New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 733164 link

Starred by 1 user

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

Figure out whether we can require origins with a domain set to match ports

Project Member Reported by jochen@chromium.org, Jun 14 2017

Issue description

it's a bit difficult was SecurityOrigin is in platform/weborigin where we can count features, but maybe we can approximate usage.
 

Comment 1 by mkwst@chromium.org, Jun 14 2017

If we can measure this, it would also be interesting to understand how often the `document.domain` check actually matters. Like, I see ads set it all the time, and then try to poke at their cross-origin parents. That's never going to work, `document.domain` or not.
Project Member

Comment 2 by bugdroid1@chromium.org, Jun 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/56c9c7065fb31b72c730e90655f1994bf8405557

commit 56c9c7065fb31b72c730e90655f1994bf8405557
Author: Jochen Eisinger <jochen@chromium.org>
Date: Wed Jun 14 12:47:34 2017

Add a use counter for document.domain usage and ports

BUG=733164
R=mkwst@chromium.org

Change-Id: I7e0c763477e87bfbb2ba8ce106d15b5aafa100ad
Reviewed-on: https://chromium-review.googlesource.com/535515
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Mike West <mkwst@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#479361}
[modify] https://crrev.com/56c9c7065fb31b72c730e90655f1994bf8405557/third_party/WebKit/Source/core/dom/Document.cpp
[modify] https://crrev.com/56c9c7065fb31b72c730e90655f1994bf8405557/third_party/WebKit/public/platform/WebFeature.h
[modify] https://crrev.com/56c9c7065fb31b72c730e90655f1994bf8405557/tools/metrics/histograms/enums.xml

Comment 3 by jochen@chromium.org, Jul 31 2017

Labels: -M-61
so the data suggests that it's very rare for the port to be non-default. I guess what I'd like to achieve is to separate default port from non-default port. That means that we also have to do this for cookies

Comment 5 by est...@chromium.org, Nov 10 2017

Labels: Hotlist-EnamelAndFriendsFixIt

Comment 6 by est...@chromium.org, Feb 18 2018

Labels: -Hotlist-EnamelAndFriendsFixIt
Cc: jochen@chromium.org
Owner: ----
Status: Available (was: Assigned)
unassigning from my self, as I realistically won't get around to adding more metrics anytime soon.

fwiw, I think the next step would be to extend CanonicalCookie to store one additional bit whether it was received on the default port for its protocol, and plumbing that through all the layers

Sign in to add a comment