Bug 228291

Summary: Referrer-Policy not properly applying with iframe redirections
Product: WebKit Reporter: Sam Sneddon [:gsnedders] <gsnedders>
Component: Page LoadingAssignee: Alex Christensen <achristensen>
Status: NEW ---    
Severity: Normal CC: achristensen, beidson, bfulgham, cdumez, ews-watchlist, japhet, webkit-bug-importer, wilander
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
URL: http://wpt.live/referrer-policy/gen/top.http-rp/same-origin/iframe-tag.http.html
Description Flags
Patch ews-feeder: commit-queue-

Description Sam Sneddon [:gsnedders] 2021-07-26 12:07:08 PDT
wpt.fyi shows a variety of iframe-related failures:


(using WebKitGTK as it contains more recent fixes in this area than the latest STP run)

Essentially, regardless of where the policy is specified, we fail to apply a policy on redirection from same (HTTP, not HTTPS) origin, and hence end up sending the Referrer when we shouldn't.
Comment 1 Alex Christensen 2021-07-28 17:06:15 PDT
Created attachment 434478 [details]
Comment 2 Alex Christensen 2021-07-28 17:44:49 PDT
Comment on attachment 434478 [details]

This also breaks several other tests.  This isn't quite right.
Comment 3 Alex Christensen 2021-07-28 19:12:39 PDT
SubresourceLoader::checkRedirectionCrossOriginAccessControl is also a good place to look around
Comment 4 Radar WebKit Bug Importer 2021-08-02 12:08:28 PDT