Intent to ship: Clear browsing context name on cross site navigation or history traversal

[Andy Paicu]

Contact emails

andy...@gmail.com

Spec

https://html.spec.whatwg.org/multipage/browsers.html#resetBCName

I2I

https://groups.google.com/a/chromium.org/d/msg/blink-dev/8uZDknA2Ua0/Sm33B4MPCwAJ

Summary

This is a port of this change: https://trac.webkit.org/changeset/209076/webkit from safari. To summarize:

When updating the history after a cross-origin navigation, the HTML Standard says:

"If the browsing context is a top-level browsing context, but not an auxiliary browsing

context, then set the browsing context's name to the empty string."

Currently we are not doing this which means there's potential information leak.

UseCounter is at around 0.008%: https://www.chromestatus.com/metrics/feature/timeline/popularity/2023

This UseCounter counts pages where the non-null name has been accessed after a cross-origin navigation. This is (I think) a bit higher than the usual threshold but I suspect that a lot of the uses are accidental and don't necessarily break based on document name. Also I would argue that for fixing potential leaks a higher than usual use counter could be acceptable.

Motivation

It implements the HTML Standard and fixes a potential information leak.

Interoperability and Compatibility Risk

Edge: No signals

Firefox: No signals

Safari: Shipped

Web developers: No signals

Ongoing technical constraints

None

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

Yes

Web Platform Tests

All tests will be added to the Web Platform Tests folder

OWP launch tracking bug

Add crbug.com/706350

Link to entry on the feature dashboard

https://www.chromestatus.com/feature/5929195548966912

Requesting approval to ship?

Yes

[Philip Jägenstedt]

This looks small enough to be called a bug fix and bypass the process, but LGTM1.

After the tests have landed in web-platform-tests, filing bugs on the browsers that still fail would probably shorten the time to interop for this little corner of the web.

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CACnmqYhgazNvOWNdZooLXVaVL4y8Ce4YhtwxxqoZu9uZ4K8hRw%40mail.gmail.com.

[Dimitri Glazkov]

LGTM2

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAARdPYfbc9otb0eEZWXpiTbNxoK-%3DF53sGshorTFFdgk_%2Bxc-A%40mail.gmail.com.

[Mike West]

LGTM3.

-mike

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAOtFfx7C-P5T4aWPWARE_fgHY3W_V6Zd_dYwnd12DPRf0syB_g%40mail.gmail.com.