CREDENTIAL: Tighten the behavior of 'requireUserMediation()'

CREDENTIAL: Tighten the behavior of 'requireUserMediation()'

Currently, we're looking for an exact origin match between a stored
PasswordForm and the page which called 'requireUserMediation()'. We ought
to be looking for a match between their registrable domains, given that
we allow credentials to flow ~freely between these origins.

This patch tightens the check accordingly.

BUG=607858
R=vabr@chromium.org

Committed: https://crrev.com/3aa4344859e35071117a4278663eecf4f3ea9d17
Cr-Commit-Position: refs/heads/master@{#390618}

[Mike West, 2016-04-29 10:03:04]

vabr@, WDYT?

[vabr (Chromium), 2016-04-29 11:27:42]

LGTM!

Just curious why this is "tightening" the check as opposed to loosening it (more
forms not pass the check)? :)

Cheers,
Vaclav

[Mike West, 2016-04-29 11:32:06]

On 2016/04/29 at 11:27:42, vabr wrote:
> LGTM!
> 
> Just curious why this is "tightening" the check as opposed to loosening it
(more forms not pass the check)? :)

"tightening" in the sense that `requireUserMediation()` will make things safer
than it does today? Idunno. I agree that it's confusing, but it makes sense to
me. :P

[Mike West, 2016-04-29 11:32:08]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2016-04-29 11:32:17]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1928323002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1928323002/1

[commit-bot: I haz the power, 2016-04-29 11:36:50]

Committed patchset #1 (id:1)

[vabr (Chromium), 2016-04-29 11:40:49]

On 2016/04/29 11:32:06, Mike West (slow until 25th) wrote:
> On 2016/04/29 at 11:27:42, vabr wrote:
> > LGTM!
> > 
> > Just curious why this is "tightening" the check as opposed to loosening it
> (more forms not pass the check)? :)
> 
> "tightening" in the sense that `requireUserMediation()` will make things safer
> than it does today? Idunno. I agree that it's confusing, but it makes sense to
> me. :P

Got it, for conditions for auto-sign-in are now tighter, because in particular
requireUserMediation() must not have been called on any PSL-related origins (as
opposed to just the current precise origin).

Makes sense, thanks for explaining.

Cheers,
Vaclav

[commit-bot: I haz the power, 2016-04-30 17:25:01]

Patchset 1 (id:??) landed as
https://crrev.com/3aa4344859e35071117a4278663eecf4f3ea9d17
Cr-Commit-Position: refs/heads/master@{#390618}

[commit-bot: I haz the power, 2016-04-30 18:00:07]

Description was changed from

==========
CREDENTIAL: Tighten the behavior of 'requireUserMediation()'

Currently, we're looking for an exact origin match between a stored
PasswordForm and the page which called 'requireUserMediation()'. We ought
to be looking for a match between their registrable domains, given that
we allow credentials to flow ~freely between these origins.

This patch tightens the check accordingly.

BUG=607858
R=vabr@chromium.org
==========

to

==========
CREDENTIAL: Tighten the behavior of 'requireUserMediation()'

Currently, we're looking for an exact origin match between a stored
PasswordForm and the page which called 'requireUserMediation()'. We ought
to be looking for a match between their registrable domains, given that
we allow credentials to flow ~freely between these origins.

This patch tightens the check accordingly.

BUG=607858
R=vabr@chromium.org

Committed: https://crrev.com/3aa4344859e35071117a4278663eecf4f3ea9d17
Cr-Commit-Position: refs/heads/master@{#390618}
==========