Origin header should be preserved in http requests made via OpenURL code path.

third_party/WebKit/LayoutTests/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt

Index: third_party/WebKit/LayoutTests/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt
diff --git a/third_party/WebKit/LayoutTests/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt b/third_party/WebKit/LayoutTests/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt
index db658522e5d2ef3b88dadd01b7c8367e8f5e63a9..6eb5e9844d84b59a443983447aa94b1547a71d4d 100644
--- a/third_party/WebKit/LayoutTests/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt
@@ -9,3 +9,9 @@ This page was requested with the HTTP method GET.
 Parameters:
 
 test-field = test-value
+Http headers:
+
+HTTP_CONNECTION = keep-alive
+HTTP_HOST = localhost:8000
+HTTP_REFERER = http://127.0.0.1:8000/navigation/form-targets-cross-site-frame-get.html
+HTTP_UPGRADE_INSECURE_REQUESTS = 1

[Łukasz Anforowicz, 2016/08/09 17:55:51]

Interestingly, there is no HTTP_ORIGIN header here.  This is surprising, because
AFAICT the CORS spec doesn't call for a different behavior between POST and GET
(and this testcase is the same as form-targets-cross-site-frame-post.html,
except that this testcase uses GET method).  See also
https://crbug.com/635400#c13.

[jww, 2016/08/09 22:38:22]

The Origin header is defined by the Web Origin Concept spec, and it is pretty
specific that the Origin header is optional for all HTTP requests:
https://tools.ietf.org/html/rfc6454#page-13 This, I believe, is because the
origin idea of the Origin header was that it was for CSRF, which means it's only
technically a concern on POST request, and the CORS bits are a later addition.
I'll look into what the actually CORS requirements are separately.

[Łukasz Anforowicz, 2016/08/10 00:03:19]

Thanks for the explanation.  I feel much better about the GET-vs-POST difference
knowing now that 1) Origin header is not necessarily/always tied with CORS
protocol and 2) that (as pointed out by mmenke@ in https://crbug.com/635400#c18)
the Fetch spec asks for Origin header in POST but not in GET requests
(https://fetch.spec.whatwg.org/#origin-header).

[jww, 2016/08/10 00:44:52]

As mentioned on the bug, the Fetch spec is the definitive guide to the Origin
header these days, but I wanted to point out that old RFC to give context for
why it originally was created.