LadybirdBrowser / ladybird

Truly independent web browser
https://ladybird.org
BSD 2-Clause "Simplified" License
12.15k stars 481 forks source link

LibWeb: Incorrect `referrer` header #355

Open fdellwing opened 1 week ago

fdellwing commented 1 week ago

This is a copy of https://github.com/SerenityOS/serenity/issues/23255, the issue is still relevant. We still get a 403 in LB, but shouldn't.


Given this URL: https://fonts.wod-game.de/java_font_renderer/render?skin=skin-8&profil=font_menu-1-hovered&text=Ladybird%201

Opening this in a browser should show you an image with the text "Ladybird 1".

In Ladybird though we only get the "image did not load" box (because the remote has a referrer filter).

I debugged this on the server side and we can see a clear problem here:

Firefox:

95.90.204.x - - [19/Feb/2024:09:30:04 +0100] "GET /java_font_renderer/render?skin=skin-8&profil=font_menu-1-hovered&text=Ladybird%201 HTTP/1.1" 200 8741 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"

Ladybird:

95.90.204.x - - [19/Feb/2024:09:31:22 +0100] "GET /java_font_renderer/render?skin=skin-8&profil=font_menu-1-hovered&text=Ladybird%201 HTTP/1.1" 200 8741 "-" "Mozilla/5.0 (Linux; x86_64) Ladybird/1.0"
95.90.204.x - - [19/Feb/2024:09:31:22 +0100] "GET /java_font_renderer/render?skin=skin-8&profil=font_menu-1-hovered&text=Ladybird%201 HTTP/1.1" 403 746 "https://fonts.wod-game.de/java_font_renderer/render?skin=skin-8&profil=font_menu-1-hovered&text=Ladybird%201" "Mozilla/5.0 (Linux; x86_64) Ladybird/1.0"
95.90.204.x - - [19/Feb/2024:09:31:22 +0100] "GET /favicon.ico HTTP/1.1" 404 547 "https://fonts.wod-game.de/java_font_renderer/render?skin=skin-8&profil=font_menu-1-hovered&text=Ladybird%201" "Mozilla/5.0 (Linux; x86_64) Ladybird/1.0"

These logs are produced when opening the site in a new tab. We should only see one request, or if we need two for whatever reason we should not add that referer there.

More context might be found in this and following messages: https://discord.com/channels/830522505605283862/830525031720943627/1209048373655773205

Dan-Q commented 1 week ago

360 (dupe) provides another way to replicate.