Enable blocking of subresource requests whose URLs include credentials.

Enable blocking of subresource requests whose URLs include credentials.

This patch flips the 'BlockCredentialedSubresources' flag to 'stable', and
ties it to a feature flag in //content that we can use as a kill switch if
it turns out that enterprise usage of the feature is higher than we hope
(the overall numbers still look reasonably low[1]).

Intent: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/lx-U_JR2BF0

[1]: https://www.chromestatus.com/metrics/feature/timeline/popularity/532

BUG=504300, 435547
Review-Url: https://codereview.chromium.org/2779603002
Cr-Commit-Position: refs/heads/master@{#459781}
Committed: https://chromium.googlesource.com/chromium/src/+/1ddb4a2eacb8a77affdb05061644ee4f23adbd58

[Mike West, 2017-03-27 10:52:50]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-27 10:53:07]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2017-03-27 10:57:38]

mkwst@chromium.org changed reviewers:
+ jochen@chromium.org

[Mike West, 2017-03-27 10:57:38]

WDYT, Jochen? I suspect this will uncover a few browser-side tests that need
updates, but the core's pretty straightforward.

[commit-bot: I haz the power, 2017-03-27 11:48:42]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-27 11:48:43]

Dry run: Try jobs failed on following builders:
  win_chromium_x64_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_...)

[Mike West, 2017-03-27 11:58:42]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[Mike West, 2017-03-27 11:58:50]

https://codereview.chromium.org/2779603002/diff/20001/chrome/browser/ui/login...
File chrome/browser/ui/login/login_handler_browsertest.cc (left):

https://codereview.chromium.org/2779603002/diff/20001/chrome/browser/ui/login...
chrome/browser/ui/login/login_handler_browsertest.cc:990: const char
kXHRTestPage[] = "/login/xhr_with_credentials.html#incorrect";
Dropping both of these tests, as they rely on XHR sending embedded credentials,
which it's no longer capable of doing.

[commit-bot: I haz the power, 2017-03-27 11:58:55]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[jochen (gone - plz use gerrit), 2017-03-27 12:03:42]

lgtm

[commit-bot: I haz the power, 2017-03-27 14:02:15]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-27 14:02:15]

Dry run: This issue passed the CQ dry run.

[Mike West, 2017-03-27 14:45:17]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2017-03-27 14:45:41]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-27 14:50:14]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1490625917907440,
"parent_rev": "84bc80b27808786621ac68bb9e267d2d13d7034d", "commit_rev":
"1ddb4a2eacb8a77affdb05061644ee4f23adbd58"}

[commit-bot: I haz the power, 2017-03-27 14:51:09]

Description was changed from

==========
Enable blocking of subresource requests whose URLs include credentials.

This patch flips the 'BlockCredentialedSubresources' flag to 'stable', and
ties it to a feature flag in //content that we can use as a kill switch if
it turns out that enterprise usage of the feature is higher than we hope
(the overall numbers still look reasonably low[1]).

Intent:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/lx-U_JR2BF0

[1]: https://www.chromestatus.com/metrics/feature/timeline/popularity/532

BUG=504300,435547
==========

to

==========
Enable blocking of subresource requests whose URLs include credentials.

This patch flips the 'BlockCredentialedSubresources' flag to 'stable', and
ties it to a feature flag in //content that we can use as a kill switch if
it turns out that enterprise usage of the feature is higher than we hope
(the overall numbers still look reasonably low[1]).

Intent:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/lx-U_JR2BF0

[1]: https://www.chromestatus.com/metrics/feature/timeline/popularity/532

BUG=504300,435547

Review-Url: https://codereview.chromium.org/2779603002
Cr-Commit-Position: refs/heads/master@{#459781}
Committed:
https://chromium.googlesource.com/chromium/src/+/1ddb4a2eacb8a77affdb05061644...
==========

[commit-bot: I haz the power, 2017-03-27 14:51:11]

Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/1ddb4a2eacb8a77affdb05061644...