Referrers: Flip ReducedReferrerGranularity to enabled by default

We rolled out ReducedReferrerGranularity, which changes the default referrer policy to strict-origin-when-cross-origin, to 100% in M85 stable. To clean up the experiment, we need to enable the behavior by default. This will take effect in M88; we'll follow up by removing the flag, the corresponding enterprise policy, and the corresponding field trial testing configuration. Changing this base::Feature's default value entails cleaning up the remaining tests that weren't within the field trial testing config's scope. These changes are mostly straightforward, involving updating expectations of full-URL referrers to expectations of the corresponding origins, but some tests require logic changes to make sure that they still cover the desired behavior. (For instance, multiple tests previously expected origins in order to test that a particular, arbitrary, non-default referrer policy took effect: to achieve a similar effect, this CL updates these tests to now expect full URLs and swaps in non-default full-URL-generating policies for the prior non-default origin-generating policies.) Launch approval: crbug.com/1019930 Spec change: w3c/webappsec-referrer-policy#142 Bug: 1014207, 1131688 Change-Id: Ib575af6a858641fb1fe2c8de73941f5702d88191 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2429247 Reviewed-by: Charlie Reis <creis@chromium.org> Reviewed-by: Dominic Farolino <dom@chromium.org> Reviewed-by: Kunihiko Sakamoto <ksakamoto@chromium.org> Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org> Reviewed-by: Jeremy Roman <jbroman@chromium.org> Commit-Queue: David Van Cleve <davidvc@chromium.org> Cr-Commit-Position: refs/heads/master@{#828098} GitOrigin-RevId: 226b67fc9bb0aee954b8f35eb4e485b310c24713
mjfroman · Nov 17, 2020 · 9692f9f · 9692f9f
1 parent 4c6de56
commit 9692f9f
Show file tree

Hide file tree

Showing 139 changed files with 1,391 additions and 4,503 deletions.
diff --git a/blink/common/features.cc b/blink/common/features.cc
@@ -739,7 +739,7 @@ const base::Feature kCompositingOptimizations{
 // Reduce the amount of information in the default 'referer' header for
 // cross-origin requests.
 const base::Feature kReducedReferrerGranularity{
-    "ReducedReferrerGranularity", base::FEATURE_DISABLED_BY_DEFAULT};
+    "ReducedReferrerGranularity", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Enables the constant streaming in the ContentCapture task.
 const base::Feature kContentCaptureConstantStreaming = {

diff --git a/blink/common/loader/referrer_utils_unittest.cc b/blink/common/loader/referrer_utils_unittest.cc
@@ -12,7 +12,7 @@ namespace blink {
 
 TEST(DefaultNetReferrerPolicyTest, Unconfigured) {
   EXPECT_EQ(blink::ReferrerUtils::GetDefaultNetReferrerPolicy(),
-            net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
+            net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN);
 }
 
 TEST(DefaultNetReferrerPolicyTest, FeatureOnly) {

diff --git a/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-referrer.any.js b/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-referrer.any.js
@@ -35,8 +35,11 @@ var origin = get_host_info().HTTP_ORIGIN + "/";
 corsPreflightReferrer("Referrer policy: no-referrer", corsUrl, "no-referrer", undefined, "");
 corsPreflightReferrer("Referrer policy: no-referrer", corsUrl, "no-referrer", "myreferrer", "");
 
-corsPreflightReferrer("Referrer policy: \"\"", corsUrl, "", undefined, location.toString())
-corsPreflightReferrer("Referrer policy: \"\"", corsUrl, "", "myreferrer", new URL("myreferrer", location).toString());
+corsPreflightReferrer("Referrer policy: \"\"", corsUrl, "", undefined, origin);
+corsPreflightReferrer("Referrer policy: \"\"", corsUrl, "", "myreferrer", origin);
+
+corsPreflightReferrer("Referrer policy: no-referrer-when-downgrade", corsUrl, "no-referrer-when-downgrade", undefined, location.toString())
+corsPreflightReferrer("Referrer policy: no-referrer-when-downgrade", corsUrl, "no-referrer-when-downgrade", "myreferrer", new URL("myreferrer", location).toString());
 
 corsPreflightReferrer("Referrer policy: origin", corsUrl, "origin", undefined, origin);
 corsPreflightReferrer("Referrer policy: origin", corsUrl, "origin", "myreferrer", origin);

diff --git a/...s/browsing-the-web/navigating-across-documents/source/navigate-child-src-about-blank.html b/...s/browsing-the-web/navigating-across-documents/source/navigate-child-src-about-blank.html
@@ -6,12 +6,14 @@
 <div id=log></div>
 <iframe></iframe>
 <script>
-  setup({ single_test: true });
+  setup({
+    single_test: true
+  });
   onload = function() {
     var fr = document.querySelector("iframe")
     fr.src = "about:blank"
     fr.onload = function() {
-      assert_equals(fr.contentDocument.referrer, document.URL)
+      assert_equals(fr.contentDocument.referrer, document.location.origin + '/')
       done()
     }
   }

diff --git a/blink/web_tests/external/wpt/html/browsers/windows/browsing-context.html b/blink/web_tests/external/wpt/html/browsers/windows/browsing-context.html
@@ -40,7 +40,7 @@
     }, "Check that new document nodes extant, empty");
 
     test(function () {
-      assert_equals(doc.referrer, document.URL, "The document's referrer should be its creator document's address.");
+      assert_equals(doc.referrer, document.location.origin + '/', "The document's referrer should be its creator document's origin.");
       assert_equals(iframe.contentWindow.parent.document, document);
     }, "Check the document properties corresponding to the creator browsing context");
     </script>

diff --git a/...eporting/access-reporting/access-from-coop-page-to-opener_coop-ro_cross-origin.https.html b/...eporting/access-reporting/access-from-coop-page-to-opener_coop-ro_cross-origin.https.html
@@ -22,7 +22,7 @@
   const report_token = token();
   const openee_token = token();
 
-  const opener_url = location.href;
+  const opener_origin = location.origin + '/';
 
   const reportTo = reportToHeaders(report_token);
   const openee_url = cross_origin + executor_path +
@@ -52,7 +52,7 @@
   assert_equals(report.body.openerURL, "");
   assert_equals(report.body.openeeURL, undefined);
   assert_equals(report.body.otherDocumentURL, undefined);
-  assert_equals(report.body.referrer, opener_url);
+  assert_equals(report.body.referrer, opener_origin);
   assert_equals(report.body.initialPopupURL, undefined);
 }, name);
 

diff --git a/...eporting/access-reporting/access-to-coop-page-from-opener_coop-ro_cross-origin.https.html b/...eporting/access-reporting/access-to-coop-page-from-opener_coop-ro_cross-origin.https.html
@@ -23,7 +23,7 @@
   const openee_token = token();
   const opener_token = token(); // The current test window.
 
-  const opener_url = location.href;
+  const opener_origin = location.origin + '/';
 
   const reportTo = reportToHeaders(report_token);
   const openee_url = cross_origin + executor_path +
@@ -59,7 +59,7 @@
   assert_equals(report.body.openerURL, "");
   assert_equals(report.body.openeeURL, undefined);
   assert_equals(report.body.otherDocumentURL, undefined);
-  assert_equals(report.body.referrer, opener_url);
+  assert_equals(report.body.referrer, opener_origin);
   assert_equals(report.body.initialPopupURL, undefined);
 }, name);
 

diff --git a/...rigin-opener-policy/reporting/navigation-reporting/reporting-popup-same-origin.https.html b/...rigin-opener-policy/reporting/navigation-reporting/reporting-popup-same-origin.https.html
@@ -31,7 +31,7 @@
             "disposition": "enforce",
             "effectivePolicy": "same-origin",
             "previousResponseURL": "",
-            "referrer": `${location.href}`, // referrer
+            "referrer": `${location.origin}/`, // referrer
             "type": "navigation-to-response"
           },
           "url": /uuid=EXECUTOR_UUID$/,
@@ -84,7 +84,7 @@
           "body": {
             "disposition": "enforce",
             "previousResponseURL": "",
-            "referrer": `${location.href}`, // referrer
+            "referrer": `${location.origin}/`, // referrer
             "type": "navigation-to-response"
           },
           "url": /uuid=EXECUTOR_UUID$/,

diff --git a/...er-policy/reporting/navigation-reporting/reporting-popup-unsafe-none-report-to.https.html b/...er-policy/reporting/navigation-reporting/reporting-popup-unsafe-none-report-to.https.html
@@ -109,7 +109,7 @@
             "disposition": "enforce",
             "effectivePolicy": "same-origin",
             "previousResponseURL": ``,
-            "referrer": `${location.href}`, // referrer
+            "referrer": `${location.origin}/`, // referrer
             "type": "navigation-to-response"
           },
           "url": /uuid=EXECUTOR_UUID$/,

diff --git a/blink/web_tests/external/wpt/referrer-policy/4K+1/gen/top.http-rp/unset/a-tag.http.html b/blink/web_tests/external/wpt/referrer-policy/4K+1/gen/top.http-rp/unset/a-tag.http.html
@@ -14,26 +14,6 @@
     <script>
       TestCase(
         [
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-http",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "a-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for a-tag to cross-http origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-https",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "a-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for a-tag to cross-https origin and no-redirect redirection from http context."
-          },
           {
             "expectation": "stripped-referrer",
             "origin": "same-http",
@@ -43,16 +23,6 @@
             "subresource": "a-tag",
             "subresource_policy_deliveries": [],
             "test_description": "Referrer Policy: Expects stripped-referrer for a-tag to same-http origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-https",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "a-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for a-tag to same-https origin and no-redirect redirection from http context."
           }
         ],
         new SanityChecker()

diff --git a/blink/web_tests/external/wpt/referrer-policy/4K+1/gen/top.http-rp/unset/fetch.http.html b/blink/web_tests/external/wpt/referrer-policy/4K+1/gen/top.http-rp/unset/fetch.http.html
@@ -14,66 +14,6 @@
     <script>
       TestCase(
         [
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-http",
-            "redirection": "keep-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to cross-http origin and keep-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-http",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to cross-http origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-http",
-            "redirection": "swap-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to cross-http origin and swap-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-https",
-            "redirection": "keep-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to cross-https origin and keep-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-https",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to cross-https origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-https",
-            "redirection": "swap-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to cross-https origin and swap-origin redirection from http context."
-          },
           {
             "expectation": "stripped-referrer",
             "origin": "same-http",
@@ -93,46 +33,6 @@
             "subresource": "fetch",
             "subresource_policy_deliveries": [],
             "test_description": "Referrer Policy: Expects stripped-referrer for fetch to same-http origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-http",
-            "redirection": "swap-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to same-http origin and swap-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-https",
-            "redirection": "keep-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to same-https origin and keep-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-https",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to same-https origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-https",
-            "redirection": "swap-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "fetch",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for fetch to same-https origin and swap-origin redirection from http context."
           }
         ],
         new SanityChecker()

diff --git a/blink/web_tests/external/wpt/referrer-policy/4K+1/gen/top.http-rp/unset/iframe-tag.http.html b/blink/web_tests/external/wpt/referrer-policy/4K+1/gen/top.http-rp/unset/iframe-tag.http.html
@@ -14,66 +14,6 @@
     <script>
       TestCase(
         [
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-http",
-            "redirection": "keep-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to cross-http origin and keep-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-http",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to cross-http origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-http",
-            "redirection": "swap-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to cross-http origin and swap-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-https",
-            "redirection": "keep-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to cross-https origin and keep-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-https",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to cross-https origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "cross-https",
-            "redirection": "swap-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to cross-https origin and swap-origin redirection from http context."
-          },
           {
             "expectation": "stripped-referrer",
             "origin": "same-http",
@@ -93,46 +33,6 @@
             "subresource": "iframe-tag",
             "subresource_policy_deliveries": [],
             "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to same-http origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-http",
-            "redirection": "swap-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to same-http origin and swap-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-https",
-            "redirection": "keep-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to same-https origin and keep-origin redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-https",
-            "redirection": "no-redirect",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to same-https origin and no-redirect redirection from http context."
-          },
-          {
-            "expectation": "stripped-referrer",
-            "origin": "same-https",
-            "redirection": "swap-origin",
-            "source_context_list": [],
-            "source_scheme": "http",
-            "subresource": "iframe-tag",
-            "subresource_policy_deliveries": [],
-            "test_description": "Referrer Policy: Expects stripped-referrer for iframe-tag to same-https origin and swap-origin redirection from http context."
           }
         ],
         new SanityChecker()