Bug 244637 – CSP 3: Update Content Security Policy when header sent as part of a 304 response

• Status: RESOLVED
• Resolution: FIXED
• Component: Page Loading

[Hercules Hjalmarsson]

imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub.html

Is a constant text failure on macOS wk1 ToT and since 253966@main when it was un-skipped. It appears that this test is failing expectedly on wk2 but passing on wk1. I'm unsure which is correct after un-skip.

HISTORY:
https://results.webkit.org/?suite=layout-tests&test=imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub.html

DIFF:
@@ -2,6 +2,6 @@

 PASS Test that the first frame uses nonce abc
 PASS Test that the first frame does not use nonce def
-FAIL Test that the second frame uses nonce def assert_unreached: Unexpected message received Reached unreachable code
-FAIL Test that the second frame does not use nonce abc assert_unreached: Unexpected message received Reached unreachable code
+PASS Test that the second frame uses nonce def
+PASS Test that the second frame does not use nonce abc

[Radar WebKit Bug Importer]

<rdar://problem/99405897>

[Hercules Hjalmarsson]

My previous comment is mentioning failing expectedly from the DIFF output and not in the history.

[Hercules Hjalmarsson]

This issue can be bisected to 253966@main using command:

run-webkit-tests --iterations=2 -1 imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub.html

[EWS]

Test gardening commit 254011@main (f787f2f60509): <https://commits.webkit.org/254011@main>

Reviewed commits have been landed. Closing PR #3881 and removing active labels.

[Ryan Reno]

We aren't updating the CSP when we get a new header as part of a 304 response which is why this test is failing.

See discussion https://github.com/w3c/webappsec-csp/issues/161

[Ryan Reno]

We also fail https://wpt.fyi/results/cors/304.htm?label=experimental&label=master&aligned

So we likely fail any WPT that tests our behavior w.r.t. updating the cache entry upon a 304 response.

[Ryan Reno]

Pull request: https://github.com/WebKit/WebKit/pull/8629

[EWS]

Committed 258931@main (9bcb547791aa): <https://commits.webkit.org/258931@main>

Reviewed commits have been landed. Closing PR #8629 and removing active labels.