Prune location.ancestorOrigins entries

[fmarier]

location.ancestorOrigins allows embedded pages to know the origin of all of the parent pages.

For example, if a.com iframes b.com which itself iframes c.com, then the innermost frame (c.com) can see: [b.com, a.com]

Previously, only the immediate parent was visible via the Referer header or document.referrer property.

Firefox has not yet implemented this, but is considering doing so in a way that does not leak a.com to c.com:

• show the parent origin unless the referrer would be omitted based on a.com's referrer policy
• only expose the number of other ancestor origins

In our example, Firefox would therefore hypothetically return [b.com, "null"] where "null" does include the quotes.

[fmarier]

Test page: https://fmarier.com/referrer/frames.html

[ShivanKaul]

@pes10k suggested checking Chrome web data for prevalence.

[pes10k]

here is the chrome web data info: https://chromestatus.com/metrics/feature/timeline/popularity/823

TL;DR; it looks very uncommon, and so its either a very low risk, or Chrome stoped instrumenting it.

[tophf]

or Chrome stoped instrumenting it.

Yes, it stopped in 2017, and can be enabled only explicitly by making a build with compile-time flags enable_blink_bindings_tracing, extended_tracing_enabled. You can see the new histogram by git-blaming the source.