search

privacytests / privacytests.org

Source code for privacytests.org. Includes browser testing code and site rendering.
https://privacytests.org
MIT License
798 stars 23 forks source link

Alt-Svc test improvements #101

Closed goodov closed 2 years ago

goodov commented 2 years ago

Hey Arthur! I've checked the way Alt-Svc test works and I think it doesn't reflect the reality perfectly. The main issue is that it ignores the fact that the value is actually partitioned on the first call from a different first party. We can clearly see that the first request was done using h2 protocol, but next requests started to use h3 (because the requested /protocol resource contains alt-svc header).

What about using a query parameter like ?check which will not add alt-svc header? Alt-Svc logic should still work, we can assert this in the read step by requesting /protocol?check and expecting h3.

I did run local tests and I see that NetworkIsolationKey is actually used and the partitioning is happening as intended. I haven't discovered why Private mode always uses h2, but it might be some QUIC restrictions in private mode.

image

arthuredelstein commented 2 years ago

Hi Aleksey! You are completely right, this was a bug. Sorry for the mistake, and thank you for tracking it down and letting me know about it. I have committed a fix along the lines of what you suggested. The new browser results will be published in the next day or two. In addition, I separated the test domains for the H3 and Alt-Svc tests so they wouldn't interfere with one another.

Fix in 732553e599891237893b70d5ea981dca5d0c7a45