Bug 244637 - CSP 3: Update Content Security Policy when header sent as part of a 304 response
Summary: CSP 3: Update Content Security Policy when header sent as part of a 304 response
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Ryan Reno
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-08-31 15:11 PDT by Hercules Hjalmarsson
Modified: 2023-01-15 10:08 PST (History)
8 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Hercules Hjalmarsson 2022-08-31 15:11:32 PDT
imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub.html

Is a constant text failure on macOS wk1 ToT and since 253966@main when it was un-skipped. It appears that this test is failing expectedly on wk2 but passing on wk1. I'm unsure which is correct after un-skip.

HISTORY:
https://results.webkit.org/?suite=layout-tests&test=imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub.html

DIFF:
@@ -2,6 +2,6 @@

 PASS Test that the first frame uses nonce abc
 PASS Test that the first frame does not use nonce def
-FAIL Test that the second frame uses nonce def assert_unreached: Unexpected message received Reached unreachable code
-FAIL Test that the second frame does not use nonce abc assert_unreached: Unexpected message received Reached unreachable code
+PASS Test that the second frame uses nonce def
+PASS Test that the second frame does not use nonce abc
Comment 1 Radar WebKit Bug Importer 2022-08-31 15:11:53 PDT
<rdar://problem/99405897>
Comment 2 Hercules Hjalmarsson 2022-08-31 15:13:01 PDT
My previous comment is mentioning failing expectedly from the DIFF output and not in the history.
Comment 3 Hercules Hjalmarsson 2022-08-31 15:14:05 PDT
This issue can be bisected to 253966@main using command:

run-webkit-tests --iterations=2 -1 imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub.html
Comment 4 EWS 2022-08-31 15:27:30 PDT
Test gardening commit 254011@main (f787f2f60509): <https://commits.webkit.org/254011@main>

Reviewed commits have been landed. Closing PR #3881 and removing active labels.
Comment 5 Ryan Reno 2023-01-13 08:39:33 PST
We aren't updating the CSP when we get a new header as part of a 304 response which is why this test is failing.

See discussion https://github.com/w3c/webappsec-csp/issues/161
Comment 6 Ryan Reno 2023-01-13 08:56:57 PST
We also fail https://wpt.fyi/results/cors/304.htm?label=experimental&label=master&aligned

So we likely fail any WPT that tests our behavior w.r.t. updating the cache entry upon a 304 response.
Comment 7 Ryan Reno 2023-01-13 10:57:48 PST
Pull request: https://github.com/WebKit/WebKit/pull/8629
Comment 8 EWS 2023-01-15 10:08:41 PST
Committed 258931@main (9bcb547791aa): <https://commits.webkit.org/258931@main>

Reviewed commits have been landed. Closing PR #8629 and removing active labels.