tor-browser

commit 878c968479b0186ca785b79ddea1fd861a38f4e3
parent fdbf27485b14b3e81f9cb5ffd3fa2d9b2776709a
Author: Manuel Bucher <manuel@mozilla.com>
Date:   Tue,  7 Oct 2025 11:08:28 +0000

Bug 1992712 - Storage-Access-Headers: Only send in secure context (https) r=timhuang

Differential Revision: https://phabricator.services.mozilla.com/D267604

Diffstat:
M
toolkit/components/antitracking/AntiTrackingUtils.cpp
 | 
17
++++++++++++++---

1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/toolkit/components/antitracking/AntiTrackingUtils.cpp b/toolkit/components/antitracking/AntiTrackingUtils.cpp
@@ -30,6 +30,7 @@
 #include "nsIPermission.h"
 #include "nsIURI.h"
 #include "nsNetUtil.h"
+#include "nsMixedContentBlocker.h"
 #include "nsPIDOMWindow.h"
 #include "nsQueryObject.h"
 #include "nsRFPService.h"
@@ -621,9 +622,17 @@ AntiTrackingUtils::GetStoragePermissionStateInParent(nsIChannel* aChannel) {
     }
   }
 
-  // determine whether storage access could be granted using the
-  // Activate-Storage-Access header from the storage-access-headers draft.
-  // XXX(Bug 1968723, Bug 1968725): The response header is not yet parsed.
+  // The remaining part of the function is for determining whether storage
+  // access could be granted using Storage-Access-Headers. And granting it
+  // if instructed by the server via the "Activate-Storage-Access"-header.
+  // Storage-Access headers are only sent in secure context
+  if(!nsMixedContentBlocker::IsPotentiallyTrustworthyOrigin(trackingURI)) {
+    return nsILoadInfo::NoStoragePermission;
+  }
+
+  // In case Storage-Access was granted to the origin prior with the
+  // Storage-Access-API and the permission still exists, the website can
+  // activate Storage-Access with Storage-Access-Headers.
   uint32_t result = 0;
   rv = AntiTrackingUtils::TestStoragePermissionInParent(
       targetPrincipal, trackingPrincipal, &result);
@@ -640,6 +649,8 @@ AntiTrackingUtils::GetStoragePermissionStateInParent(nsIChannel* aChannel) {
     }
   }
 
+  // In the ABA-case, A can also get storage-access automatically via
+  // Storage-Access-Headers.
   if (isThirdParty) {
     if (RefPtr<net::nsHttpChannel> httpChannel = do_QueryObject(aChannel)) {
       // Determine whether we are in ABA or AB case, erroring on AB side