Test to make sure we isolate or disable all speculative connects

There are a variety of "resource hint" features in Tor Browser that we want to make sure are isolated by first-party or disabled. These include

  link rel=preconnect
  link rel=prefetch
  link rel=prerender

and possibly more. We should test this for the ESR45 and ESR52 versions of Tor Browser, because isolation will have different mechanisms.

See https://w3c.github.io/resource-hints/

We should also look into "SpeculativeConnect" code in Firefox to make sure there aren't any other cases of non-first-party isolated connections.

added TorBrowserTeam201805 component::applications/tor browser ff52-esr owner::tbb-team priority::medium severity::normal status::new tbb-linkability type::task labels

Trac:
Description: There are a variety of speculative connect features in Tor Browser that we want to make sure are isolated by first-party or disabled. These include

  link rel=preconnect
  link rel=prefetch
  link rel=prerender

and possibly more. We should test this for the ESR45 and ESR52 versions of Tor Browser, because isolation will have different mechanisms.

to

There are a variety of "resource hint" features in Tor Browser that we want to make sure are isolated by first-party or disabled. These include

  link rel=preconnect
  link rel=prefetch
  link rel=prerender

and possibly more. We should test this for the ESR45 and ESR52 versions of Tor Browser, because isolation will have different mechanisms.

See https://w3c.github.io/resource-hints/

Trac:
Description: There are a variety of "resource hint" features in Tor Browser that we want to make sure are isolated by first-party or disabled. These include

  link rel=preconnect
  link rel=prefetch
  link rel=prerender

and possibly more. We should test this for the ESR45 and ESR52 versions of Tor Browser, because isolation will have different mechanisms.

See https://w3c.github.io/resource-hints/

to

There are a variety of "resource hint" features in Tor Browser that we want to make sure are isolated by first-party or disabled. These include

  link rel=preconnect
  link rel=prefetch
  link rel=prerender

and possibly more. We should test this for the ESR45 and ESR52 versions of Tor Browser, because isolation will have different mechanisms.

See https://w3c.github.io/resource-hints/

We should also look into "SpeculativeConnect" code in Firefox to make sure there aren't any other cases of non-first-party isolated connections.

Trac:
Keywords: N/A deleted, tbb-linkability added
Type: defect to task

Probably the best way to do this is to add those other attribute values to the links in the "Bug #13749.2: Regression tests for first-party isolation of cache" test patch?

Replying to mikeperry:

Probably the best way to do this is to add those other attribute values to the links in the "Bug #13749.2: Regression tests for first-party isolation of cache" test patch?

I agree. Also they can be added to the uplifted version of those tests, here: https://hg.mozilla.org/mozilla-central/rev/4128e57e39bd

Arthur, I am a bit hesitant but could you squeeze that onto your ToDo list for the coming week? I make this ticket blocking #15988 (moved) for now but need the latter resolved one way or the other by the end of next week.

Trac:
Keywords: N/A deleted, TorBrowserTeam201703 added
Parent: N/A to #15988 (moved)

Turns out:

• We already have a test for link rel=preconnect
• We need a test for link rel=prefetch
• Firefox doesn't yet support link rel=prerender (according to https://bugzilla.mozilla.org/show_bug.cgi?id=730101)

So here is a branch for review: https://github.com/arthuredelstein/tor-browser/commits/21657+1 Note there are two patches.

The first disables our test for the track element, because it is failing (not sure why I haven't seen this before). Fixing this track element test can be a separate task: #21679 (moved).

The second patch implements the link rel=prefetch test. This test confirms that prefetch requests and caching are correctly isolated by first party.

I'm working on a version of this patch for Firefox that should be backportable to TBB/ESR52.

Trac:
Status: new to needs_review
Keywords: TorBrowserTeam201703 deleted, TorBrowserTeam201703R added

Replying to arthuredelstein:

Turns out:

• We already have a test for link rel=preconnect
• We need a test for link rel=prefetch
• Firefox doesn't yet support link rel=prerender (according to https://bugzilla.mozilla.org/show_bug.cgi?id=730101)

So here is a branch for review: https://github.com/arthuredelstein/tor-browser/commits/21657+1 Note there are two patches.

The first disables our test for the track element, because it is failing (not sure why I haven't seen this before). Fixing this track element test can be a separate task: #21679 (moved).

The second patch implements the link rel=prefetch test. This test confirms that prefetch requests and caching are correctly isolated by first party.

I'm working on a version of this patch for Firefox that should be backportable to TBB/ESR52.

Thanks. I guess there is no need to backport this fix to the 6.5.x branch and our 7.0.x one is basically about to get switched to ESR 52. So, while this patch looks good I guess I wait for the ESR52 one and move this ticket instead on our ff52-esr radar.

Trac:
Status: needs_review to assigned
Keywords: TorBrowserTeam201703R deleted, TorBrowserTeam201703, ff52-esr added

Replying to gk:

Thanks. I guess there is no need to backport this fix to the 6.5.x branch and our 7.0.x one is basically about to get switched to ESR 52. So, while this patch looks good I guess I wait for the ESR52 one and move this ticket instead on our ff52-esr radar.

OK! That also means I can close #21679 (moved) because the element test as adapted by Mozilla is already working in our ESR52 branch.

Trac:
Parent: #15988 (moved) to N/A

Remmove remaining tickets over to April

Trac:
Keywords: TorBrowserTeam201703 deleted, TorBrowserTeam201704 added

Moving our tickets to May 2017.

Trac:
Keywords: TorBrowserTeam201704 deleted, TorBrowserTeam201705 added

Trac:
Keywords: TorBrowserTeam201705 deleted, TorBrowserTeam201706 added

Moving Tickets to July 2017.

Trac:
Keywords: TorBrowserTeam201706 deleted, TorBrowserTeam201707 added

Replying to arthuredelstein:

Turns out:

• Firefox doesn't yet support link rel=prerender (according to https://bugzilla.mozilla.org/show_bug.cgi?id=730101)

And they won't. See: https://bugzilla.mozilla.org/show_bug.cgi?id=1383876.

Moving our Tickets to August.

Trac:
Keywords: TorBrowserTeam201707 deleted, TorBrowserTeam201708 added

Items for September 2017.

Trac:
Keywords: TorBrowserTeam201708 deleted, TorBrowserTeam201709 added

Trac:
Username: groovecoder
Cc: N/A to luke.crouch@gmail.com

Items for October 2017

Trac:
Keywords: TorBrowserTeam201709 deleted, TorBrowserTeam201710 added

Moving tickets over to November.

Trac:
Keywords: TorBrowserTeam201710 deleted, TorBrowserTeam201711 added

Moving tickets to December 2017

Moving tickets to December 2017, for realz.

Trac:
Keywords: TorBrowserTeam201711 deleted, TorBrowserTeam201712 added

Moving tickets to 2018.

Trac:
Keywords: TorBrowserTeam201712 deleted, TorBrowserTeam201801 added

Trac:
Keywords: TorBrowserTeam201801 deleted, TorBrowserTeam201802 added
Status: assigned to new

Adding to our March plate.

Trac:
Keywords: TorBrowserTeam201802 deleted, TorBrowserTeam201803 added

Moving our tickets to April.

Trac:
Keywords: TorBrowserTeam201803 deleted, TorBrowserTeam201804 added

Moving remaining tickets to May.

Trac:
Keywords: TorBrowserTeam201804 deleted, TorBrowserTeam201805 added

mentioned in issue #22162 (moved)

mentioned in issue #33939 (moved)

mentioned in issue #34429 (moved)

moved to tpo/applications/tor-browser#21657

mentioned in issue tpo/applications/fenix#33939 (closed)