Site-specific cookies setting does not override default for (Google API) HTTP referrer

[i-Mobyl]

Description

Using a Google API (e.g., for Maps Embed) with a key that is restricted via a list of HTTP Referrers. I understand brave spoofs cross-origin referrer when '3rd party cookie block' is on. When I set the default shield cookie settings to "Allow all cookies", the API works (maps displayed), while on the other "Block..." settings, the API errors. This is expected. However, setting the site-specific shield cookie setting to "Allow all cookies", or even turn shields off, if the default is to "Block..", then the API errors. My understanding is that site-specific settings should override the default, so that if "Allow all cookies" is selected for a site, the API should work regardless of the default setting.

Steps to Reproduce

1. Create a "restricted by HTTP Referrer" Google API key for, e.g., Google Maps Embed, and restrict access to "my.site.com"
2. Embed Google Maps into my.site.com
3. Browse my.site.com, with the default shield setting to "Only block cross-site cookies"
4. Set the my.site.com specific shield cookie setting to "Allow all cookies"

Actual result:

The referrer is set to https://www.google.com and the following error appears:
"Google Maps Platform rejected your request. This IP, site or mobile application is not authorized to use this API key. Request received from IP address 98.229.177.122, with referer: https://www.google.com/"

Expected result:

The site-specific cookie setting of "Allow all cookies" overrides the default setting, the referrer is set to my.site.com and the map itself displays.

Reproduces how often:

Every time.

Brave version (brave://version info)

Version 0.70.121 Chromium: 78.0.3904.70 (Official Build) (64-bit)

Version/Channel Information:

Tried only on current release.

• Can you reproduce this issue with the current release?
• Can you reproduce this issue with the beta channel?
• Can you reproduce this issue with the dev channel?
• Can you reproduce this issue with the nightly channel?

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? No
• Does the issue resolve itself when disabling Brave Rewards? No
• Is the issue reproducible on the latest version of Chrome? No

Miscellaneous Information:

[rebron]

cc: @tomlowenthal @jumde Can you take a look?

[fmarier]

With the changes to the referrer in #8696, this may no longer be a problem.

@i-Mobyl Are you able to re-test in Nightly?

[i-Mobyl]

Oui. The change seems to have fixed this. Using the nightly build, the proper referrer is used and the Map API behaves correctly. Cheers.

[bsclifton]

Thanks for the confirmation, @i-Mobyl 😄 I'll close this issue out and label it so that we can test this with the 1.12 release 😄

Fixed with brave/brave-core#5613

[LaurenWags]

Marking as QA/Blocked for now, sent some questions to @fmarier re: pages in the test plan not behaving as expected

[LaurenWags]

Verified passed with

Brave | 1.12.108 Chromium: 84.0.4147.105 (Official Build) (64-bit)
-- | --
Revision | a6b12dfad6663f13a7e16e9a42a6a4975374096b-refs/branch-heads/4147@{#943}
OS | macOS Version 10.14.6 (Build 18G3020)

• Verified test plan from 8696: Change referrer blocking in Brave brave-core#5613
• Confirmed tests on https://fmarier.github.io/brave-testing/referrer-spoofing.html work as expected. Logged [Desktop] sometimes referrer doesn't display properly until page is reloaded - follow up to 8696 #11119 as follow up noted in Change sub-resource referrer policy to report 3p origin #8696 (comment).
• Confirmed tests on https://referrer.fmarier.org/samesite.html work as expected.
• Confirmed tests on https://fmarier.com/referrer/strict-origin.html work as expected.
• Confirmed tests on https://referrer.fmarier.org/redirects.html (bottom boxes only per Change sub-resource referrer policy to report 3p origin #8696 (comment)) work as expected.
• Confirmed tests on https://dev-pages.brave.software/referrer/index.html work as expected.

---

Verification passed on

Brave	1.12.108 Chromium: 84.0.4147.105 (Official Build) (64-bit)
Revision	a6b12dfad6663f13a7e16e9a42a6a4975374096b-refs/branch-heads/4147@{#943}
OS	Ubuntu 18.04 LTS

• Verified test plan from 8696: Change referrer blocking in Brave brave-core#5613
• Confirmed tests on https://fmarier.github.io/brave-testing/referrer-spoofing.html work as expected. Encountered [Desktop] sometimes referrer doesn't display properly until page is reloaded - follow up to 8696 #11119
• Confirmed tests on https://referrer.fmarier.org/samesite.html work as expected.
• Confirmed tests on https://fmarier.com/referrer/strict-origin.html work as expected.
• Confirmed tests on https://referrer.fmarier.org/redirects.html (bottom boxes only per Change sub-resource referrer policy to report 3p origin #8696 (comment)) work as expected.
• Confirmed tests on https://dev-pages.brave.software/referrer/index.html work as expected.

---

Verification passed on

Brave | 1.12.108 Chromium: 84.0.4147.105 (Official Build) (64-bit)
-- | --
Revision | a6b12dfad6663f13a7e16e9a42a6a4975374096b-refs/branch-heads/4147@{#943}
OS | Windows 10 OS Version 1903 (Build 18362.959)

• Verified test plan from 8696: Change referrer blocking in Brave brave-core#5613
• Confirmed tests on https://fmarier.github.io/brave-testing/referrer-spoofing.html work as expected. Encountered [Desktop] sometimes referrer doesn't display properly until page is reloaded - follow up to 8696 #11119
• Confirmed tests on https://referrer.fmarier.org/samesite.html work as expected.
• Confirmed tests on https://fmarier.com/referrer/strict-origin.html work as expected.
• Confirmed tests on https://referrer.fmarier.org/redirects.html (bottom boxes only per Change sub-resource referrer policy to report 3p origin #8696 (comment)) work as expected.
• Confirmed tests on https://dev-pages.brave.software/referrer/index.html work as expected.

[srirambv]

Verification passed on OnePlus 6T with Android 10 running 1.12.111 x64 build

• Verified test plan from 8696: Change referrer blocking in Brave brave-core#5613
• Verified test on https://fmarier.github.io/brave-testing/referrer-spoofing.html work as expected.
• Verified test on https://referrer.fmarier.org/samesite.html work as expected.
• Verified test on https://fmarier.com/referrer/strict-origin.html work as expected.
• Verified test on https://referrer.fmarier.org/redirects.html
• Verified test on https://dev-pages.brave.software/referrer/index.html work as expected.

---

Verification passed on Samsung Tab A with Android 10 running 1.12.111 x64 build

• Verified test plan from 8696: Change referrer blocking in Brave brave-core#5613
• Verified test on https://fmarier.github.io/brave-testing/referrer-spoofing.html work as expected.
• Verified test on https://referrer.fmarier.org/samesite.html work as expected
• Verified test on https://fmarier.com/referrer/strict-origin.html work as expected
• Verified test on https://referrer.fmarier.org/redirects.html work as expected
• Verified test on https://dev-pages.brave.software/referrer/index.html work as expected