blocked-uri in CSP report should be the request URI, not the URI after the redirect

@mikewest

wpt/content-security-policy/frame-src/frame-src-redirect.html

Lines 24 to 26 in 1a7d6fc

    
           var redirect_report_only = waitForViolation(window, "frame-src http://foo.test", (new URL(redirect.target)).origin) 
        
           // Enforced policy should trigger a violation on the redirected request. 
        
           var redirect_enforced = waitForViolation(window, "frame-src 'self'", (new URL(redirect.target)).origin)

According to the spec the blocked-uri should be the original URI, not the URI that got blocked after the redirect (https://www.w3.org/TR/CSP/#security-violation-reports).

@mikewest

@antosart

Ideally we'd also always compare the full values rather than just their origin.

cc @antosart

Yes, we should fix the implementations and the tests here. I opened a bug for chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=1172898

@annevk

@annevk wouldn't we leak cross-origin information if we use the full blocked-uri in the report? The report is sent to the parent frame, while the child frame might have been navigated to a URL which the parent does not know and must not know.

I'm not sure we should report anything at all. It seems rather problematic that the parent would get access to such information. I guess even if we reported nothing the parent could go on a fishing expedition, but at least that would take a long time and likely not be effective.

(I think I would have preferred if only the initial navigation could be controlled and any further navigations would not be subject to CSP at all.)

CSP: Use request URL as blocked URL in browser

Navigation Menu

Repository navigation

blocked-uri in CSP report should be the request URI, not the URI after the redirect #27384

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	var redirect_report_only = waitForViolation(window, "frame-src http://foo.test", (new URL(redirect.target)).origin)
	// Enforced policy should trigger a violation on the redirected request.
	var redirect_enforced = waitForViolation(window, "frame-src 'self'", (new URL(redirect.target)).origin)

blocked-uri in CSP report should be the request URI, not the URI after the redirect #27384

Description

Activity

annevk commented on Jan 29, 2021

antosart commented on Feb 1, 2021

antosart commented on Mar 8, 2021

annevk commented on Mar 9, 2021

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions