Command line switch for the ultra security concious: --force-https!...

Command line switch for the ultra security concious: --force-https!

If you set this switch, the browser refuses to talk HTTP and refuses to permit certificate errors.  For best results, use with a dedicated profile.

R=jar


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=6979

[jar (doing other things), 2008-12-15 08:34:17]

I'd be curious to play with this either way, so I'll give you an LGTM.   Please
consider the more restrictive option shown in the comment below.

Thanks!!!

Jim

http://codereview.chromium.org/14421/diff/1/2
File net/url_request/url_request_http_job.cc (right):

http://codereview.chromium.org/14421/diff/1/2#newcode46
Line 46: if (kForceHTTPS && scheme == "http")
Perhaps you should even be more aggressive and use:
scheme != "https" ?

That would preclude ftp for example.

[abarth-chromium, 2008-12-15 09:17:37]

I made the change you suggest, but FTP URLs are not blocked.  To block those,
we'd have to move the check into URLRequestJobManager::CreateJob.  That will
break things like the new tab page and the inspector, so it might not be a great
idea.  I'll write a blog post explaining how to use this feature as is to
achieve some useful security.

[wtc, 2008-12-15 18:14:15]

LGTM.

http://codereview.chromium.org/14421/diff/1/4
File base/base_switches.cc (right):

http://codereview.chromium.org/14421/diff/1/4#newcode33
Line 33: // Refuse to make HTTP connections and refuse to accept certificate
errors.
Should you reference your ForceHTTPS paper to provide a
background for this switch?

http://codereview.chromium.org/14421/diff/1/2
File net/url_request/url_request_http_job.cc (right):

http://codereview.chromium.org/14421/diff/1/2#newcode45
Line 45: CommandLine().HasSwitch(switches::kForceHTTPS);
Nit: this line seems to be over-indented.