Add to the list of HTTP headers that don't overwrite in 304 responses.

net/http/http_response_headers.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // The rules for header parsing were borrowed from Firefox:
 // http://lxr.mozilla.org/seamonkey/source/netwerk/protocol/http/src/nsHttpResponseHead.cpp
 // The rules for parsing content-types were also borrowed from Firefox:
 // http://lxr.mozilla.org/mozilla/source/netwerk/base/src/nsURLHelper.cpp#834
 
 #include "net/http/http_response_headers.h"
@@ skipping 60 matching lines @@
 // response headers.  This list is based on Mozilla's nsHttpResponseHead.cpp.
 const char* const kNonUpdatedHeaders[] = {
   "connection",
   "proxy-connection",
   "keep-alive",
   "www-authenticate",
   "proxy-authenticate",
   "trailer",
   "transfer-encoding",
   "upgrade",
-  // these should never change:
-  "content-location",
-  "content-md5",
   "etag",
-  // assume cache-control: no-transform
-  "content-encoding",
-  "content-range",
-  "content-type",
-  // some broken microsoft servers send 'content-length: 0' with 304s
-  "content-length"
+  "x-frame-options",
+  "x-xss-protection",
+};
+
+// Some header prefixes mean "Don't copy this header from a 304 response.".
+// Rather than listing all the relevant headers, we can consolidate them into
+// this list:
+const char* const kNonUpdatedHeaderPrefixes[] = {

[agl, 2013/02/05 14:41:55]

Minor sadness at the extra indirection and relocation records here.

const char kNonUpdatedHeaderPrefixes[][12] = {
   ...
}

Would save all that, but it goes against the format of all the other lists in
this file. So I probably wouldn't change it, but it's something to consider.

[Mike West, 2013/02/05 15:59:39]

Filed https://code.google.com/p/chromium/issues/detail?id=174346. If, upon
consideration, you want me to update this and other lists in this file, I'm
happy to. Just assign the bug to me, or close it if you change your mind. :)

+  "content-",
+  "x-content-",
+  "x-webkit-"
 };
 
 bool ShouldUpdateHeader(const std::string::const_iterator& name_begin,
                         const std::string::const_iterator& name_end) {
   for (size_t i = 0; i < arraysize(kNonUpdatedHeaders); ++i) {
     if (LowerCaseEqualsASCII(name_begin, name_end, kNonUpdatedHeaders[i]))
       return false;
   }
+  for (size_t i = 0; i < arraysize(kNonUpdatedHeaderPrefixes); ++i) {
+    if (StartsWithASCII(std::string(name_begin, name_end),

[agl, 2013/02/05 14:41:55]

Yet more sadness for there not being a StartsWithASCII that takes a StringPiece
or iterator pair.

[Mike West, 2013/02/05 15:59:39]

Indeed. I looked briefly at adding such a beast, but it's nontrivial. Filed
https://code.google.com/p/chromium/issues/detail?id=174347. Can you recommend
some folks to CC on that bug?

+                        kNonUpdatedHeaderPrefixes[i], false))
+      return false;
+  }
   return true;
 }
 
 void CheckDoesNotHaveEmbededNulls(const std::string& str) {
   // Care needs to be taken when adding values to the raw headers string to
   // make sure it does not contain embeded NULLs. Any embeded '\0' may be
   // understood as line terminators and change how header lines get tokenized.
   CHECK(str.find('\0') == std::string::npos);
 }
 
@@ skipping 1227 matching lines @@
   return true;
 }
 
 bool HttpResponseHeaders::IsChunkEncoded() const {
   // Ignore spurious chunked responses from HTTP/1.0 servers and proxies.
   return GetHttpVersion() >= HttpVersion(1, 1) &&
       HasHeaderValue("Transfer-Encoding", "chunked");
 }
 
 }  // namespace net