PS - Adjusting webRequest API for use in Public Sessions

chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
 
 #include <stddef.h>
 
 #include <cstddef>
 #include <string>
@@ skipping 646 matching lines @@
 
     // Admin controls network config anyways.
     "vpnProvider",
 
     // Just UX.
     "wallpaper",
 
     // Privacy sensitive URL access.
     // "webNavigation",
 
-    // Provides access to cookies and form upload data. Options: (1) block,
-    // (2) strip all content in events.
-    // "webRequest",
-
-    // Fine once webRequest is adjusted.
-    // "webRequestBlocking",
+    // Sensitive content is stripped away.
+    "webRequest",
+    "webRequestBlocking",
 
     // This allows content scripts and capturing. However, the webview runs
     // within a separate storage partition, i.e. doesn't share cookies and other
     // storage with the browsing session. Furthermore, the embedding app could
     // just as well proxy 3rd-party origin content through its own web origin
     // server-side or via chrome.socket. Finally, web security doesn't make a
     // lot of sense when there's no URL bar or HTTPS padlock providing trusted
     // UI. Bottom line: Risks are mitigated, further restrictions don't make
     // sense, so OK to allow.
     "webview",
@@ skipping 253 matching lines @@
   if (error) {
     *error = l10n_util::GetStringFUTF16(
           IDS_EXTENSION_CANT_INSTALL_IN_DEVICE_LOCAL_ACCOUNT,
           base::UTF8ToUTF16(extension->name()),
           base::UTF8ToUTF16(extension->id()));
   }
   return false;
 }
 
 }  // namespace chromeos