RequestPolicy/requestpolicy — Issue #80: thenation.com has javascript that causes duplicate requests which result in missing destinations in RP menu
Author: jsamuel
Created: 2011-12-22 18:50:55+00:00
State: open
Labels: extension

imported trac ticket
created: 2010-02-08 07:08:52
reporter: justin

This page:

http://www.thenation.com/doc/20100222/lessig

performs more than one request to one of its stylesheets:

http://www.thenation.com/css/screen/main.css

which causes a problem because that stylesheet requests third-party content:

http://s3.amazonaws.com/thenation/css/core.css

and the information about the blocked/allowed third-party request is lost when the second request is made. The second request doesn't make the same third-party content requests (probably because the content is already cached).

The reason the information about the blocked/allowed requests that originate from http://www.thenation.com/css/screen/main.css is lost when http://www.thenation.com/css/screen/main.css itself is requested again is that this is how !RequestPolicy decides whether to clear its old information about an origin urls requests: when that origin itself is requested again, all previous information about the origin's blocked/allowed request destinations is cleared.

My testing so far seems to indicate that the duplicate request may be the result of javascript running on thenation.com. When I have thenation.com blocked with !NoScript, then the duplicate request never seems to happen (from what I can tell) and I always get amazonaws.com as a blocked/allowed destination in the RP menu. However, when thenation.com is allowed with !NoScript, many additional requests are made (including to different destinations) and sometimes the duplicate request to `/css/screen/main.css` is performed, causing amazonaws.com to not show up in the menu.

I'm not sure at the moment how to solve this. I'm inclined to say it's just a bug in a website and because it seems to be an uncommon bug (only this one website is known to have it), there's no need to try to work around it. Maybe the best thing to do would be to track down the javascript that's the culprit, fix it for them, and send the web developers of thenation.com a patch (which wouldn't just help RP but would actually improve page load time because there's an unnecessary request being made).