WIP: Move 'X-Frame-Options' checking to the browser.

chrome/browser/security/xfo_throttle.h

Index: chrome/browser/security/xfo_throttle.h
diff --git a/chrome/browser/security/xfo_throttle.h b/chrome/browser/security/xfo_throttle.h
new file mode 100644
index 0000000000000000000000000000000000000000..25cf1f2f6556831f215bdd568c5494edf9a33891
--- /dev/null
+++ b/chrome/browser/security/xfo_throttle.h
@@ -0,0 +1,44 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SECURITY_XFO_THROTTLE_H_
+#define CHROME_BROWSER_SECURITY_XFO_THROTTLE_H_
+
+#include "base/memory/scoped_ptr.h"
+#include "content/public/browser/navigation_throttle.h"
+
+namespace content {
+class NavigationHandle;
+}
+
+namespace net {
+class HttpResponseHeaders;
+}
+
+using content::NavigationHandle;
+using content::NavigationThrottle;
+
+class XFOThrottle : public NavigationThrottle {

[Mike West, 2015/12/17 13:09:15]

As above, this should move to //content somewhere.

[Mike West, 2015/12/17 13:31:29]

Or a component.

+ public:
+  explicit XFOThrottle(NavigationHandle* handle);
+  ~XFOThrottle() override;
+
+  NavigationThrottle::ThrottleCheckResult WillProcessResponse() override;
+  static scoped_ptr<NavigationThrottle> MaybeCreateThrottleFor(
+      NavigationHandle* handle);
+
+ private:
+  enum HeaderDisposition {
+    NOT_PRESENT,
+    DENY,
+    SAMEORIGIN,
+    ALLOWALL,
+    INVALID,
+    CONFLICT
+  };
+
+  HeaderDisposition ParseHeader(const net::HttpResponseHeaders* headers);
+};
+
+#endif  // CHROME_BROWSER_SECURITY_XFO_THROTTLE_H_