Write Firefox patch for removing third-party HTTP authentication tokens

We still remove third-party HTTP authentication tokens in the SafeCache related code. We should turn that into a C++ patch + a proper test and get rid of the JS code as it is not needed anymore since the fix for #13742 (moved) landed.

added TorBrowserTeam201502R component::applications/tor browser owner::mcs priority::medium resolution::fixed status::closed tbb-firefox-patch tbb-linkability tbb-testcase type::enhancement labels

I think we should aim for having this as part of our the thirdparty isolation feature merge for FF38.

Trac:
Keywords: N/A deleted, TorBrowserTeam201501 added

Trac:
Owner: tbb-team to mcs
Cc: N/A to mikeperry, brade, mcs
Status: new to assigned

Kathy and are working on this. Our current thinking is that we will modify nsHttpChannel::BeginConnect() and nsHttpChannel::DoAuthRetry() to suppress the Authorization header when the request is a third party one. That approach will keep the behavior consistent with what is implemented by Torbutton's stanford-safecache.js code today.

We will use methods from ThirdPartyUtil to determine if the request is a third party request. We may need to whitelist requests whose parent is "chrome://browser/content/browser.xul" to allow for authenticated favicon requests (as is done in stanford-safecache.js).

Trac:
Keywords: TorBrowserTeam201501 deleted, TorBrowserTeam201502 added

We have not written automated tests yet, but please review these two commits:

https://gitweb.torproject.org/user/brade/tor-browser.git/commit/?h=bug13900-01&id=b6be541aaa22422ecf9e70680282aa9c7dc05f06

https://gitweb.torproject.org/user/brade/torbutton.git/commit/?h=bug13900-01&id=d85c080568e7bfb645fc8ef3efd7e294fce4c220

Trac:
Keywords: TorBrowserTeam201502 deleted, TorBrowserTeam201502R added
Status: assigned to needs_review

Ok, this looks good to me. For now, I am thinking we will make a push for writing tests when we revisit this in April/May for the Firefox 38 rebase.

Trac:
Status: needs_review to closed
Resolution: N/A to fixed

closed

mentioned in issue #14089 (moved)

mentioned in issue #21555 (moved)

mentioned in issue #21756 (moved)

moved to tpo/applications/tor-browser#13900 (closed)