Chrome should send cookieless request to WebAPK server.

Chrome should send cookieless request to WebAPK server.

WebAPK server only takes the user agent from the request sent from
Chrome, and ignores cookies. From security perspective, it is safer
to send request without any cookie. Therefore, we add flag to exlude
cookies from the request to the WebAPK server.

BUG=687191
Review-Url: https://codereview.chromium.org/2669463004
Cr-Commit-Position: refs/heads/master@{#447282}
Committed: https://chromium.googlesource.com/chromium/src/+/3faa6994cce92431aa1ba5179aa92e3a45a7bb91

[Xi Han, 2017-01-31 15:53:52]

Description was changed from

==========
Chrome should send cookieless request to WebAPK server.

When sending request to the WebAPK server, add flag to exlude cookies.

BUG=687191
==========

to

==========
Chrome should send cookieless request to WebAPK server.

WebAPK server only takes the user agent from the request sent from
Chrome, and ignores cookies. From security perspective, it is safer
to send request without any cookie. Therefore, we add flag to exlude
cookies from the request to the WebAPK server.

BUG=687191
==========

[Xi Han, 2017-01-31 15:56:49]

hanxi@chromium.org changed reviewers:
+ dominickn@chromium.org

[Xi Han, 2017-01-31 15:56:50]

Hi Dominick, could you please take a look? Thanks!

[dominickn, 2017-01-31 18:02:14]

lgtm % question

https://codereview.chromium.org/2669463004/diff/1/chrome/browser/android/weba...
File chrome/browser/android/webapk/webapk_installer.cc (right):

https://codereview.chromium.org/2669463004/diff/1/chrome/browser/android/weba...
chrome/browser/android/webapk/webapk_installer.cc:512:
net::LOAD_DO_NOT_SAVE_COOKIES);
Should there be any other flags? net::LOAD_DISABLE_CACHE or
net::LOAD_DO_NOT_SEND_AUTH_DATA?

[Xi Han, 2017-01-31 18:12:58]

https://codereview.chromium.org/2669463004/diff/1/chrome/browser/android/weba...
File chrome/browser/android/webapk/webapk_installer.cc (right):

https://codereview.chromium.org/2669463004/diff/1/chrome/browser/android/weba...
chrome/browser/android/webapk/webapk_installer.cc:512:
net::LOAD_DO_NOT_SAVE_COOKIES);
On 2017/01/31 18:02:14, dominickn wrote:
> Should there be any other flags? net::LOAD_DISABLE_CACHE or
> net::LOAD_DO_NOT_SEND_AUTH_DATA?

Makes sense to me. Added, thanks!

[Xi Han, 2017-01-31 18:13:03]

The CQ bit was checked by hanxi@chromium.org

[Xi Han, 2017-01-31 18:13:04]

The patchset sent to the CQ was uploaded after l-g-t-m from
dominickn@chromium.org
Link to the patchset: https://codereview.chromium.org/2669463004/#ps20001
(title: "Add more flags.")

[commit-bot: I haz the power, 2017-01-31 18:13:24]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[pkotwicz, 2017-01-31 18:27:44]

Is net::LOAD_DISABLE_CACHE redundant given that this is a POST request?

[pkotwicz, 2017-01-31 18:28:17]

The CQ bit was unchecked by pkotwicz@chromium.org

[pkotwicz, 2017-01-31 18:30:13]

Looks like other places in the code set net::LOAD_DISABLE_CACHE for POST
requests. So I guess your code is correct. That is confusing though. I thought
we bypassed the cache for POST

[pkotwicz, 2017-01-31 18:30:15]

The CQ bit was checked by pkotwicz@chromium.org

[commit-bot: I haz the power, 2017-01-31 18:31:24]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Xi Han, 2017-01-31 18:35:31]

Thank you Peter for verifying these flags! I don't know whether there is a rule
to define which flag should be used in which situation. It seems in Chromium
code base these four flags are used in many kinds of combinations.

[commit-bot: I haz the power, 2017-01-31 18:54:56]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1485887415855080,
"parent_rev": "f5e8986bdcd359c7ca82d83907c81642dd01f55e", "commit_rev":
"3faa6994cce92431aa1ba5179aa92e3a45a7bb91"}

[commit-bot: I haz the power, 2017-01-31 18:55:29]

Description was changed from

==========
Chrome should send cookieless request to WebAPK server.

WebAPK server only takes the user agent from the request sent from
Chrome, and ignores cookies. From security perspective, it is safer
to send request without any cookie. Therefore, we add flag to exlude
cookies from the request to the WebAPK server.

BUG=687191
==========

to

==========
Chrome should send cookieless request to WebAPK server.

WebAPK server only takes the user agent from the request sent from
Chrome, and ignores cookies. From security perspective, it is safer
to send request without any cookie. Therefore, we add flag to exlude
cookies from the request to the WebAPK server.

BUG=687191

Review-Url: https://codereview.chromium.org/2669463004
Cr-Commit-Position: refs/heads/master@{#447282}
Committed:
https://chromium.googlesource.com/chromium/src/+/3faa6994cce92431aa1ba5179aa9...
==========

[commit-bot: I haz the power, 2017-01-31 18:55:30]

Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/3faa6994cce92431aa1ba5179aa9...