RequestPolicy/tractest — Issue #182: cross-site redirects from favicon requests not subject to restriction
Author: jsamuel
Created: 2011-12-22 02:45:27+00:00
State: open
Labels: extension

When Firefox requests a favicon, either the default /favicon.ico or a custom specified favicon location such as ``, if the requested favicon responds with a Location header, the redirect is always followed and is not subject to restriction by RP. The issue is that the redirect appears to come from privileged code (RP logs the allowed redirect with "Original request is from privileged code.").

This is an unfortunate RP bypass. I had previously checked that custom defined favicons (``) are subject to restriction if the URI is cross-site. However, apparently I had not checked that redirected favicon requests are subject to restriction.