ServiceWorkers violate first party isolation, probably

I haven't looked at ServiceWorkers (starting Firefox 33) closely, but I think they likely violate first party isolation. A brief look at some code in mozilla-central suggests that we may be able to use the same code to isolate SharedWorkers and ServiceWorkers by first party domain.

added BugSmashFund component::applications/tor browser ff78-esr owner::tbb-team points::1 priority::high severity::normal status::new tbb-linkability type::defect labels

Trac:
Keywords: N/A deleted, tbb-linkability added
Component: - Select a component to Tor Browser
Owner: N/A to tbb-team

Trac:
Keywords: N/A deleted, ff38-esr added
Cc: N/A to gk

ServiceWorkers are still disabled by pref in FF38.

Trac:
Keywords: ff38-esr deleted, ff45-esr added
Summary: ServiceWorkers (arriving FF33) violate first party isolation, probably to ServiceWorkers violate first party isolation, probably

Don't forget the associated CacheStorage/Cache interfaces: https://developer.mozilla.org/en-US/docs/Web/API/CacheStorage.

Replying to gk:

Don't forget the associated CacheStorage/Cache interfaces: https://developer.mozilla.org/en-US/docs/Web/API/CacheStorage.

This landed in Firefox 39 (https://bugzilla.mozilla.org/show_bug.cgi?id=940273).

Trac:
Priority: normal to major

This is disabled in ESR 45 moving it on the ESR 52 radar. This holds for the Push API as well. See: https://hg.mozilla.org/releases/mozilla-esr45/rev/67317aa69b40.

Trac:
Keywords: ff45-esr deleted, ff52-esr added
Reviewer: N/A to N/A
Sponsor: N/A to N/A
Severity: N/A to Normal

Might be worth keeping https://bugzilla.mozilla.org/show_bug.cgi?id=1201160 in mind.

It's still off in ESR 52: https://bugzilla.mozilla.org/show_bug.cgi?id=1338144, moving to ESR 59 tasks

Trac:
Keywords: ff52-esr deleted, ff59-esr added

Firefox 60 is the new ESR.

Trac:
Keywords: ff59-esr deleted, ff60-esr added

Will still be disabled in ESR 60: https://bugzilla.mozilla.org/show_bug.cgi?id=1457915. However, we might need to do something about it much earlier for the mobile context...

Trac:
Keywords: ff60-esr deleted, ff67-esr added

Version 68 of Firefox will be the next ESR.

Trac:
Keywords: ff67-esr deleted, ff68-esr added

Don't forget Push. Resolved #27729 (moved) as a duplicate.

Trac:
Cc: gk to gk, traumschule

Still disabled in Firefox ESR 68 on desktop but not mobile. See: https://bugzilla.mozilla.org/show_bug.cgi?id=1557565.

https://bugzilla.mozilla.org/show_bug.cgi?id=1557596 :(((

Adding Sponsor 44 to ESR68 tickets

Trac:
Sponsor: N/A to Sponsor44-can

Trac:
Keywords: N/A deleted, tbb-9.0-must-alpha added

Trac:
Points: N/A to 1

AFAIK, service workers APIs should not be usable in private browsing mode, navigator.serviceWorker is not present in that case. So in mobile they have flipped the serviceworker pref but as long as we only have private windows it should not be usable. Should we still investigate this for browser.privatebrowsing.autostart = false?

Trac:
Status: new to needs_information

Replying to acat:

AFAIK, service workers APIs should not be usable in private browsing mode, navigator.serviceWorker is not present in that case. So in mobile they have flipped the serviceworker pref but as long as we only have private windows it should not be usable. Should we still investigate this for browser.privatebrowsing.autostart = false?

We should disable dom.serviceWorkers.enabled on mobile. We don't support browser.privatebrowsing.autostart = false, but we know some people use Tor Browser like that, regardless of the consequences. In the longer term, we should make sure ServiceWorkers do not violate FPI when used in non-private browsing mode, but I don't think verifying this now is worth the effort.

I'll open a ticket for disabling it on Android (for the people who use non-private browsing mode).

I support closing this ticket as done, and opening another ticket specifically for non-private browsing mode, so we don't forget about this in the future.

Let's keep this ticket for now to have a single point for all the context around this feature. Disabling ServiceWorkers landed on tor-browser-68.1.0esr-9.0-2 (commit 726047a459acf9d8c26fcfdd72584f0196dd60ce) (see comment:30:ticket:31010 for more context).

Let's remove it from our ESR 68 radar, though.

Trac:
Keywords: tbb-9.0-must-alpha, ff68-esr deleted, N/A added
Status: needs_information to new

Trac:
Keywords: N/A deleted, ff76-esr added

There is no 76 ESR.

Trac:
Keywords: ff76-esr deleted, ff78-esr added

BugSmashFund can be used for the ESR work done so far

Trac:
Keywords: N/A deleted, BugSmashFund added

Sponsor 44 only covered PM and Team Lead work

Trac:
Sponsor: Sponsor44-can to N/A

changed time estimate to 8h

mentioned in issue #27729 (moved)

mentioned in issue #31010 (moved)

moved to tpo/applications/tor-browser#15563