Sanitize headers in Proxy Authentication Required responses

net/http/proxy_client_socket.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/proxy_client_socket.h"
 
 #include "base/metrics/histogram.h"
 #include "base/strings/stringprintf.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/net_errors.h"
@@ skipping 54 matching lines @@
         HttpUtil::GetStatusCodesForHistogram());
   } else {
     UMA_HISTOGRAM_CUSTOM_ENUMERATION(
         "Net.BlockedTunnelResponse.HttpProxy",
         HttpUtil::MapStatusCodeForHistogram(http_status_code),
         HttpUtil::GetStatusCodesForHistogram());
   }
 }
 
 // static
-bool ProxyClientSocket::SanitizeProxyRedirect(HttpResponseInfo* response,
-                                              const GURL& url) {
+bool ProxyClientSocket::SanitizeProxyAuth(HttpResponseInfo* response) {
+  DCHECK(response && response->headers.get());
+  response->headers->RemoveHeader("set-cookie");
+  return true;

[Ryan Sleevi, 2014/12/01 21:28:49]

I have trouble convincing myself a blacklist is the right approach here.

Why can you not strip out ALL headers except for WWW-Authenticate?

[Ryan Hamilton, 2014/12/02 01:50:52]

Sounds reasonable! You probably want Proxy-Authenticate, though, right?

[Deprecated (see juliatuttle), 2014/12/02 20:10:21]

Yeah, agreed.

Is there a way that is more efficient than RemoveHeader-ing each of the
non-Proxy-Authenticate headers (which is O(n^2)) and less kludgey than
reassembling new fake raw headers with just the Proxy-Authenticate header?

[Ryan Hamilton, 2014/12/02 20:14:25]

As far as kludges go, the "assemble new fake raw headers" seems to be pretty
simple. Since it's what's done in SanitizeProxyRedirect, that seems like a good
approach to me.

+}
+
+// static
+bool ProxyClientSocket::SanitizeProxyRedirect(HttpResponseInfo* response) {
   DCHECK(response && response->headers.get());
 
   std::string location;
   if (!response->headers->IsRedirect(&location))
     return false;
 
-  // Return minimal headers; set "Content-length: 0" to ignore response body.
+  // Return minimal headers; set "Content-Length: 0" to ignore response body.
   std::string fake_response_headers =
-      base::StringPrintf("HTTP/1.0 302 Found\n"
+      base::StringPrintf("HTTP/1.1 302 Found\n"
                          "Location: %s\n"
-                         "Content-length: 0\n"
+                         "Content-Length: 0\n"
                          "Connection: close\n"
                          "\n",
                          location.c_str());
   std::string raw_headers =
       HttpUtil::AssembleRawHeaders(fake_response_headers.data(),
                                    fake_response_headers.length());
   response->headers = new HttpResponseHeaders(raw_headers);
 
   return true;
 }
 
 }  // namespace net