COOP: modify redirects handling #5739

camillelamy · 2020-07-17T13:50:45Z

This commit modifies the way we handle redirects with COOP. Instead of always
comparing a response to the current Document, we will compare it to the
previous redirect when enforcing COOP.

At least two implementers are interested (and none opposed):
- Chrome
- Firefox (this is based on @annevk's suggestion in Special case redirects less camillelamy/explainers#12)
Tests are written and can be reviewed and commented upon at:
- COOP: add redirect WPT tests web-platform-tests/wpt#24915
Implementation bugs are filed:
- Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=1108292
- Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1664128
- Safari: N/A

(See WHATWG Working Mode: Changes for more details.)

/browsing-the-web.html ( diff )
/origin.html ( diff )

domenic · 2020-07-17T15:50:17Z

It sounds like @annevk has the background here based on camillelamy/explainers#12, so I'll let him review.

Does this affect observable results? If so we'd want tests (although we could delay that until there's agreement on the approach).

annevk · 2020-07-20T09:18:21Z

Yeah, it does with same-origin-allow-popups (this ends up being stricter).

domenic · 2020-07-24T19:31:04Z

I want to make sure this isn't falling through the cracks... This needs a bit of rebasing, and tests, but probably @annevk could review it still to make sure it's the right approach. So, a gentle ping to both @camillelamy and @annevk :)

camillelamy · 2020-07-28T10:09:15Z

I'm having some issue with my machine + bad internet connection that means I won't be able to write a test for this this week (hence the delay). I'm planning to have one next week to move this forward.

This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy@ work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80

This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy@ work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <[email protected]> Commit-Queue: Pâris Meuleman <[email protected]> Auto-Submit: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#794090}

This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy@ work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <[email protected]> Commit-Queue: Pâris Meuleman <[email protected]> Auto-Submit: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#794090} Co-authored-by: Pâris MEULEMAN <[email protected]>

camillelamy · 2020-08-07T16:19:32Z

I have added a test for the case that will change with this PR at web-platform-tests/wpt#24915.

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy@ work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <[email protected]> Commit-Queue: Pâris Meuleman <[email protected]> Auto-Submit: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#794090} Co-authored-by: Pâris MEULEMAN <[email protected]> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854

domenic · 2020-08-10T18:14:36Z

Excellent, thank you! Could you rebase on master?

camillelamy · 2020-08-12T13:14:03Z

@domenic I have rebased on master, PTAL.

domenic

This LGTM; I pushed some minor editorial tweaks. I would appreciate if @annevk had time to look when he is back as well.

I also took the liberty of editing the original post here to restore the pull request template. All that remains is to file bugs on Gecko and WebKit, which we can do right before or after merging.

This CL changes the handling of redirects in COOP to match whatwg/html#5739. Instead of comparing a response to the current document, we will compare it to the last entry in the redirect chain. Change-Id: I73a3926a8827733974d7c08b7f3553da06435ac3

This CL changes the handling of redirects in COOP to match whatwg/html#5739. Instead of comparing a response to the current document, we will compare it to the last entry in the redirect chain. Change-Id: I73a3926a8827733974d7c08b7f3553da06435ac3 Bug: 1108292

This CL changes the handling of redirects in COOP to match whatwg/html#5739. Instead of comparing a response to the current document, we will compare it to the last entry in the redirect chain. Change-Id: I73a3926a8827733974d7c08b7f3553da06435ac3 Bug: 1108292 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2339988 Commit-Queue: Camille Lamy <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Reviewed-by: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#798083}

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy@ work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <[email protected]> Commit-Queue: Pâris Meuleman <[email protected]> Auto-Submit: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#794090} Co-authored-by: Pâris MEULEMAN <[email protected]> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org> Commit-Queue: Pâris Meuleman <pmeulemanchromium.org> Auto-Submit: Pâris Meuleman <pmeulemanchromium.org> Cr-Commit-Position: refs/heads/master{#794090} Co-authored-by: Pâris MEULEMAN <pmeulemanchromium.org> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854 UltraBlame original commit: 143d914013383261f9af6c0b99d08ad29c6602d0

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org> Commit-Queue: Pâris Meuleman <pmeulemanchromium.org> Auto-Submit: Pâris Meuleman <pmeulemanchromium.org> Cr-Commit-Position: refs/heads/master{#794090} Co-authored-by: Pâris MEULEMAN <pmeulemanchromium.org> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854 UltraBlame original commit: 075d1a7becd6433ebfc6863069293bc5dca69041

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org> Commit-Queue: Pâris Meuleman <pmeulemanchromium.org> Auto-Submit: Pâris Meuleman <pmeulemanchromium.org> Cr-Commit-Position: refs/heads/master{#794090} Co-authored-by: Pâris MEULEMAN <pmeulemanchromium.org> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854 UltraBlame original commit: 143d914013383261f9af6c0b99d08ad29c6602d0

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org> Commit-Queue: Pâris Meuleman <pmeulemanchromium.org> Auto-Submit: Pâris Meuleman <pmeulemanchromium.org> Cr-Commit-Position: refs/heads/master{#794090} Co-authored-by: Pâris MEULEMAN <pmeulemanchromium.org> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854 UltraBlame original commit: 075d1a7becd6433ebfc6863069293bc5dca69041

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org> Commit-Queue: Pâris Meuleman <pmeulemanchromium.org> Auto-Submit: Pâris Meuleman <pmeulemanchromium.org> Cr-Commit-Position: refs/heads/master{#794090} Co-authored-by: Pâris MEULEMAN <pmeulemanchromium.org> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854 UltraBlame original commit: 143d914013383261f9af6c0b99d08ad29c6602d0

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org> Commit-Queue: Pâris Meuleman <pmeulemanchromium.org> Auto-Submit: Pâris Meuleman <pmeulemanchromium.org> Cr-Commit-Position: refs/heads/master{#794090} Co-authored-by: Pâris MEULEMAN <pmeulemanchromium.org> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854 UltraBlame original commit: 075d1a7becd6433ebfc6863069293bc5dca69041

annevk

This looks good to me too, modulo a minor nit.

annevk · 2020-08-18T14:01:39Z

source

+   <var>currentCOOPEnforcementResult</var>'s <span
+   data-x="coop-enforcement-coop">cross-origin opener policy</span>,
+   <var>currentCOOPEnforcementResult</var>'s <span
+   data-x="coop-enforcement-origin">origin</span>,


Do we want to call this current origin or origin? The term used is not consistent.

I think just origin will be simpler. I have changed the name here and below.

…stonly Automatic update from web-platform-tests COOP: change handling of redirects This CL changes the handling of redirects in COOP to match whatwg/html#5739. Instead of comparing a response to the current document, we will compare it to the last entry in the redirect chain. Change-Id: I73a3926a8827733974d7c08b7f3553da06435ac3 Bug: 1108292 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2339988 Commit-Queue: Camille Lamy <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Reviewed-by: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#798083} -- wpt-commits: ed42d5908c6008e054919281f893b7f5cecd5e75 wpt-pr: 24990

This commit modifies the way we handle redirects with COOP. Instead of always comparing a response to the current Document, we will compare it to the previous redirect when enforcing COOP. Editorial tweaks

camillelamy · 2020-09-09T13:11:30Z

Thanks Anne and Domenic! Sorry for the delay, I have rebased the PR so I think it should be good to go.

Automatic update from web-platform-tests COOP: add redirect WPT tests (#24854) This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy@ work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <[email protected]> Commit-Queue: Pâris Meuleman <[email protected]> Auto-Submit: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#794090} Co-authored-by: Pâris MEULEMAN <[email protected]> -- wpt-commits: ea967166620364b1598ef6dbabb7f75100e9472d wpt-pr: 24854

…stonly Automatic update from web-platform-tests COOP: change handling of redirects This CL changes the handling of redirects in COOP to match whatwg/html#5739. Instead of comparing a response to the current document, we will compare it to the last entry in the redirect chain. Change-Id: I73a3926a8827733974d7c08b7f3553da06435ac3 Bug: 1108292 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2339988 Commit-Queue: Camille Lamy <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Reviewed-by: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#798083} -- wpt-commits: ed42d5908c6008e054919281f893b7f5cecd5e75 wpt-pr: 24990

This CL adds a WPT test that checks the interaction of COOP same-origin-allow-popups with redirects as specified in whatwg/html#5739. This follows up on Clamy@ work in https://crrev.com/2312796. Change-Id: I4afede7221c2edeec675035339064c4a9ae7fb80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332260 Reviewed-by: Arthur Sonzogni <[email protected]> Commit-Queue: Pâris Meuleman <[email protected]> Auto-Submit: Pâris Meuleman <[email protected]> Cr-Original-Commit-Position: refs/heads/master@{#794090} Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src Cr-Mirrored-Commit: d906c6267954c2787b269b6fdbaad17baa38a098

This CL changes the handling of redirects in COOP to match whatwg/html#5739. Instead of comparing a response to the current document, we will compare it to the last entry in the redirect chain. Change-Id: I73a3926a8827733974d7c08b7f3553da06435ac3 Bug: 1108292 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2339988 Commit-Queue: Camille Lamy <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Reviewed-by: Pâris Meuleman <[email protected]> Cr-Commit-Position: refs/heads/master@{#798083} GitOrigin-RevId: f338d7dc22470768bb78f1766e8816b15de30884

camillelamy mentioned this pull request Jul 17, 2020

Special case redirects less camillelamy/explainers#12

Open

domenic assigned annevk Jul 17, 2020

annevk added the needs tests Moving the issue forward requires someone to write tests label Jul 20, 2020

chromium-wpt-export-bot mentioned this pull request Aug 3, 2020

COOP: add redirect WPT tests web-platform-tests/wpt#24854

Merged

domenic added the topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header label Aug 10, 2020

camillelamy force-pushed the coop-fix-redirects branch from 40d9d88 to 51fb138 Compare August 12, 2020 12:57

domenic removed the needs tests Moving the issue forward requires someone to write tests label Aug 12, 2020

domenic approved these changes Aug 12, 2020

View reviewed changes

chromium-wpt-export-bot mentioned this pull request Aug 13, 2020

COOP: change handling of redirects web-platform-tests/wpt#24990

Merged

domenic mentioned this pull request Aug 13, 2020

Cross origin opener policy reporting #5518

Merged

3 tasks

annevk approved these changes Aug 18, 2020

View reviewed changes

clamy and others added 2 commits September 9, 2020 15:04

COOP: modify redirects handling

4b7830a

This commit modifies the way we handle redirects with COOP. Instead of always comparing a response to the current Document, we will compare it to the previous redirect when enforcing COOP. Editorial tweaks

Fix origin member name in enforcement result

b4c5430

camillelamy force-pushed the coop-fix-redirects branch from 261955f to b4c5430 Compare September 9, 2020 13:10

annevk merged commit 7d852a3 into whatwg:master Sep 10, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

COOP: modify redirects handling #5739

COOP: modify redirects handling #5739

camillelamy commented Jul 17, 2020 •

edited by pr-preview bot

Loading

domenic commented Jul 17, 2020

annevk commented Jul 20, 2020

domenic commented Jul 24, 2020

camillelamy commented Jul 28, 2020

camillelamy commented Aug 7, 2020

domenic commented Aug 10, 2020

camillelamy commented Aug 12, 2020

domenic left a comment

annevk left a comment

annevk Aug 18, 2020

camillelamy Sep 9, 2020

camillelamy commented Sep 9, 2020

COOP: modify redirects handling #5739

COOP: modify redirects handling #5739

Conversation

camillelamy commented Jul 17, 2020 • edited by pr-preview bot Loading

domenic commented Jul 17, 2020

annevk commented Jul 20, 2020

domenic commented Jul 24, 2020

camillelamy commented Jul 28, 2020

camillelamy commented Aug 7, 2020

domenic commented Aug 10, 2020

camillelamy commented Aug 12, 2020

domenic left a comment

Choose a reason for hiding this comment

annevk left a comment

Choose a reason for hiding this comment

annevk Aug 18, 2020

Choose a reason for hiding this comment

camillelamy Sep 9, 2020

Choose a reason for hiding this comment

camillelamy commented Sep 9, 2020

camillelamy commented Jul 17, 2020 •

edited by pr-preview bot

Loading