script: Use correct creation_url for workers#41458
Merged
TimvdLippe merged 1 commit intoservo:mainfrom Dec 29, 2025
Merged
Conversation
servo-highfive
added
the
S-awaiting-review
|
🔨 Triggering try run (#20411398306) for Linux (WPT) |
TimvdLippe
force-pushed
the
fix-referrer-creation-url
branch
from
a7425e4 to
bce1c0a
Compare
|
Test results for linux-wpt from try job (#20411398306): Flaky unexpected result (32)
Stable unexpected results that are known to be intermittent (27)
Stable unexpected results (33)
|
|
|
|
🔨 Triggering try run (#20411793143) for Linux (WPT) |
|
Test results for linux-wpt from try job (#20411793143): Flaky unexpected result (32)
Stable unexpected results that are known to be intermittent (30)
Stable unexpected results (2)
|
|
|
|
🔨 Triggering try run (#20427264445) for Linux (WPT) |
4 tasks
TimvdLippe
force-pushed
the
fix-referrer-creation-url
branch
from
85273a3 to
e126a9c
Compare
TimvdLippe
commented
Dec 22, 2025
|
|
||
| // Step 1 Set worker global scope's url to response's url. | ||
| scope.set_url(metadata.final_url.clone()); | ||
| global_scope.set_creation_url(metadata.final_url.clone()); |
Contributor
Author
There was a problem hiding this comment.
Pending whatwg/html#12038 update the spec steps here
|
Test results for linux-wpt from try job (#20427264445): Flaky unexpected result (28)
Stable unexpected results that are known to be intermittent (25)
|
|
✨ Try run (#20427264445) succeeded. |
mrobinson
approved these changes
Dec 22, 2025
Member
mrobinson
left a comment
mrobinson
left a comment
There was a problem hiding this comment.
Is it possible to write a test for this?
servo-highfive
removed
the
S-awaiting-review
Contributor
Author
|
Note for myself: I think this is user-observable via |
TimvdLippe
force-pushed
the
fix-referrer-creation-url
branch
from
e126a9c to
aeca024
Compare
servo-highfive
added
the
S-awaiting-review
TimvdLippe
commented
Dec 24, 2025
| @@ -0,0 +1,3 @@ | |||
| [dedicated-worker-correct-url-in-report.html] | |||
| [URL in report should point to worker where violation occurs' (with redirect)'] | |||
| expected: FAIL | |||
Contributor
Author
There was a problem hiding this comment.
expected "http://web-platform.test:8000/content-security-policy/reporting-api/support/dedicatedworker-report-url.sub.js?location=%2Fcontent-security-policy%2Freporting-api%2Fsupport%2Fdedicatedworker-report-url.sub.js&test-name=%27+%28with+redirect%29%27&count=1" but got "http://web-platform.test:8000/fetch/api/resources/redirect.py?location=%2Fcontent-security-policy%2Freporting-api%2Fsupport%2Fdedicatedworker-report-url.sub.js&test-name=%27%20(with%20redirect)%27"
Note that the URL is mostly correct, but it fails on the query parameter serialization. I believe that's outside the scope of this PR, but at least we have the full redirect URL now. The other new test in this file does catch the issue where the creation URL is correct for workers now.
Collaborator
|
🤖 Opened new upstream WPT pull request (web-platform-tests/wpt#56921) with upstreamable changes. |
TimvdLippe
force-pushed
the
fix-referrer-creation-url
branch
from
aeca024 to
a7b7034
Compare
TimvdLippe
changed the title
Collaborator
|
📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#56921). |
Collaborator
|
✍ Updated existing upstream WPT pull request (web-platform-tests/wpt#56921) title and body. |
TimvdLippe
added a commit
to TimvdLippe/webappsec-referrer-policy
that referenced
this pull request
Dec 25, 2025
Based on an investigation as to why Servo doesn't use the correct URL per the spec [1] I thought that HTML was incorrectly setting the creation URL [2]. However, after writing a WPT test [3] it turns out that the creation URL is correctly set in HTML, but incorrectly used in Referrer Policy. Browsers don't use the creation URL to determine the referrer policy, per another WPT test [4]. Instead of the creation URL, browsers use the url of the worker, which is the same as the API base URL [5]. [1]: servo/servo#41458 [2]: whatwg/html#12038 [3]: web-platform-tests/wpt#56921 [4]: https://wpt.fyi/results/fetch/api/basic/request-referrer-redirected-worker.html?label=master&label=experimental&aligned [5]: https://html.spec.whatwg.org/multipage/workers.html#script-settings-for-workers:api-base-url
TimvdLippe
force-pushed
the
fix-referrer-creation-url
branch
from
a7b7034 to
a5f9124
Compare
Collaborator
|
📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#56921). |
|
🔨 Triggering try run (#20560117131) for Linux (WPT) |
|
Test results for linux-wpt from try job (#20560117131): Flaky unexpected result (28)
Stable unexpected results that are known to be intermittent (25)
|
|
✨ Try run (#20560117131) succeeded. |
Instead of the creation URL of the containing global, it should instead use the URL of the current worker. Despite the referrer specification stating that we should use the creation URL, instead browsers use the current URL. A new WPT test is added to cover that which we currently fail because of incorrect serialization of query parameters of a URL. But the actual redirect and all work now. Signed-off-by: Tim van der Lippe <[email protected]>
TimvdLippe
force-pushed
the
fix-referrer-creation-url
branch
from
a5f9124 to
e508276
Compare
Collaborator
|
📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#56921). |
mrobinson
approved these changes
Dec 29, 2025
servo-highfive
removed
the
S-awaiting-review
servo-highfive
added
the
S-awaiting-merge
servo-highfive
removed
the
S-awaiting-merge
TimurBora
pushed a commit
to TimurBora/servo
that referenced
this pull request
Jan 2, 2026
Instead of the creation URL of the containing global, it should instead use the URL of the current worker. Despite the referrer specification stating that we should use the creation URL, instead browsers use the current URL. A new WPT test is added to cover that which we currently fail because of incorrect serialization of query parameters of a URL. But the actual redirect and all work now. Signed-off-by: Tim van der Lippe <[email protected]>
TimurBora
pushed a commit
to TimurBora/servo
that referenced
this pull request
Jan 2, 2026
Instead of the creation URL of the containing global, it should instead use the URL of the current worker. Despite the referrer specification stating that we should use the creation URL, instead browsers use the current URL. A new WPT test is added to cover that which we currently fail because of incorrect serialization of query parameters of a URL. But the actual redirect and all work now. Signed-off-by: Tim van der Lippe <[email protected]>
TimurBora
pushed a commit
to TimurBora/servo
that referenced
this pull request
Jan 2, 2026
Instead of the creation URL of the containing global, it should instead use the URL of the current worker. Despite the referrer specification stating that we should use the creation URL, instead browsers use the current URL. A new WPT test is added to cover that which we currently fail because of incorrect serialization of query parameters of a URL. But the actual redirect and all work now. Signed-off-by: Tim van der Lippe <[email protected]> Signed-off-by: TimurBora <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Instead of the creation URL of the containing global,
it should instead use the URL of the current worker.
Despite the referrer specification stating that we
should use the creation URL, instead browsers use
the current URL. A new WPT test is added to cover that
which we currently fail because of incorrect
serialization of query parameters of a URL. But the
actual redirect and all work now.