Adding Embedding-CSP HTTP header

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index af4d71268aead1e1b8211453e5ba162035ffb0b9..8f4be80106c5a2eb8b12df0ddc1875110d912802 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -983,6 +983,13 @@ void FrameLoader::load(const FrameLoadRequest& passedRequest, FrameLoadType fram
 
     setReferrerForFrameRequest(request);
 
+    AtomicString requiredCSP = m_frame->owner() ? m_frame->owner()->csp() : nullAtom;
+    if (RuntimeEnabledFeatures::embedderCSPEnforcementEnabled() && !requiredCSP.isNull()) {
+        // Record the latest requiredCSP value that was used when sending this request.

[amalika, 2016/09/29 13:01:14]

This seems to be necessary to make sure we correctly check against the CSP
response even if csp attribute has changed.

[Mike West, 2016/09/29 13:33:13]

I agree that we need to bind the required CSP so that it's locked in at
load-time, but I don't think `Window` is the right place to put it. In
particular, we certainly don't need to replicate the value out to remote
anythings, as it's a local cache for this process.

Where are you planning on doing the blocking checks? I'd guess we'd end up doing
those somewhere near
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/loader/Do...
in the short term (and somewhere in `//content` in the long term, similar to
what we're doing for `X-Frame-Options`). We have access to the `FrameLoader`
there, so why not just cache the value here? That's vaguely similar to what we
do for `Upgrade-Insecure-Requests` (but we just reach up to the parent for that
getter, because we don't have the same problem of changing values).

+        m_frame->localDOMWindow()->setRequiredCSP(requiredCSP);
+        request.resourceRequest().setHTTPHeaderField(HTTPNames::Embedding_CSP, requiredCSP);

[Mike West, 2016/09/29 13:33:13]

I think I'd prefer to push this logic out to a separate function. Perhaps we
could combine this and
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/loader/Fr...
from `FrameLoader::upgradeInsecureRequest` into something like
`FrameLoader::addOutgoingSecurityHeaders` (or whatever)?

Note also that you'll need to deduplicate the header in case of redirects (as
you'll hit `load` again). The code in `upgradeInsecureRequest` is a good model.

+    }
+
     FrameLoadType newLoadType = (frameLoadType == FrameLoadTypeStandard) ?
         determineFrameLoadType(request) : frameLoadType;
     NavigationPolicy policy = navigationPolicyForRequest(request);