[DevTools] Remove report_raw_headers from network::ResourceRequest
This patch also removes raw response info from network::mojom::URLResponseHead. report_raw_headers has been used by DevTools to get "raw" headers for network request debugging. However, the renderer process shouldn't have access to raw headers, because then it would have access to cross-origin cookies, HttpOnly cookies, etc. In order to fix this security issue but still make headers debuggable for DevTools, a trusted channel to the DevTools frontend which goes through the browser process instead of the renderer process was made, and I plumbed an ID, called "devtools_request_id", through this channel in crrev.com/648335 so DevTools has required context to debug the network request. Now that DevTools doesn't need report_raw_headers in order to debug network headers anymore, we're removing it along with the related raw header code in order to simplify things and strengthen security. I waited longer than I should have to do this because shared worker request debugging still relies on report_raw_headers, but in light of recent security issues, in addition to lack of perceived interest in shared worker request debugging, and *significant* complexity of updating shared worker code, I am going for it now. Bug: 1142014 Fixed: 1199865, 1017836, 849483 Change-Id: I903770a0038bfed1ad8d5ebba6a44a8b5eefe5a7 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2856099 Reviewed-by:Andrey Kosyakov <caseq@chromium.org> Reviewed-by:
Hiroki Nakagawa <nhiroki@chromium.org> Reviewed-by:
Takashi Toyoshima <toyoshim@chromium.org> Reviewed-by:
Kinuko Yasuda <kinuko@chromium.org> Reviewed-by:
Benoit L <lizeb@chromium.org> Reviewed-by:
Ryan Sturm <ryansturm@chromium.org> Reviewed-by:
Kenichi Ishibashi <bashi@chromium.org> Reviewed-by:
Sean Topping <seantopping@chromium.org> Reviewed-by:
Junbo Ke <juke@chromium.org> Commit-Queue: Joey Arhar <jarhar@chromium.org> Cr-Commit-Position: refs/heads/master@{#908142}
Loading
Please register or sign in to comment