Add to the list of HTTP headers that don't overwrite in 304 responses.

net/http/http_response_headers.cc

Index: net/http/http_response_headers.cc
diff --git a/net/http/http_response_headers.cc b/net/http/http_response_headers.cc
index 4cbe03c0ef3801afb429f5c55f57dce5a8a2a96c..824cfd09ecd99aefe455484418a2d0ddee669375 100644
--- a/net/http/http_response_headers.cc
+++ b/net/http/http_response_headers.cc
@@ -78,16 +78,18 @@ const char* const kNonUpdatedHeaders[] = {
   "trailer",
   "transfer-encoding",
   "upgrade",
-  // these should never change:
-  "content-location",
-  "content-md5",
   "etag",
-  // assume cache-control: no-transform
-  "content-encoding",
-  "content-range",
-  "content-type",
-  // some broken microsoft servers send 'content-length: 0' with 304s
-  "content-length"
+  "x-frame-options",
+  "x-xss-protection",
+};
+
+// Some header prefixes mean "Don't copy this header from a 304 response.".
+// Rather than listing all the relevant headers, we can consolidate them into
+// this list:
+const char* const kNonUpdatedHeaderPrefixes[] = {

[agl, 2013/02/05 14:41:55]

Minor sadness at the extra indirection and relocation records here.

const char kNonUpdatedHeaderPrefixes[][12] = {
   ...
}

Would save all that, but it goes against the format of all the other lists in
this file. So I probably wouldn't change it, but it's something to consider.

[Mike West, 2013/02/05 15:59:39]

Filed https://code.google.com/p/chromium/issues/detail?id=174346. If, upon
consideration, you want me to update this and other lists in this file, I'm
happy to. Just assign the bug to me, or close it if you change your mind. :)

+  "content-",
+  "x-content-",
+  "x-webkit-"
 };
 
 bool ShouldUpdateHeader(const std::string::const_iterator& name_begin,
@@ -96,6 +98,11 @@ bool ShouldUpdateHeader(const std::string::const_iterator& name_begin,
     if (LowerCaseEqualsASCII(name_begin, name_end, kNonUpdatedHeaders[i]))
       return false;
   }
+  for (size_t i = 0; i < arraysize(kNonUpdatedHeaderPrefixes); ++i) {
+    if (StartsWithASCII(std::string(name_begin, name_end),

[agl, 2013/02/05 14:41:55]

Yet more sadness for there not being a StartsWithASCII that takes a StringPiece
or iterator pair.

[Mike West, 2013/02/05 15:59:39]

Indeed. I looked briefly at adding such a beast, but it's nontrivial. Filed
https://code.google.com/p/chromium/issues/detail?id=174347. Can you recommend
some folks to CC on that bug?

+                        kNonUpdatedHeaderPrefixes[i], false))
+      return false;
+  }
   return true;
 }