Adding Embedding-CSP HTTP header

third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 681 matching lines @@
         frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageSource, level, message));
 }
 
 SecurityOrigin* FrameFetchContext::getSecurityOrigin() const
 {
     return m_document ? m_document->getSecurityOrigin() : nullptr;
 }
 
 void FrameFetchContext::upgradeInsecureRequest(ResourceRequest& resourceRequest)
 {
-    frame()->loader().upgradeInsecureRequest(resourceRequest, m_document);
+    // Record the latest requiredCSP value that will be used when sending this request.
+    frame()->loader().recordLatestRequiredCSP();
+    frame()->loader().addOutgoingSecurityHeaders(resourceRequest, m_document);

[Mike West, 2016/09/30 13:11:49]

This seems strange. I don't know why we call into upgradeInsecureRequest from
here and frameloader. Let me dig into that a moment.

 }
 
 void FrameFetchContext::addClientHintsIfNecessary(FetchRequest& fetchRequest)
 {
     if (!RuntimeEnabledFeatures::clientHintsEnabled() || !m_document)
         return;
 
     bool shouldSendDPR = m_document->clientHintsPreferences().shouldSendDPR() || fetchRequest.clientHintsPreferences().shouldSendDPR();
     bool shouldSendResourceWidth = m_document->clientHintsPreferences().shouldSendResourceWidth() || fetchRequest.clientHintsPreferences().shouldSendResourceWidth();
     bool shouldSendViewportWidth = m_document->clientHintsPreferences().shouldSendViewportWidth() || fetchRequest.clientHintsPreferences().shouldSendViewportWidth();
@@ skipping 119 matching lines @@
 }
 
 DEFINE_TRACE(FrameFetchContext)
 {
     visitor->trace(m_document);
     visitor->trace(m_documentLoader);
     FetchContext::trace(visitor);
 }
 
 } // namespace blink