Fix Sec-Fetch-Site header (#37277)

While working on #37209 I discovered that the header was computed
incorrectly. After carefully reading the specification, I realized that
the link in the spec was wrong and we were missing the fact that for
host-domains, we should operate on the registrable domain.

Additionally, the same-site call was missing the negation.

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
This commit is contained in:
Tim van der Lippe 2025-06-07 18:57:29 +02:00 committed by GitHub
parent a625420b23
commit c808ff7666
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
36 changed files with 41 additions and 444 deletions

View file

@ -1,45 +1,9 @@
[element-script.https.sub.html]
[sec-fetch-site - Cross-site, no attributes]
expected: FAIL
[sec-fetch-site - Cross-site, attributes: type=module]
expected: FAIL
[sec-fetch-site - Same-Origin -> Cross-Site -> Same-Origin redirect, no attributes]
expected: FAIL
[sec-fetch-site - Same-Origin -> Cross-Site -> Same-Origin redirect, attributes: type=module]
expected: FAIL
[sec-fetch-site - Cross-Site -> Same Origin, no attributes]
expected: FAIL
[sec-fetch-site - Cross-Site -> Same Origin, attributes: type=module]
expected: FAIL
[sec-fetch-site - Cross-Site -> Same-Site, no attributes]
expected: FAIL
[sec-fetch-site - Cross-Site -> Same-Site, attributes: type=module]
expected: FAIL
[sec-fetch-site - Cross-Site -> Cross-Site, no attributes]
expected: FAIL
[sec-fetch-site - Cross-Site -> Cross-Site, attributes: type=module]
expected: FAIL
[sec-fetch-site - Same-Origin -> Cross-Site, no attributes]
expected: FAIL
[sec-fetch-site - Same-Origin -> Cross-Site, attributes: type=module]
expected: FAIL
[sec-fetch-site - Same-Site -> Cross-Site, no attributes]
expected: FAIL
[sec-fetch-site - Same-Site -> Cross-Site, attributes: type=module]
expected: FAIL
[sec-fetch-storage-access - Cross-site, no attributes]
expected: FAIL
[sec-fetch-site - Same-Origin -> Same-Site -> Same-Origin redirect, attributes: type=module]
expected: FAIL
[sec-fetch-site - Same-Site -> Same Origin, attributes: type=module]
expected: FAIL