From 53149ed64642a29e23ef7dde208e935bca953a09 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Thu, 4 Jul 2024 22:40:06 +0200 Subject: [PATCH] Issue #2542 - Part 6: Add Sec-Fetch-User header for all requests that are the direct result of a system principal request. This means navigation resulting from interaction with the browser UI should result in a -user header (address bar navigation, bookmarks, etc.) --- dom/security/SecFetch.cpp | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/dom/security/SecFetch.cpp b/dom/security/SecFetch.cpp index 203832af4c..fec82c13e4 100644 --- a/dom/security/SecFetch.cpp +++ b/dom/security/SecFetch.cpp @@ -271,12 +271,22 @@ void SecFetch::AddSecFetchSite(nsIHttpChannel* aHTTPChannel) { } void SecFetch::AddSecFetchUser(nsIHttpChannel* aHTTPChannel) { - // TODO: Bug 1621987: Implement Sec-Fetch-User + bool userInitiated = false; + + nsCOMPtr loadInfo = aHTTPChannel->GetLoadInfo(); + // A request issued by the browser is always assumed user-initiated. + if (nsContentUtils::IsSystemPrincipal(loadInfo->TriggeringPrincipal())) { + userInitiated = true; + } - // nsAutoCString user("?1"); - // nsresult rv = aHTTPChannel->SetRequestHeader( - // NS_LITERAL_CSTRING("Sec-Fetch-User"), user, false); - // Unused << NS_WARN_IF(NS_FAILED(rv)); + // TODO: Implement content interaction + + nsAutoCString user("?1"); + + if (userInitiated) { + nsresult rv = aHTTPChannel->SetRequestHeader(NS_LITERAL_CSTRING("Sec-Fetch-User"), user, false); + Unused << NS_WARN_IF(NS_FAILED(rv)); + } } void SecFetch::AddSecFetchHeader(nsIHttpChannel* aHTTPChannel) {