PlzNavigate: add origin header

content/browser/frame_host/navigation_request.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_request.h"
 
 #include <utility>
 
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
@@ skipping 87 matching lines @@
 // TODO(clamy): This should be function in FrameTreeNode.
 bool IsSecureFrame(FrameTreeNode* frame) {
   while (frame) {
     if (!IsPotentiallyTrustworthyOrigin(frame->current_origin()))
       return false;
     frame = frame->parent();
   }
   return true;
 }
 
+// This should match blink::ResourceRequest::needsHTTPOrigin.
+bool NeedsHTTPOrigin(net::HttpRequestHeaders* headers,
+                     const std::string& method) {
+  // Don't add an Origin header if it is already present.
+  if (headers->HasHeader(net::HttpRequestHeaders::kOrigin))
+    return false;
+
+  // Don't send an Origin header for GET or HEAD to avoid privacy issues.
+  // For example, if an intranet page has a hyperlink to an external web
+  // site, we don't want to include the Origin of the request because it
+  // will leak the internal host name. Similar privacy concerns have lead
+  // to the widespread suppression of the Referer header at the network
+  // layer.
+  if (method == "GET" || method == "HEAD")
+    return false;

[Mike West, 2016/11/17 14:27:12]

This doesn't seem right: we send the `Origin` header for `GET` requests in
various cases. XMLHttpRequest that adds strange headers, `<img crossorigin>`,
etc.

CCing tyoshino@ to see if he can explain the existing code, as it seems
incorrect to me.

[Mike West, 2016/11/17 14:29:47]

Oh. This is only for navigations. It might be the case that we only send the
header for `<form>` POST (though I'm not sure that would be correct).

+
+  // For non-GET and non-HEAD methods, always send an Origin header so the
+  // server knows we support this feature.
+  return true;
+}
+
 // TODO(clamy): This should match what's happening in
 // blink::FrameFetchContext::addAdditionalRequestHeaders.
 void AddAdditionalRequestHeaders(net::HttpRequestHeaders* headers,
                                  const GURL& url,
                                  FrameMsg_Navigate_Type::Value navigation_type,
-                                 BrowserContext* browser_context) {
+                                 BrowserContext* browser_context,
+                                 const std::string& method,
+                                 FrameTreeNode* frame_tree_node) {
   if (!url.SchemeIsHTTPOrHTTPS())
     return;
 
   bool is_reload =
       navigation_type == FrameMsg_Navigate_Type::RELOAD ||
       navigation_type == FrameMsg_Navigate_Type::RELOAD_MAIN_RESOURCE ||
       navigation_type == FrameMsg_Navigate_Type::RELOAD_BYPASSING_CACHE ||
       navigation_type == FrameMsg_Navigate_Type::RELOAD_ORIGINAL_REQUEST_URL;
   if (is_reload)
     headers->RemoveHeader("Save-Data");
 
   if (GetContentClient()->browser()->IsDataSaverEnabled(browser_context))
     headers->SetHeaderIfMissing("Save-Data", "on");
 
   headers->SetHeaderIfMissing(net::HttpRequestHeaders::kUserAgent,
                               GetContentClient()->GetUserAgent());
 
   // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational
   // requests, as described in
   // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect
   headers->AddHeaderFromString("Upgrade-Insecure-Requests: 1");
+
+  // Set the HTTP Origin if needed.
+  if (NeedsHTTPOrigin(headers, method)) {

[tyoshino (SeeGerritForStatus), 2016/12/06 16:39:20]

early return?

[clamy, 2016/12/09 17:58:28]

Done.

+    // Create a unique origin.
+    url::Origin origin;
+    bool origin_is_sandboxed =
+        (frame_tree_node->effective_sandbox_flags() &
+         blink::WebSandboxFlags::Origin) != blink::WebSandboxFlags::None;

[tyoshino (SeeGerritForStatus), 2016/12/06 16:39:20]

how about calculating this in the else block below?

[clamy, 2016/12/09 17:58:28]

Done.

+    if (frame_tree_node->IsMainFrame()) {
+      // For main frame, the origin is the url currently loading.
+      origin = url::Origin(url);
+    } else if (!origin_is_sandboxed){

[tyoshino (SeeGerritForStatus), 2016/12/06 16:39:20]

space before {

[clamy, 2016/12/09 17:58:28]

Done.

+      // The origin should be the origin of the root, except for sandboxed
+      // frames which have a unique origin.
+      origin = frame_tree_node->frame_tree()->root()->current_origin();
+    }
+
+    headers->SetHeader(net::HttpRequestHeaders::kOrigin, origin.Serialize());
+  }
 }
 
 }  // namespace
 
 // static
 std::unique_ptr<NavigationRequest> NavigationRequest::CreateBrowserInitiated(
     FrameTreeNode* frame_tree_node,
     const GURL& dest_url,
     const Referrer& dest_referrer,
     const FrameNavigationEntry& frame_entry,
@@ skipping 104 matching lines @@
   // Update the load flags with cache information.
   UpdateLoadFlagsWithCacheFlags(&begin_params_.load_flags,
                                 common_params_.navigation_type,
                                 common_params_.method == "POST");
 
   // Add necessary headers that may not be present in the BeginNavigationParams.
   net::HttpRequestHeaders headers;
   headers.AddHeadersFromString(begin_params_.headers);
   AddAdditionalRequestHeaders(
       &headers, common_params_.url, common_params_.navigation_type,
-      frame_tree_node_->navigator()->GetController()->GetBrowserContext());
+      frame_tree_node_->navigator()->GetController()->GetBrowserContext(),
+      common_params.method, frame_tree_node);
   begin_params_.headers = headers.ToString();
 }
 
 NavigationRequest::~NavigationRequest() {
 }
 
 void NavigationRequest::BeginNavigation() {
   DCHECK(!loader_);
   DCHECK(state_ == NOT_STARTED || state_ == WAITING_FOR_RENDERER_RESPONSE);
   state_ = STARTED;
@@ skipping 331 matching lines @@
   DCHECK_EQ(request_params_.has_user_gesture, begin_params_.has_user_gesture);
 
   render_frame_host->CommitNavigation(response_.get(), std::move(body_),
                                       common_params_, request_params_,
                                       is_view_source_);
 
   frame_tree_node_->ResetNavigationRequest(true);
 }
 
 }  // namespace content