Bug 185732 – Incorrect referrer for font-face

• Component: Text
• Status: RESOLVED DUPLICATE

[Bernardo]

How to reproduce:

Scenario, request a page that have a CSS asset hosted by a CDN, this asset contain a few `font-face` declarations.
When requesting those fonts I would expect the `Referer` header to have the CDN domain in it, not my original webpage.

Example:

1. Page `example-a.com`
2. CDN `my-cdn.com` which hosts `myasset.css`
3. When `myasset.css` triggers a font request I would expect the `Referer` header to contain `my-cdn.com` instead of `example-a.com`

[Radar WebKit Bug Importer]

<rdar://problem/40351764>

[Andy Estes]

David from Shopify provided me a test case for this in email:

"""

The easiest way to replicate this is to load a page with a stylesheet that loads a font.

For instance, loading https://output.jsbin.com/hewivoluqe and looking at the font request in the network inspector shows

- The CSS file's location being used as the Referer in Chrome and Firefox
- The web page's location being used as the Referer in Safari (both desktop and mobile)

I've attached screenshots highlighting this behaviour.

"""

[Andy Estes]

Created attachment 341190 [details]
Firefox

[Andy Estes]

Created attachment 341191 [details]
Chrome

[Andy Estes]

Created attachment 341192 [details]
iOS Safari

[Andy Estes]

Created attachment 341193 [details]
macOS Safari

[youenn fablet]

Related spec is at https://www.w3.org/TR/css-fonts-3/#font-fetching-requirements
We might indeed need to explicitly set the referrer before calling CachedResourceLoader::requestFont.

[Myles C. Maxfield]

I don't think we're convinced that the spec states that we are wrong.

https://w3c.github.io/webappsec-referrer-policy/

https://tools.ietf.org/html/rfc7231#section-5.5.2

[Alex Christensen]

The css fonts spec says this:
"When fetching, user agents must use "Anonymous" mode, set the referrer source to the stylesheet's URL and set the origin to the URL of the containing document."

I'm wondering why the referrer is explicitly set in this spec to mean something different than other referrers.

[youenn fablet]

> I'm wondering why the referrer is explicitly set in this spec to mean
> something different than other referrers.

Agreed, knowing the rationale would help either fixing our implementation or fixing the spec.

The spec is using old wording but the intent is pretty clear to me.
The stylesheet URL is used as referrer and can be further tweaked by the environment referrer policy as defined in https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer

[Simon Fraser (smfr)]

git blame the CSS spec and see who wrote it.

[Sam Sneddon [:gsnedders]]

*** This bug has been marked as a duplicate of bug 179054 ***