Skip to content

Relax window.name clearing protection for page refresh

In #16620 (closed), the torbutton patch was ported to a Firefox patch (originally legacy/trac#3414 (closed)). The purpose of this patch is described in section 4.5.13 of the design doc. However, the goal of these patches is preventing cross-origin linkability, unfortunately the current implementation affects same-origin requests, as well. In particular a webapp may use window.name for storing session information, and when the page is reloaded window.name is cleared.

The current patch is a9bf408f

Edited by Matthew Finkel
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information