Support nonce & referrer-policy in preload & link headers by noamr · Pull Request #7961 · whatwg/html

noamr · 2022-05-27T16:13:21Z

In preparation for supporting modulepreload in link headers.

Parse referrerpolicy from link headers
Add referrer policy and nonce to link processing optinos

At least two implementers are interested (and none opposed):
- Gecko supports this
- Chromium is willing to implement the missing referrerpolicy bit
Tests are written and can be reviewed and commented upon at:
- Test referrerpolicy with preload web-platform-tests/wpt#34245
- Existing nonce test: https://github.com/web-platform-tests/wpt/blob/master/preload/link-header-preload-nonce.html
Implementation bugs are filed:

(See WHATWG Working Mode: Changes for more details.)

/links.html ( diff )
/semantics.html ( diff )

In preparation for supporting [modulepreload](whatwg#7862) in link headers. - Parse `referrerpolicy` from link headers - Add referrer policy and nonce to link processing optinos

domenic

This seems like a great idea to me. Maybe @domfarolino could comment with Chromium implementer interest?

Is there a need to include any of these in the preload key? Referrer policy especially seems potentially worthwhile... although perhaps tricky, because the current behavior is to just not require a match, so there might be a compat issue in starting to require a match?

source

noamr · 2022-06-01T08:06:14Z

This seems like a great idea to me. Maybe @domfarolino could comment with Chromium implementer interest?

Is there a need to include any of these in the preload key? Referrer policy especially seems potentially worthwhile...
although perhaps tricky, because the current behavior is to just not require a match, so there might be a compat issue in starting to require a match?

I wouldn't suggest requiring a match for referrer policy. It's tricky in many ways. A mismatch in referrer policy could still be a match in referrer, and a match in referrer policy can still be a mismatch in referrer (e.g. a font will have the containing style as referrer)

Either way, I wanted first to align link headers with link elements, and perhaps we can discuss changing the preload matching mechanism in a subsequent issue?

domenic · 2022-06-01T14:12:08Z

Either way, I wanted first to align link headers with link elements, and perhaps we can discuss changing the preload matching mechanism in a subsequent issue?

That seems reasonable, as long as we have tests showing that both link elements and link headers allow such mismatches.

noamr · 2022-06-01T16:20:06Z

Either way, I wanted first to align link headers with link elements, and perhaps we can discuss changing the preload matching mechanism in a subsequent issue?

That seems reasonable, as long as we have tests showing that both link elements and link headers allow such mismatches.

I modified web-platform-tests/wpt#34245 to test this.

source

domenic · 2022-06-01T17:13:57Z

So right now it seems like attribute processing is split across a few places:

"create a link element request" reads [[CryptographicNonce]], integrity, and referrerpolicy directly from the element and puts them on the request.
But "create link options from element" reads [[CryptographicNonce]] and integrity (but not referrerpolicy) from the element

This seems bad? As far as I can tell this means we're using different codepaths for preconnect/preload ("create link options from element") vs. everything else ("create a link element request"). "Everything else" notably includes stylesheet, manifest, and modulepreload, although in theory any of the external resource links might be fetched by browsers.

I think at the very least "create link options from element" needs to include referrerpolicy, right?

Further unification would probably require using "create link options from element" for everything else, which I guess we should not do at this point. But it does indicate the name "link processing options" might be overly-broad since it only applies to preconnect/preload.

noamr · 2022-06-01T17:56:21Z

So right now it seems like attribute processing is split across a few places:

"create a link element request" reads [[CryptographicNonce]], integrity, and referrerpolicy directly from the element and puts them on the request.

But "create link options from element" reads [[CryptographicNonce]] and integrity (but not referrerpolicy) from the element

This seems bad? As far as I can tell this means we're using different codepaths for preconnect/preload ("create link options from element") vs. everything else ("create a link element request"). "Everything else" notably includes stylesheet, manifest, and modulepreload, although in theory any of the external resource links might be fetched by browsers.

It's temporarily inconsistent (aka "bad"). modulepreload will also use create link options from element in a subsequent patch.

I think at the very least "create link options from element" needs to include referrerpolicy, right?

Right, it's a missing part that should go into this patch,

Further unification would probably require using "create link options from element" for everything else, which I guess we should not do at this point. But it does indicate the name "link processing options" might be overly-broad since it only applies to preconnect/preload.

If we decide to support further rels in link headers they would probably use the same struct. Not sure how else to call it

domenic · 2022-06-01T17:57:44Z

Yeah, I guess we'll leave any further clarification/renaming until at least #7890.

domenic

LGTM, including tests. This seems like it should be quite reasonable but I'd still love some confirmation from Chromium or WebKit before merging, in case there's some opposition. Let's try asking @yoavweiss in addition to @domfarolino, for Chromium...

yoavweiss · 2022-06-02T05:14:02Z

Seems like nonce is already implemented and passing the tests. I can take on adding the ReferrerPolicy bits, if no one else does. /cc @yutakahirano

domfarolino · 2022-06-02T22:56:16Z

Back from vacation today. Yoav, feel free to take the referrer policy bits, otherwise I'm happy to do it if you do not have time.

This CL adds `referrerpolicy` support to Link header preloads, and fixes the related tests. PR: whatwg/html#7961 Bug: i1330073 Change-Id: I0deb4afd6c77a2d766da8e706211195d6840b3a1

This CL adds `referrerpolicy` support to Link header preloads, and fixes the related tests. PR: whatwg/html#7961 Bug: 1330073 Change-Id: I0deb4afd6c77a2d766da8e706211195d6840b3a1

This CL adds `referrerpolicy` support to Link header preloads, and fixes the related tests. PR: whatwg/html#7961 Bug: 1330073 Change-Id: I0deb4afd6c77a2d766da8e706211195d6840b3a1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3698081 Reviewed-by: Yutaka Hirano <[email protected]> Commit-Queue: Yoav Weiss <[email protected]> Cr-Commit-Position: refs/heads/main@{#1013370}

…rt, a=testonly Automatic update from web-platform-tests Preload Link header referrerpolicy support This CL adds `referrerpolicy` support to Link header preloads, and fixes the related tests. PR: whatwg/html#7961 Bug: 1330073 Change-Id: I0deb4afd6c77a2d766da8e706211195d6840b3a1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3698081 Reviewed-by: Yutaka Hirano <[email protected]> Commit-Queue: Yoav Weiss <[email protected]> Cr-Commit-Position: refs/heads/main@{#1013370} -- wpt-commits: 2d82c9ff94b451881ad3e3f5bc9b03d6b62719e8 wpt-pr: 34365

https://bugs.webkit.org/show_bug.cgi?id=241059 <rdar://94384756> Reviewed by Darin Adler. Added support for referrer-policy in link headers. whatwg/html#7961 * Source/WebCore/loader/LinkHeader.cpp: (WebCore::paramterNameFromString): (WebCore::LinkHeader::setValue): * Source/WebCore/loader/LinkHeader.h: (WebCore::LinkHeader::referrerPolicy const): * Source/WebCore/loader/LinkLoader.cpp: (WebCore::LinkLoader::loadLinksFromHeader): * LayoutTests/imported/w3c/web-platform-tests/preload/preload-referrer-policy-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/preload/preload-referrer-policy.html: Added. * LayoutTests/imported/w3c/web-platform-tests/preload/resources/echo-referrer.py: Added. (main): * LayoutTests/imported/w3c/web-platform-tests/preload/resources/link-header-referrer-policy.html: Added. * LayoutTests/imported/w3c/web-platform-tests/preload/resources/link-header-referrer-policy.py: Added. (main): Canonical link: https://commits.webkit.org/255354@main

…rt, a=testonly Automatic update from web-platform-tests Preload Link header referrerpolicy support This CL adds `referrerpolicy` support to Link header preloads, and fixes the related tests. PR: whatwg/html#7961 Bug: 1330073 Change-Id: I0deb4afd6c77a2d766da8e706211195d6840b3a1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3698081 Reviewed-by: Yutaka Hirano <[email protected]> Commit-Queue: Yoav Weiss <[email protected]> Cr-Commit-Position: refs/heads/main@{#1013370} -- wpt-commits: 2d82c9ff94b451881ad3e3f5bc9b03d6b62719e8 wpt-pr: 34365

Support nonce & referrerpolicy in preload & link headers

e1bbf38

In preparation for supporting [modulepreload](whatwg#7862) in link headers. - Parse `referrerpolicy` from link headers - Add referrer policy and nonce to link processing optinos

noamr changed the title ~~Support nonce & referrerpolicy in preload & link headers~~ Support nonce & referrer-policy in preload & link headers May 27, 2022

Parse referrer policy

9caf6ea

noamr mentioned this pull request May 30, 2022

modulepreload in Link header & early hints #7862

Open

3 tasks

domenic reviewed May 31, 2022

View reviewed changes

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

domenic added addition/proposal New features or enhancements topic: link labels May 31, 2022

noamr added 2 commits June 1, 2022 09:35

Parse nonce from header

bd85430

Fix nonce ref

e75a3b1

domenic reviewed Jun 1, 2022

View reviewed changes

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

PR suggestions

63441db

Apply referrerpolicy from element

eebf2b9

domenic approved these changes Jun 1, 2022

View reviewed changes

domenic merged commit 94a9b1d into whatwg:main Jun 2, 2022

chromium-wpt-export-bot mentioned this pull request Jun 9, 2022

Preload Link header referrerpolicy support web-platform-tests/wpt#34365

Merged

charliewolfe mentioned this pull request Jul 29, 2022

Link headers don't support referrerpolicy WebKit/WebKit#2867

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support nonce & referrer-policy in preload & link headers#7961

Support nonce & referrer-policy in preload & link headers#7961
domenic merged 6 commits intowhatwg:mainfrom
noamr:preload-referrer-policy

noamr commented May 27, 2022 •

edited by pr-preview bot

Loading

Uh oh!

domenic left a comment

Uh oh!

Uh oh!

Uh oh!

noamr commented Jun 1, 2022

Uh oh!

domenic commented Jun 1, 2022

Uh oh!

noamr commented Jun 1, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

domenic commented Jun 1, 2022

Uh oh!

noamr commented Jun 1, 2022

Uh oh!

domenic commented Jun 1, 2022

Uh oh!

domenic left a comment

Uh oh!

yoavweiss commented Jun 2, 2022

Uh oh!

domfarolino commented Jun 2, 2022

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Conversation

noamr commented May 27, 2022 • edited by pr-preview bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

domenic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

noamr commented Jun 1, 2022

Uh oh!

domenic commented Jun 1, 2022

Uh oh!

noamr commented Jun 1, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

domenic commented Jun 1, 2022

Uh oh!

noamr commented Jun 1, 2022

Uh oh!

domenic commented Jun 1, 2022

Uh oh!

domenic left a comment

Choose a reason for hiding this comment

Uh oh!

yoavweiss commented Jun 2, 2022

Uh oh!

domfarolino commented Jun 2, 2022

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

noamr commented May 27, 2022 •

edited by pr-preview bot

Loading