-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
For blocked URLs, we should do 200 status code instead of redirects #2554
Comments
Just mentioning this here as well: like #2931 shows, there can be problems with not blocking, too, if the script thinks that it actually managed to load something that we blocked. Possibly these are rarer than the problems solved by not blocking, I don't have numbers, just an FYI. |
@mrzealot Yeah, that makes sense. We are not going to quickly push this change to stable, I think we would rather treat this as an experiment. |
Moving issue to |
@srirambv thanks for pinging me, added QA/Yes |
@iefremov Could you include a test plan in brave/brave-core#1377? I have no idea how to test this one. |
|
Thanks @iefremov ! Verification passed on
Used test plan from #2554 (comment) Verification passed on
Verified passed with
|
Description
We currently redirect to empty data URLs (or empty image data URLs for images).
We should instead be responding with 200 status code because data URLs can cause CSP violations.
I believe this will help with general webcompat no a large scale.
See also:
https://chromium.googlesource.com/chromium/src/+/master/net/docs/life-of-a-url-request.md
Test plan
See #2554 (comment)
The text was updated successfully, but these errors were encountered: