WIP: Move 'X-Frame-Options' checking to the browser.

chrome/browser/chrome_content_browser_client.cc

Index: chrome/browser/chrome_content_browser_client.cc
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 8328723ffcebe2bdbc18e062cc925547bf4d9b57..a24331b068e8d642f449c0cb14bd9c2e5eaeb527 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -67,6 +67,7 @@
 #include "chrome/browser/search/instant_service_factory.h"
 #include "chrome/browser/search/search.h"
 #include "chrome/browser/search_engines/search_provider_install_state_message_filter.h"
+#include "chrome/browser/security/xfo_throttle.h"
 #include "chrome/browser/speech/chrome_speech_recognition_manager_delegate.h"
 #include "chrome/browser/speech/tts_controller.h"
 #include "chrome/browser/speech/tts_message_filter.h"
@@ -2736,6 +2737,11 @@ ChromeContentBrowserClient::CreateThrottlesForNavigation(
   }
 #endif
 
+  scoped_ptr<content::NavigationThrottle> xfo_throttle =

[Mike West, 2015/12/17 13:09:15]

I think this probably needs to happen in //content, as I don't want to make
every embedder implement it themselves. I don't know whether it's a good idea to
do it directly in ContentBrowserClient, though...

+      XFOThrottle::MaybeCreateThrottleFor(handle);
+  if (xfo_throttle)
+    throttles.push_back(xfo_throttle.Pass());
+
   return throttles.Pass();
 }