Referrers: Flip ReducedReferrerGranularity to enabled by default #26441

chromium-wpt-export-bot · 2020-11-07T01:02:35Z

We rolled out ReducedReferrerGranularity, which changes the default
referrer policy to strict-origin-when-cross-origin, to 100% in M85
stable. To clean up the experiment, we need to enable the behavior by
default. This will take effect in M88; we'll follow up by removing the
flag, the corresponding enterprise policy, and the corresponding field
trial testing configuration.

Changing this base::Feature's default value entails cleaning up the
remaining tests that weren't within the field trial testing config's
scope. These changes are mostly straightforward, involving updating
expectations of full-URL referrers to expectations of the corresponding
origins, but some tests require logic changes to make sure that they
still cover the desired behavior. (For instance, multiple tests
previously expected origins in order to test that a particular,
arbitrary, non-default referrer policy took effect: to achieve a similar
effect, this CL updates these tests to now expect full URLs and swaps
in non-default full-URL-generating policies for the prior non-default
origin-generating policies.)

Launch approval: crbug.com/1019930
Spec change: w3c/webappsec-referrer-policy#142

Bug: 1014207, 1131688
Change-Id: Ib575af6a858641fb1fe2c8de73941f5702d88191
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2429247
Reviewed-by: Charlie Reis <creis@chromium.org>
Reviewed-by: Dominic Farolino <dom@chromium.org>
Reviewed-by: Kunihiko Sakamoto <ksakamoto@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#828098}

wpt-pr-bot

The review process for this patch is being conducted in the Chromium project.

domfarolino · 2020-11-11T00:25:17Z

Hey @annevk, I'm wondering if you could take a look at the non-generated files in this PR. We'd like to land this change which is currently blocking the merge of w3c/webappsec-referrer-policy#142, but since we're changing an important default value in the spec, I want to make sure another vendor takes a look.

There are not too many files in this PR to take a look at when you exclude all of the */gen/* ones under //referrer-policy, so hopefully this isn't too big an ask :)

Edit: We've determined that the wpt-chrome-dev-stability bot failure is unrelated, so no worries there.

annevk

I think this looks reasonable though I didn't look at all the things. Is this default referrer policy also reflected in fetch requests that end up in a service worker and is that tested?

One thing that seems broken and needs a follow-up is that spec.src.json is not JSON. You cannot have comments in JSON.

Will bugs be filed against other browsers as part of the specification change? Or are they already filed? I lost track I'm afraid.

annevk · 2020-11-11T08:46:39Z

html/browsers/windows/browsing-context.html

-    test(function () {
-      assert_equals(doc.referrer, document.URL, "The document's referrer should be its creator document's address.");
+    test(function() {
+      assert_equals(doc.referrer, document.location.origin + '/', "The document's referrer should be its creator document's address's origin.");


Nit: no need for "address" here.

Thanks for the review!

Nit: no need for "address" here.

Done; thanks for the suggestion

I think this looks reasonable though I didn't look at all the things. Is this default referrer policy also reflected in fetch requests that end up in a service worker and is that tested?

Yes, this is covered by tests changed in the linked CL, like fetch-event-referrer-policy.https.html.

Thanks, any feedback on the remainder of the comment?

@maudnals Hey Maud, do you know offhand if Firefox and WebKit have tracking bugs specifically for changing the default referrer policy? Thanks!

re JSON, I filed issue 26528 to track this: a quick codesearch shows it's not confined to the referrer policy tests

As mentioned over here, Firefox does. I think Safari doesn't because they've already rolled out a superset of this change (discussion on that thread and privacycg/proposals#13). Ultimately this change allows everyone to align more to Safari, and bring Safari's behavior closer to the spec. We'll consider the additional referrer trimming that they do in the PrivacyCG is my understanding

I thought Safari didn't do a superset after all as they differed for subresources and navigations?

I filed https://bugs.webkit.org/show_bug.cgi?id=218909 against WK. I think it'd be accurate to describe their behavior as "roughly a superset of strict-origin-when-cross-origin, with a few rough edges": for instance, there are longstanding bugs where various HTML elements' referrerpolicy attributes no-op, which I think are just too low-priority to attract attention.

Yeah I think it is slightly unclear how safari behaves in all cases, given the tracking bug above and at least discrepancies like https://bugs.webkit.org/show_bug.cgi?id=217758. I don't think this change is contentious, but I think the outcome of the referrer trimming discussion is where there are the more divergent views

We rolled out ReducedReferrerGranularity, which changes the default referrer policy to strict-origin-when-cross-origin, to 100% in M85 stable. To clean up the experiment, we need to enable the behavior by default. This will take effect in M88; we'll follow up by removing the flag, the corresponding enterprise policy, and the corresponding field trial testing configuration. Changing this base::Feature's default value entails cleaning up the remaining tests that weren't within the field trial testing config's scope. These changes are mostly straightforward, involving updating expectations of full-URL referrers to expectations of the corresponding origins, but some tests require logic changes to make sure that they still cover the desired behavior. (For instance, multiple tests previously expected origins in order to test that a particular, arbitrary, non-default referrer policy took effect: to achieve a similar effect, this CL updates these tests to now expect full URLs and swaps in non-default full-URL-generating policies for the prior non-default origin-generating policies.) Launch approval: crbug.com/1019930 Spec change: w3c/webappsec-referrer-policy#142 Bug: 1014207, 1131688 Change-Id: Ib575af6a858641fb1fe2c8de73941f5702d88191 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2429247 Reviewed-by: Charlie Reis <creis@chromium.org> Reviewed-by: Dominic Farolino <dom@chromium.org> Reviewed-by: Kunihiko Sakamoto <ksakamoto@chromium.org> Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org> Reviewed-by: Jeremy Roman <jbroman@chromium.org> Commit-Queue: David Van Cleve <davidvc@chromium.org> Cr-Commit-Position: refs/heads/master@{#828098}

chromium-wpt-export-bot added chromium-export do not merge yet labels Nov 7, 2020

wpt-pr-bot added fetch html referrer-policy service-workers wg-sw wg-webappsec labels Nov 7, 2020

wpt-pr-bot approved these changes Nov 7, 2020

View reviewed changes

chromium-wpt-export-bot force-pushed the chromium-export-cl-2429247 branch 4 times, most recently from c3ea979 to b4d16af Compare November 7, 2020 03:59

wpt-pr-bot added the signed-exchange label Nov 7, 2020

chromium-wpt-export-bot force-pushed the chromium-export-cl-2429247 branch 7 times, most recently from c22b707 to f32a6e8 Compare November 10, 2020 19:29

domfarolino assigned annevk Nov 11, 2020

annevk reviewed Nov 11, 2020

View reviewed changes

chromium-wpt-export-bot force-pushed the chromium-export-cl-2429247 branch from f32a6e8 to 4b678d0 Compare November 13, 2020 00:17

chromium-wpt-export-bot force-pushed the chromium-export-cl-2429247 branch from 4b678d0 to 14be535 Compare November 17, 2020 07:21

chromium-wpt-export-bot removed the do not merge yet label Nov 17, 2020

chromium-wpt-export-bot merged commit 60d6623 into master Nov 17, 2020

chromium-wpt-export-bot deleted the chromium-export-cl-2429247 branch November 17, 2020 09:03

moz-wptsync-bot added mozilla:gecko-blocked and removed mozilla:gecko-blocked labels Nov 17, 2020

CYBAI mentioned this pull request Nov 28, 2020

Set referrer policy default to strict-origin-when-cross-origin servo/servo#27868

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Referrers: Flip ReducedReferrerGranularity to enabled by default #26441

Referrers: Flip ReducedReferrerGranularity to enabled by default #26441

chromium-wpt-export-bot commented Nov 7, 2020 •

edited

wpt-pr-bot left a comment

domfarolino commented Nov 11, 2020 •

edited

annevk left a comment

annevk Nov 11, 2020

davidvancleve Nov 13, 2020

annevk Nov 13, 2020

davidvancleve Nov 13, 2020

davidvancleve Nov 13, 2020 •

edited

domfarolino Nov 13, 2020

annevk Nov 13, 2020

davidvancleve Nov 13, 2020 •

edited

domfarolino Nov 13, 2020

Referrers: Flip ReducedReferrerGranularity to enabled by default #26441

Referrers: Flip ReducedReferrerGranularity to enabled by default #26441

Conversation

chromium-wpt-export-bot commented Nov 7, 2020 • edited

wpt-pr-bot left a comment

Choose a reason for hiding this comment

domfarolino commented Nov 11, 2020 • edited

annevk left a comment

Choose a reason for hiding this comment

annevk Nov 11, 2020

Choose a reason for hiding this comment

davidvancleve Nov 13, 2020

Choose a reason for hiding this comment

annevk Nov 13, 2020

Choose a reason for hiding this comment

davidvancleve Nov 13, 2020

Choose a reason for hiding this comment

davidvancleve Nov 13, 2020 • edited

Choose a reason for hiding this comment

domfarolino Nov 13, 2020

Choose a reason for hiding this comment

annevk Nov 13, 2020

Choose a reason for hiding this comment

davidvancleve Nov 13, 2020 • edited

Choose a reason for hiding this comment

domfarolino Nov 13, 2020

Choose a reason for hiding this comment

chromium-wpt-export-bot commented Nov 7, 2020 •

edited

domfarolino commented Nov 11, 2020 •

edited

davidvancleve Nov 13, 2020 •

edited

davidvancleve Nov 13, 2020 •

edited