Blocked domain telemetry: Add referrer and original URL for redirects

[jonathanmendez]

1. Add referrer to telemetry.

• Move telemetry from WebsiteFilter's shouldLoad to the caller in C++ that has access to the IHttpChannel with referrer information
• Add code to obtain computed referrer (after policies) to the telemetry
• For redirect responses, add code to observer in WebsiteFilter to include computed referrer in telemetry

2. Since URLs that are blocked after redirect responses (3xx) do not go through the same code path, send telemetry in WebsiteFilter's observe callback when it blocks a redirected URL.

• Update the telemetry data to rename url to blocked_url and in the case of a redirect, include an original_url field.
• This will require changes to the console ingestion (I will create a PR)

3. Add a test for the telemetry

[gcp]

TODO?

[gcp]

Ah this refers to the debouncing/deduplication which this is still missing.

[jonathanmendez]

Yes, I planned to implement the debouncing/deduplication in a separate PR. I don't know if we have a policy around landing TODOs into the code base and/or tagging them with links to bugs to track, etc.?

[gcp]

FWIW, for myself I set a block on morbo.be, then navigate to https://sjeng.org/referrer-hop.html, which is:

  document.getElementById("go").addEventListener("click", () => {
    location.href = "http://morbo.org/";
  });

morbo.org has a redirect to www.morbo.be

This records

  "events": [                                                                                                
    {                                                                                                        
      "category": "content_policy",                                                                          
      "extra": {                                                                                             
        "glean_timestamp": "1766755855522",                                                                  
        "original_url": "http://morbo.org/",                                                                 
        "referrer": "",                                                                                      
        "url": "http://www.morbo.be/"                                                                        
      },                                                                                                     
      "name": "blocklist_domain_browsed",                                                                    
      "timestamp": 0                                                                                         
    }                                                                                                        
  ],

a previous version of this patch was still getting the original referrer right:

  "events": [
    {
      "category": "content_policy",
      "extra": {
        "glean_timestamp": "1766060860297",
        "referrer": "https://sjeng.org/referrer-hop.html",
        "url": "http://www.morbo.be/"
      },
      "name": "blocklist_domain_browsed",
      "timestamp": 0
    }
  ],

[gcp]

I've added https://sjeng.org/referrer-hop-direct.html, which is

  document.getElementById("go").addEventListener("click", () => {
    location.href = "http://www.morbo.be/";
  });

this records

  "events": [
    {
      "category": "content_policy",
      "extra": {
        "glean_timestamp": "1766756680769",
        "referrer": "",
        "url": "http://www.morbo.be/"
      },
      "name": "blocklist_domain_browsed",
      "timestamp": 0
    }
  ],

So the referrer isn't detected correctly (...any more).

[jonathanmendez]

In an offline discussion we clarified that the lack of referrer in this case is a result of the choice to use the "computed referrer", i.e. matching what is in the "Referer" header after applying the referrer-policy. In these scenarios, the block is happening while executing an http request from an https referrer, so the policy has stripped the referrer.

It is technically easy to instead use the original referrer (pre-policy), so we're left with a judgment call of which is the correct data to include. I'll pursue that question and update here accordingly.

[gcp]

Ah this refers to the debouncing/deduplication which this is still missing.