LNA restrictions for Main Frame Navigations

[MayyaSunil]

Current LNA restrictions are only applied to subresource loads and iframe navigations.
At the time of writing this issue, chromium does not apply these restrictions to main frame navigations and in firefox LNA restrictions are under pref (network.lna.allow_top_level_navigation).

The purpose of this issue is to track and discuss any challenges with regard to applying LNA restrictions for top-level/main-frame navigations among various implementers.

[MayyaSunil]

Hey @christhompson @hubertchao,

Chromium only applies LNA restrictions to iframe navigations currently. It may be worth expanding this to include main-frame navigations (especially popup windows which can be controlled by their opener).

It would be great to know if you have any timeline for this to ensure the implementers have similar behaviour. Additionaly did you face any problems during enforcing this?

For e.g. we saw some breakages due our necko stack terminating the connection before prompting the user for permission ->
https://bugzilla.mozilla.org/show_bug.cgi?id=1983386.

[hubertchao]

Hey @christhompson @hubertchao,

Chromium only applies LNA restrictions to iframe navigations currently. It may be worth expanding this to include main-frame navigations (especially popup windows which can be controlled by their opener).

It would be great to know if you have any timeline for this to ensure the implementers have similar behaviour. Additionaly did you face any problems during enforcing this?

For e.g. we saw some breakages due our necko stack terminating the connection before prompting the user for permission -> https://bugzilla.mozilla.org/show_bug.cgi?id=1983386.

We did have a bug in that we were accidentally blocking main frame navigations from public sites to localhost/local sites. See: https://issues.chromium.org/issues/428879902

We don't have any timelines on trying to enforce LNA restrictions on main frame navigations; given some of the bugs that were reported around this there definitely will be some breakages that we'll have to think about/mitigate (if you look at the dupes for https://issues.chromium.org/issues/428879902 you'll see reports where enforcing LNA on main frame navigations breaks gcloud auth and okta fastpass auth)

[christhompson]

It would be great to know if you have any timeline for this to ensure the implementers have similar behaviour. Additionaly did you face any problems during enforcing this?

For e.g. we saw some breakages due our necko stack terminating the connection before prompting the user for permission ->
https://bugzilla.mozilla.org/show_bug.cgi?id=1983386.

For iframes, we effectively defer navigation request while the permission prompt is showing, rather than canceling/restarting. This does have a possibility of breaking under network mobility, but should overall be more resilient than canceling/restarting.

I think restricting iframe navigations has been relatively less troublesome compared to requiring permissions policy for local network requests within iframes.

If we were to pursue enforcing LNA on main frame navigations, I think we would probably need to implement something like an interstitial warning. Like our other security interstitials, that would (1) cancel the initial navigation, (2) commit an error page for the interstitial warning, and (3) on proceeding through the interstitial restart the navigation to the local site.