Set Origin header to "null" for cross origin redirects.

net/url_request/url_request.cc

Index: net/url_request/url_request.cc
diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
index 455bdf255c01001b487498d62e24c170d472cfb8..82a2ec3fb550b4c009dc32c26e7c87ce6472e547 100644
--- a/net/url_request/url_request.cc
+++ b/net/url_request/url_request.cc
@@ -37,6 +37,8 @@
 #include "net/url_request/url_request_job_manager.h"
 #include "net/url_request/url_request_netlog_params.h"
 #include "net/url_request/url_request_redirect_job.h"
+#include "url/gurl.h"
+#include "url/origin.h"
 
 using base::Time;
 using std::string;
@@ -940,6 +942,26 @@ int URLRequest::Redirect(const RedirectInfo& redirect_info) {
     method_ = redirect_info.new_method;
   }
 
+  // Cross-origin redirects should not result in an Origin header value that is
+  // equal to the original request's Origin header. This is necessary to prevent
+  // a reflection of POST requests to bypass CSRF protections. If the header was
+  // not set to "null", a POST request from origin A to a malicious origin M
+  // could be redirected by M back to A.
+  //
+  // In the Section 4.2, Step 4.10 of the Fetch spec
+  // (https://fetch.spec.whatwg.org/#concept-http-fetch), it states that on
+  // cross-origin 301, 302, 303, 307, and 308 redirects, the user agent should
+  // set the Origin header to an "opaque identifier," in this case "null." This

[davidben, 2015/03/27 22:46:51]

Nit: 'Origin header' -> 'request's origin'
     'in this case "null."' -> 'which serializes to "null."'.

(I also feel like 'which serializes to "null".' is somewhat less weird since
we're quoting an identifier, but I realize English disagrees with me in general
here...)

[jww, 2015/03/30 18:50:37]

Done.

+  // matches Firefox and IE behavior, although it supercedes the suggested
+  // behavior in RFC 6454, "The Web Origin Concept."
+  //
+  // See also https://crbug.com/465517.
+  if (redirect_info.new_url.GetOrigin() != url().GetOrigin() &&
+      extra_request_headers_.HasHeader(HttpRequestHeaders::kOrigin)) {
+    extra_request_headers_.SetHeader(HttpRequestHeaders::kOrigin,
+                                     url::Origin().string());

[davidben, 2015/03/27 22:46:52]

Could you add a TODO to this block and the Origin header bit up in
StripPostSpecificHeaders referencing https://crbug.com/471397?

[jww, 2015/03/30 18:50:37]

Done.

+  }
+
   referrer_ = redirect_info.new_referrer;
   first_party_for_cookies_ = redirect_info.new_first_party_for_cookies;