The bounce tracking record's initial host came from the navigation's triggering
principal, which for a navigation started by a nested navigable is the frame's own
principal. RecordStatefulBounces exempts the initial host, so a cross-site iframe
could navigate the top level through its own origin and back to the embedder without
ever being classified, gaining a first party context to write unpartitioned cookies
from. The spec derives it from the navigation's source document, which is where the
gap comes from; a spec issue will be filed separately.
Use the site the context is leaving instead: the most recent non-initial document
committed in it, via BrowsingContext::GetHasLoadedNonInitialDocument and the current
window context, both updated at commit. A context with no committed document of its
own was opened by this navigation, so its opener is used.
The derivation no longer needs the navigation to have an initiator, so one started by
the browser also exempts the site it is leaving. That fixes bug 2060555.
This matches how user activation is already attributed:
WindowGlobalParent::RecvRecordUserActivationForBTP keys on the top window context, so
a click in a frame is credited to the embedding site. The record's user activation set
deliberately still keeps the triggering principal's site, because it feeds the dynamic
FPI storage access heuristic, which wants the site that was interacted with.
Differential Revision: https://phabricator.services.mozilla.com/D316548
Emma Zuehlcke
1b7232980c