Privacy/Features/Shortened HTTP Referer header: Difference between revisions

Privacy/Features/Shortened HTTP Referer header (view source)

Revision as of 18:34, 31 January 2014

2,123 bytes added , 31 January 2014

no edit summary

Sidstamm

canmove, Confirmed users

1,537

edits

@@ Line 2: / Line 2: @@
 |Feature name=Shortened HTTP Referer header
 |Feature stage=Definition
-|Feature health=At risk
+|Feature health=OK
-|Feature status note=stalled - lack of resources
 }}
 {{FeatureTeam
 |Feature product manager=Sid Stamm
 |Feature feature manager=Sid Stamm
+|Feature lead engineer=Sid Stamm
 |Feature security lead=Curtis Koenig
 |Feature privacy lead=Sid Stamm
 |Feature qa lead=Mihai Morar
+|Feature additional members=Owen Chu
 }}
 {{FeaturePageBody
@@ Line 19: / Line 20: @@
 This feature adds a way to attenuate the information that's sent as the referrer.  This is multiple phases:
-''Phase 1:'' User global control.  In the first phase, we should create a pref so users can select at most how much of the URL is sent as referrer.  They will be able to chose a full referrer value, a referrer that is {scheme, host, port, path}, {scheme, host, port}, or just host.
+''Phase 1:'' Plumbing for global and site-specific control.  In the first phase, we will create a global pref so power users and addons can select at most how much of the URL is sent as referrer, globally.  Additionally, on a site-by-site basis (probably via permission manager) a referrer policy can be applied to override the global setting.
-''Phase 2:'' Site-based control.  In the second phase, we enable sites to reduce the amount of data transmitted in referrers generated on their site.  This is done by the site sending a signal with the HTTP response indicating that outgoing referrers should be reduced.  Stripping options should include the same options mentioned in phase 1.  One mechanism could be to support [http://www.webkit.org/blog/907/webkit-nightlies-support-html5-noreferrer-link-relation/ the rel="noreferrer" attribute] to omit referers from link clicks.
+''Phase 2:'' Site-based control via CSP header and tag attributes.  In the second phase, we enable sites to reduce the amount of data transmitted in referrers generated on their site.  This is done by the site sending a signal with Content Security Policy response header indicating that outgoing referrers should be reduced.  Stripping options should include the same options mentioned in phase 1.  Sites will be able to specify a default policy for their pages, but we will also implement some per-link control (One mechanism could be to support [http://www.webkit.org/blog/907/webkit-nightlies-support-html5-noreferrer-link-relation/ the rel="noreferrer" attribute] to omit referers from link clicks, or similar).
-Site-based control also might be accomplished using the meta referrer tag.  [http://wiki.whatwg.org/wiki/Meta_referrer See whatwg wiki] and see also {{bug|704320}}.
+''Phase 3:'' Site-based control via meta tag.  Once the CSP HTTP response header can be used to set a site policy, we will extend CSP to be settable via the meta tag.  This way sites can specify a referrer policy without having to send an HTTP header.
+Note: Site-based control could be accomplished using the meta referrer tag, but we are opting to implement the same functionality in CSP to combine the security/privacy features.  [http://wiki.whatwg.org/wiki/Meta_referrer See whatwg wiki] and see also {{bug|704320}}.
+''Phase 4:'' New Firefox defaults.  Once sites have better control, we will decide how much to limit referrer sending by default (same-origin and cross-origin).  Right now too much information is transmitted in referer headers, and we should reduce that to the extent possible.  In this phase, we'll have an open discussion in [https://lists.mozilla.org/listinfo/dev-privacy dev-privacy] about what defaults to choose.
-==== Next steps ====
+''Phase 5:'' Extra bonus phase - UI for users to control how much referrer is sent on a global basis, likely in the privacy settings for Firefox.  Additionally, per-site control in the permissions and siteinfo UI.  This may not be necessary if Phase 4 is successful and there's not much referrer sending by default.
-* {{new|(Product Manager) Socialize pref idea via mailing list, brown bag, or some public discussion.}}
-* {{new|(Feature Team) Nail down user-initiated shortening requirements}}
-* {{new|(Feature Team) Nail down server-initiated shortening requirements}}
-* {{new|(Engineer?) Make test plan}}
-* {{new|(Engineer) Write patch for phase 1 and land}}
-* {{new|(Engineer) Write patch for phase 2 and land}}
 See also: {{bug|587523}}
-|Feature users and use cases=; Leaking search terms : From {{bug|587523#c0}}: "An example of this can be seen by searching for 'no knead bread' with Google, and clicking on the 4th search result, which takes you to www.breadtopia.com/basic-no-knead-method/, a page which "helpfully" lets you know that it is aware of the search terms that brought you to the site."
+|Feature users and use cases=Nice document from Dan Aurbach:
+https://bug822869.bugzilla.mozilla.org/attachment.cgi?id=694472
+; Leaking search terms : From {{bug|587523#c0}}: "An example of this can be seen by searching for 'no knead bread' with Google, and clicking on the 4th search result, which takes you to www.breadtopia.com/basic-no-knead-method/, a page which "helpfully" lets you know that it is aware of the search terms that brought you to the site."
 ; Outbound link anonymization : Many sites like gmail send outbound links through a common redirect to strip off any information that may be present in the URL.  Supporting rel="noreferrer" reduces the need for extra HTTP traffic and redirects.
 |Feature requirements=* Test plan must be created and implemented
@@ Line 46: / Line 46: @@
 * This is not the Origin header
 |Feature functional spec=See also [http://www.whatwg.org/specs/web-apps/current-work/multipage/links.html#link-type-noreferrer the noreferrer link type]
-|Feature implementation notes=* [http://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919 Facebook write-up on "HTTP-Referer" woes]
+|Feature implementation plan=''Phase 1:''
+* {{done|global default referrer policy via pref}} {{bug|822869}}
+* {{new|site-specific setting via permission}}
+''Phase 2:''
+* {{new|CSP referrer directive support}} {{bug|965727}}
+* {{new|noreferrer attribute for anchor tags}} {{bug|530396}}
+* {{new|referrer (policy) attribute for anchor tags}}
+''Phase 3:''
+* {{new|meta tag support for CSP}} {{bug|663570}}
+''Phase 4:''
+* {{new|discussion in [https://lists.mozilla.org/listinfo/dev-privacy dev-privacy] about measuring success of new referrer defaults}}
+* {{new|discussion in [https://lists.mozilla.org/listinfo/dev-privacy dev-privacy] to choose new policy (and measurement of its effects)}}
+* {{new|change global defaults for referrer}}
+''Phase 5:''
+{{new|decide if this phase should be dropped or completed}}
+{{new|about:permissions and siteInfo UI for per-site referrer settings}}
+{{new|privacy settings pane UI for global referrer settings}}
+|Feature implementation notes=See above in Planning section for progress.  Just some links here.
+* [http://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919 Facebook write-up on "HTTP-Referer" woes]
 * [http://www.webkit.org/blog/907/webkit-nightlies-support-html5-noreferrer-link-relation/ the rel="noreferrer" attribute]
 * {{bug|587523}}: strip referrer in a future anonymous mode
+|Feature landing criteria=* Has tests
+* Tests pass on B2G, Android and Desktop
 }}
 {{FeatureInfo
-|Feature priority=P2
+|Feature priority=P1
 |Feature rank=4
 |Feature theme=Tracking Control