import() should use referring script's base URL as the referrer

[domenic]

Right now we treat import() as a "new" module script graph, i.e. it calls fetch a module script graph directly. This then uses "client" as the referrer, i.e. it uses the base URL of the appropriate settings object.

But this seems semantically wrong. import() knows what script it's being called from; it uses that information to compute URLs and and fetch options. It should also use that to compute the referrer information.

Found by @jonco3. /cc @whatwg/modules. I will try to work on a spec fix and tests for this soon...

[nhiroki]

/cc @hiroshige-g @nyaxt and me. We're now adding WPTs for referrer on module workers.

[domfarolino]

Any update on the status here (tests or spec)?

[domenic]

It looks like the spec still does not do this, but it would be much easier to change now. I think it's just a matter of changing https://html.spec.whatwg.org/multipage/webappapis.html#fetch-an-import()-module-script-graph step 3 to pass base URL instead of "client".

[nhiroki]

Regarding the tests, we have auto-generated tests for top-level worker module script loading, but not yet for import() IIUC:
https://github.com/web-platform-tests/wpt/blob/451adc0f8a2a76b97c74ff3471b0e068164e9eb8/referrer-policy/spec.src.json#L656

[nhiroki]

Ah, I just remembered there're also hand-written tests including import():

• https://github.com/web-platform-tests/wpt/blob/fc5fe7e3cc426b2b40440201d52511facf11961c/workers/modules/dedicated-worker-import-referrer.html
• https://github.com/web-platform-tests/wpt/blob/fc5fe7e3cc426b2b40440201d52511facf11961c/workers/modules/shared-worker-import-referrer.html

It would be nice to move these tests into the test generator framework.

[nicolo-ribaudo]

I was testing this issue, and it looks like Firefox implements the proposed behavior while Webkit and Chromium implement the specified behavior.

I was looking at wpt tests, but I couldn't find any. Would it be ok to just duplicate all the referrer-* tests in https://github.com/web-platform-tests/wpt/tree/master/html/semantics/scripting-1/the-script-element/module, to test the referrer when:

• using static import in an imported external module
• using dynamic import in an imported external module

Should the tests include all the referrer policy combinations, or given that this change would affect which referrer is passed and not when it would be enough to test the default one?

[annevk]

Duplicating (or abstracting) sounds fine. And no need to test all combinations. Thanks!

[nicolo-ribaudo]

Thank you! PR opened.