Fetch rewrites ws/wss URLs, but browsers still report them in CSP

[annevk]

At least in theory ws/wss cannot show up in CSP (they get mapped to http/https before CSP is involved). If they do show up there's a problem of sorts with Fetch integration. (Probably best discussed in a separate issue.)

I just validated this assumption (before removal in https://bugzilla.mozilla.org/show_bug.cgi?id=1742366). It turns out to not be unconditionally true.

data:text/html,<meta http-equiv="content-security-policy" content="connect-src;">
<script>
document.onsecuritypolicyviolation=e=>alert(e.blockedURI);
new WebSocket("ws://httpbingo.org/redirect-to?url=https://example.com")</script>

in Firefox 96.0a1, the result is ws://httpbingo.org/redirect-to?url=https://example.com

In Chromium 95, the result is ws://httpbingo.org

We should therefore also accept ws(s) and not trim it to the scheme. And have a WPT for it.

Originally posted by @Rob--W in #527 (comment)

[annevk]

I think CSP could resurrect the ws/wss scheme using request's mode (which will be "websocket"). We could also look at changing Fetch more fundamentally I suppose.

[Rob--W]

I did more tests and checked blockedURI.

Firefox:

• connect-src 'none'; -> blockedURI: "ws://httpbingo.org/redirect-to?url=https://example.com"
• connect-src ws:; -> blockedURI: "https://httpbingo.org/redirect-to?url=https://example.com"
• connect-src ws: http: -> no securitypolicyviolation error, but console shows Firefox can’t establish a connection to the server at ws://httpbingo.org/redirect-to?url=https://example.com.

In Chrome:

• connect-src 'none'; -> blockedURI: "ws://httpbingo.com"
• connect-src ws:; -> no securitypolicyviolation error, but console shows WebSocket connection to 'ws://httpbingo.org/redirect-to?url=https://example.com' failed:

It looks like redirects are not subjected to CSP in Chrome nor Firefox.

[ArthurSonzogni]

@Rob--W I added WPT tests about ws/wss:
web-platform-tests/wpt#31702
Feel free to take a look if you want.

Chrome does indeed fail to check CSP in connect-src after redirect. I don't know why.