[tor-bugs] #13900 [Tor Browser]: Write Firefox patch for removing third-party HTTP authentication tokens

[Tor Bug Tracker & Wiki]

#13900: Write Firefox patch for removing third-party HTTP authentication tokens
-------------------------+-------------------------------------------------
     Reporter:  gk       |      Owner:  mcs
         Type:           |     Status:  assigned
  enhancement            |  Milestone:
     Priority:  normal   |    Version:
    Component:  Tor      |   Keywords:  tbb-linkability, tbb-firefox-patch,
  Browser                |  tbb-testcase, TorBrowserTeam201501
   Resolution:           |  Parent ID:
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------

Comment (by mcs):

 Kathy and are working on this.  Our current thinking is that we will
 modify nsHttpChannel::BeginConnect() and nsHttpChannel::DoAuthRetry() to
 suppress the Authorization header when the request is a third party one.
 That approach will keep the behavior consistent with what is implemented
 by Torbutton's stanford-safecache.js code today.

 We will use methods from ThirdPartyUtil to determine if the request is a
 third party request.  We may need to whitelist requests whose parent is
 "chrome://browser/content/browser.xul" to allow for authenticated favicon
 requests (as is done in stanford-safecache.js).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13900#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online