Bug 97233 – CSP reports should send an empty 'referrer' rather than nothing.

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Mike West]

If no referrer exists, we don't send a 'referrer' attribute at all. It would be friendlier to send an explicitly empty referrer.

[Mike West]

Created attachment 164942 [details]
Patch

[Mike West]

At least one developer found this surprising. *shrug* It's a trivial change, and it's arguably a more explicit description of what's going on.

WDYT, Adam?

[Mike West]

https://twitter.com/adam_baldwin/status/248836426131701760 <-- the thread.

[Adam Barth]

Comment on attachment 164942 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=164942&action=review

> Source/WebCore/ChangeLog:11
> +        Currently, if a protected resource doesn't have a referrer, then any
> +        Content Security Policy violations send a report that doesn't contain
> +        a referrer attribute. It's arguably friendlier to developers to include
> +        an explicitly empty attribute.

Yeah, it's also what the spec says to do.  :)

[Mike West]

(In reply to comment #4)
> (From update of attachment 164942 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=164942&action=review
> 
> > Source/WebCore/ChangeLog:11
> > +        Currently, if a protected resource doesn't have a referrer, then any
> > +        Content Security Policy violations send a report that doesn't contain
> > +        a referrer attribute. It's arguably friendlier to developers to include
> > +        an explicitly empty attribute.
> 
> Yeah, it's also what the spec says to do.  :)

Specs... ha! Like anyone reads those...

Thanks! :)

[WebKit Review Bot]

Comment on attachment 164942 [details]
Patch

Clearing flags on attachment: 164942

Committed r129150: <http://trac.webkit.org/changeset/129150>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.