. Drinan]

Fix checked in.

Comment 12

[Stephane Saux]

keywords->verifyme

Comment 13

[David P. Drinan]

bbaetz has informed me that this bug is needed for the branch. Re-opening and 
adding keyword topembed.

Comment 14

[Christopher Blizzard (:blizzard)]

sr=blizzard

Comment 15

[chris hofmann]

this is a war room bug that we'ed like to get on the 0.9.2 branch

Comment 16

[John Unruh]

Approved for check in to the branch by verbal comment from chofmann.

Comment 17

[David P. Drinan]

Checked into the 0.9.2 branch. Marking fixed.

Comment 18

[jbailin]

Did this re-break in 0.9.3? 0.9.3 on Linux (RH7.1), I'm very clearly not getting
the referer (sic referrer) header when going from one https document to a linked
https document on the same server.

Comment 19

[jbailin]

Just to add a clarification... the problem I'm seeing is https->https, which is
technically different than this bug. BUT... this worked properly in 0.9.1, so
the patch for this bug may have had the unintended side effect of messing up
https->https.

Comment 20

[David P. Drinan]

This fix did not make it in to 0.9.3. It's checked into the 0.9.2 branch and 
the trunk.

Comment 21

[Stephane Saux]

Attachment: log file from https server showing referrer from same server

Comment 22

[Bradley Baetz (:bbaetz)]

*** Bug 93310 has been marked as a duplicate of this bug. ***

Comment 23

[Bradley Baetz (:bbaetz)]

*** Bug 97303 has been marked as a duplicate of this bug. ***

Comment 24

[Stephane Saux]

*** Bug 100289 has been marked as a duplicate of this bug. ***

Comment 25

[John Unruh]

Verified fixed.

Comment 26

[Bradley Baetz (:bbaetz)]

*** Bug 103838 has been marked as a duplicate of this bug. ***

Comment 27

[Niels Aufbau]

*** Bug 96912 has been marked as a duplicate of this bug. ***