RequestPolicy/tractest — Issue #125: Dependency based cross site request listing
Author: jsamuel
Created: 2011-12-22 02:41:20+00:00
State: open
Labels: extension

Cross site requests can result in further cross site requests; however, only a subset of these are shown in the "Other origins" submenu. Further, even if a request does appear in the "Other origins" submenu, there is no correlation to the original request.

This can significantly complicate empirically trying to configure policy, as the user is forced to track what requests resulted in further requests manually and individually.

Listing requests by dependency would seem to help in this regard. For example:

{{{
www.example.com includes a script at js.example.com
js.example.com embeds an image into the body of the page at img.example.com
img.example.com redirects to thumbs.example.com
}}}

Currently this is shown (AFAIK) as:

{{{
Same Origin:
js.example.com
img.example.com

Other Origin:
img.example.com => thumbs.example.com
}}}

However, this does not indicate the correlation between the requests, which can be shown on a "dependency" basis:

{{{
js.example.com
img.example.com
thumbs.example.com
}}}

Granted, this would require repeated listings of requested hostnames if requested multiple times for different dependencies; however, this would still be helpful to visualize how the requests were structured to form the page.

The challenge here would be to correctly correlate subsequent requests to previous requests...

For the use case of empirical policy development, perhaps merely identifying what NEW requests were made if the page is reloaded would suffice...