Validate the Origin HTTP header in the browser process.

content/public/browser/content_browser_client.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_
 #define CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_
 
 #include <map>
 #include <string>
 #include <utility>
@@ skipping 199 matching lines @@
       URLRequestInterceptorScopedVector request_interceptors);
 
   // Returns whether a specified URL is handled by the embedder's internal
   // protocol handlers.
   virtual bool IsHandledURL(const GURL& url);
 
   // Returns whether the given process is allowed to commit |url|.  This is a
   // more conservative check than IsSuitableHost, since it is used after a
   // navigation has committed to ensure that the process did not exceed its
   // authority.
+  // This is called on the UI thread.
   virtual bool CanCommitURL(RenderProcessHost* process_host, const GURL& url);
 
+  // Returns true if no URL within |origin| is allowed to commit in the given
+  // process.  Must return false if there exists at least one URL in |origin|
+  // that is allowed to commit.
+  // This is called on the IO thread.
+  virtual bool IsIllegalOrigin(ResourceContext* resource_context,
+                               int child_process_id,
+                               const GURL& origin);

[nasko, 2015/08/14 22:14:43]

Shouldn't we be using url::Origin if this is really an origin?

[Charlie Reis, 2015/08/14 23:23:32]

I debated that, but the value starts as a string (from the HTTP header) and gets
consumed as a GURL (in GetExtensionOrAppByURL).  We would end up with several
non-trivial conversions: string -> GURL -> url::Origin -> GURL.

It may make sense to revisit this as url::Origin gets more widely used, but we
may just want to leave it for now.

[nasko, 2015/08/14 23:36:41]

Acknowledged.

+
   // Returns whether a URL should be allowed to open from a specific context.
   // This also applies in cases where the new URL will open in another process.
   virtual bool ShouldAllowOpenURL(SiteInstance* site_instance, const GURL& url);
 
   // Returns whether a new view for a given |site_url| can be launched in a
   // given |process_host|.
   virtual bool IsSuitableHost(RenderProcessHost* process_host,
                               const GURL& site_url);
 
   // Returns whether a new view for a new site instance can be added to a
@@ skipping 444 matching lines @@
   // Allows an embedder to provide its own ExternalVideoSurfaceContainer
   // implementation.  Return nullptr to disable external surface video.
   virtual ExternalVideoSurfaceContainer*
   OverrideCreateExternalVideoSurfaceContainer(WebContents* web_contents);
 #endif
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_