128533 2014-02-10 07:54:11 -0800 XMLHttpRequest should not set DNT header 2014-02-11 15:57:31 -0800 1 1 1 Unclassified WebKit XML 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 youennf youennf ap commit-queue darin oldest_to_newest 978879 0 youennf 2014-02-10 07:54:11 -0800 Scripts should not be able to set the DNT (Do Not Track) header of a HTTP request using XMLHttpRequest (except if priviledged). 978897 1 223717 youennf 2014-02-10 08:34:04 -0800 Created attachment 223717 Patch 979458 2 darin 2014-02-11 09:29:09 -0800 Why? 979536 3 youennf 2014-02-11 12:10:06 -0800 The DNT header should be set by web engines according user preferences. That includes all HTTP requests, including XHR requests. Unpriviledged web apps should not be allowed to override/interfere with user preferences. A simple way to handle that is to disallow XHR to set the DNT header, as specified in http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader()-method. Mozilla seems to implement that behavior. Blink seems to allow setting the DNT header. I do not know what others do. The bug title is a bit misleading, I will change it (s/send/set/). 979561 4 223717 ap 2014-02-11 13:10:09 -0800 Comment on attachment 223717 Patch The short answer is that the XHR spec currently says so. "Terminate these steps if header is a case-insensitive match for one of the following headers: <...>" 979641 5 223717 commit-queue 2014-02-11 15:57:29 -0800 Comment on attachment 223717 Patch Clearing flags on attachment: 223717 Committed r163915: <http://trac.webkit.org/changeset/163915> 979642 6 commit-queue 2014-02-11 15:57:31 -0800 All reviewed patches have been landed. Closing bug. 223717 2014-02-10 08:34:04 -0800 2014-02-11 15:57:29 -0800 Patch bug-128533-20140210173402.patch text/plain 3788 youennf U3VidmVyc2lvbiBSZXZpc2lvbjogMTYzNzc0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYTNmNzkwZTAxYjczZWUz NzBhNTMyNjhlZjU0N2Y3NGU1MWUyMjg4Yy4uYjM5OWMxM2I4OWJlNGQ1ZjllNDE1YTUwYjFmNWM1 MGIwZTc4MWQwMCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE0LTAyLTEwICBZb3Vl bm4gRmFibGV0ICA8eW91ZW5uZkBnbWFpbC5jb20+CisKKyAgICAgICAgWE1MSHR0cFJlcXVlc3Qg c2hvdWxkIG5vdCBzZW5kIEROVCBoZWFkZXIKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTEyODUzMworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEFkZGVkIEROVCAoRG8gTm90IFRyYWNrKSBoZWFkZXIgdG8gdGhl IGxpc3Qgb2YgZm9yYmlkZGVuIGhlYWRlcnMuCisgICAgICAgIFVwZGF0ZWQgaHR0cC90ZXN0cy94 bWxodHRwcmVxdWVzdC9zZXQtZGFuZ2Vyb3VzLWhlYWRlcnMuaHRtbCB0byB0ZXN0IHRoYXQgaGVh ZGVyLgorCisgICAgICAgICogeG1sL1hNTEh0dHBSZXF1ZXN0LmNwcDoKKyAgICAgICAgKFdlYkNv cmU6OlhNTEh0dHBSZXF1ZXN0U3RhdGljRGF0YTo6WE1MSHR0cFJlcXVlc3RTdGF0aWNEYXRhKToK KwogMjAxNC0wMi0xMCAgWmFuIERvYmVyc2VrICA8emRvYmVyc2VrQGlnYWxpYS5jb20+CiAKICAg ICAgICAgRml4IGEgZmV3IG1pc3Rha2VzIHRoYXQgbGFuZGVkIHdpdGggcjE2Mzc0OS4KZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJDb3JlL3htbC9YTUxIdHRwUmVxdWVzdC5jcHAgYi9Tb3VyY2UvV2Vi Q29yZS94bWwvWE1MSHR0cFJlcXVlc3QuY3BwCmluZGV4IDA0NDg0OGM5Y2M5YjUzNmFmZjdlMDkz N2E3YTJlODQzMjFmMDM4ZjIuLjMwMzBkOWJmMDRlNmM0MzhkOGQxOWUwY2VlNzRhMmEwNjNkOGQ2 NzggMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3htbC9YTUxIdHRwUmVxdWVzdC5jcHAKKysr IGIvU291cmNlL1dlYkNvcmUveG1sL1hNTEh0dHBSZXF1ZXN0LmNwcApAQCAtMTAyLDYgKzEwMiw3 IEBAIFhNTEh0dHBSZXF1ZXN0U3RhdGljRGF0YTo6WE1MSHR0cFJlcXVlc3RTdGF0aWNEYXRhKCkK ICAgICAgICAgImNvb2tpZSIsCiAgICAgICAgICJjb29raWUyIiwKICAgICAgICAgImRhdGUiLAor ICAgICAgICAiZG50IiwKICAgICAgICAgImV4cGVjdCIsCiAgICAgICAgICJob3N0IiwKICAgICAg ICAgImtlZXAtYWxpdmUiLApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDIxNWRjNmI4MDBiMTdhZGQ4YjkzY2ZiMWEzY2E0ZWQw OWM3NGNhOGIuLmY2ZWFjYTYyNmE4ZDY0OGM1YjZlZTY4NWMwNzFhMzNkMzE3OTgxNzAgMTAwNjQ0 Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cK QEAgLTEsMyArMSwxNSBAQAorMjAxNC0wMi0xMCAgWW91ZW5uIEZhYmxldCAgPHlvdWVubmZAZ21h aWwuY29tPgorCisgICAgICAgIFhNTEh0dHBSZXF1ZXN0IHNob3VsZCBub3Qgc2VuZCBETlQgaGVh ZGVyCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMjg1 MzMKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBVcGRh dGVkIGh0dHAvdGVzdHMveG1saHR0cHJlcXVlc3Qvc2V0LWRhbmdlcm91cy1oZWFkZXJzLmh0bWwg dG8gdGVzdCB0aGF0IEROVCBoZWFkZXIgaXMgbm90IHNlbnQuCisKKyAgICAgICAgKiBodHRwL3Rl c3RzL3htbGh0dHByZXF1ZXN0L3NldC1kYW5nZXJvdXMtaGVhZGVycy1leHBlY3RlZC50eHQ6Cisg ICAgICAgICogaHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9zZXQtZGFuZ2Vyb3VzLWhlYWRlcnMu aHRtbDoKKwogMjAxNC0wMi0xMCAgTWlobmVhIE92aWRlbmllICA8bWlobmVhQGFkb2JlLmNvbT4K IAogICAgICAgICBbQ1NTIFJlZ2lvbnNdIEZpeCBQcm9wYWdhdGluZyBCb3JkZXIgYW5kIFBhZGRp bmcgZm9yIElubGluZSBSZXBsYWNlZCBFbGVtZW50cyBGbG93ZWQgaW4gUmVnaW9ucwpkaWZmIC0t Z2l0IGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9zZXQtZGFuZ2Vyb3Vz LWhlYWRlcnMtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRwcmVx dWVzdC9zZXQtZGFuZ2Vyb3VzLWhlYWRlcnMtZXhwZWN0ZWQudHh0CmluZGV4IGFlMDZmYjA3OTQ4 YjY3MmRiOWFhZWEwYzc5NDU5OGFjMGE4M2I1MGIuLjMwNzc1YTU3ZWM1MWNhYWQ2ZTlmYjc5MTVk NmJiOGNiNDU4YmJlMmUgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0 cHJlcXVlc3Qvc2V0LWRhbmdlcm91cy1oZWFkZXJzLWV4cGVjdGVkLnR4dAorKysgYi9MYXlvdXRU ZXN0cy9odHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L3NldC1kYW5nZXJvdXMtaGVhZGVycy1leHBl Y3RlZC50eHQKQEAgLTgsNiArOCw3IEBAIENPTlNPTEUgTUVTU0FHRTogUmVmdXNlZCB0byBzZXQg dW5zYWZlIGhlYWRlciAiQ09OVEVOVC1UUkFOU0ZFUi1FTkNPRElORyIKIENPTlNPTEUgTUVTU0FH RTogUmVmdXNlZCB0byBzZXQgdW5zYWZlIGhlYWRlciAiQ09PS0lFIgogQ09OU09MRSBNRVNTQUdF OiBSZWZ1c2VkIHRvIHNldCB1bnNhZmUgaGVhZGVyICJDT09LSUUyIgogQ09OU09MRSBNRVNTQUdF OiBSZWZ1c2VkIHRvIHNldCB1bnNhZmUgaGVhZGVyICJEQVRFIgorQ09OU09MRSBNRVNTQUdFOiBS ZWZ1c2VkIHRvIHNldCB1bnNhZmUgaGVhZGVyICJETlQiCiBDT05TT0xFIE1FU1NBR0U6IFJlZnVz ZWQgdG8gc2V0IHVuc2FmZSBoZWFkZXIgIkVYUEVDVCIKIENPTlNPTEUgTUVTU0FHRTogUmVmdXNl ZCB0byBzZXQgdW5zYWZlIGhlYWRlciAiSE9TVCIKIENPTlNPTEUgTUVTU0FHRTogUmVmdXNlZCB0 byBzZXQgdW5zYWZlIGhlYWRlciAiS0VFUC1BTElWRSIKZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz L2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3Qvc2V0LWRhbmdlcm91cy1oZWFkZXJzLmh0bWwgYi9M YXlvdXRUZXN0cy9odHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L3NldC1kYW5nZXJvdXMtaGVhZGVy cy5odG1sCmluZGV4IDc2OTJhZjlhMzA5YjRiM2E2ODExYjZiNWExNDdhNjVlOGQ2YWQ3OGEuLjM1 ODA4NWUwOTA4NTZlZmE3OWE0ZjQ5MzlmY2ZmOGQ2NDkyYTNlZDQgMTAwNjQ0Ci0tLSBhL0xheW91 dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3Qvc2V0LWRhbmdlcm91cy1oZWFkZXJzLmh0 bWwKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9zZXQtZGFuZ2Vy b3VzLWhlYWRlcnMuaHRtbApAQCAtMjQsNiArMjQsNyBAQAogICAgIHJlcS5zZXRSZXF1ZXN0SGVh ZGVyKCJDT09LSUUiLCAiZm9vYmFyIik7CiAgICAgcmVxLnNldFJlcXVlc3RIZWFkZXIoIkNPT0tJ RTIiLCAiZm9vYmFyIik7CiAgICAgcmVxLnNldFJlcXVlc3RIZWFkZXIoIkRBVEUiLCAiZm9vYmFy Iik7CisgICAgcmVxLnNldFJlcXVlc3RIZWFkZXIoIkROVCIsICJmb29iYXIiKTsKICAgICByZXEu c2V0UmVxdWVzdEhlYWRlcigiRVhQRUNUIiwgIjEwMC1jb250aW51ZSIpOwogICAgIHJlcS5zZXRS ZXF1ZXN0SGVhZGVyKCJIT1NUIiwgImZvb2JhciIpOwogICAgIHJlcS5zZXRSZXF1ZXN0SGVhZGVy KCJLRUVQLUFMSVZFIiwgImZvb2JhciIpOwo=