Skip to content
Commit 7d3da352 authored by Joey Arhar's avatar Joey Arhar Committed by Chromium LUCI CQ
Browse files

[DevTools] Remove report_raw_headers from network::ResourceRequest

This patch also removes raw response info from
network::mojom::URLResponseHead.

report_raw_headers has been used by DevTools to get "raw" headers for
network request debugging. However, the renderer process shouldn't have
access to raw headers, because then it would have access to cross-origin
cookies, HttpOnly cookies, etc.

In order to fix this security issue but still make headers debuggable
for DevTools, a trusted channel to the DevTools frontend which goes
through the browser process instead of the renderer process was made,
and I plumbed an ID, called "devtools_request_id", through this channel
in crrev.com/648335 so DevTools has required context to debug the
network request.

Now that DevTools doesn't need report_raw_headers in order to debug
network headers anymore, we're removing it along with the related raw
header code in order to simplify things and strengthen security.

I waited longer than I should have to do this because shared worker
request debugging still relies on report_raw_headers, but in light of
recent security issues, in addition to lack of perceived interest in
shared worker request debugging, and *significant* complexity of
updating shared worker code, I am going for it now.

Bug: 1142014
Fixed: 1199865, 1017836, 849483
Change-Id: I903770a0038bfed1ad8d5ebba6a44a8b5eefe5a7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2856099


Reviewed-by: default avatarAndrey Kosyakov <caseq@chromium.org>
Reviewed-by: default avatarHiroki Nakagawa <nhiroki@chromium.org>
Reviewed-by: default avatarTakashi Toyoshima <toyoshim@chromium.org>
Reviewed-by: default avatarKinuko Yasuda <kinuko@chromium.org>
Reviewed-by: default avatarBenoit L <lizeb@chromium.org>
Reviewed-by: default avatarRyan Sturm <ryansturm@chromium.org>
Reviewed-by: default avatarKenichi Ishibashi <bashi@chromium.org>
Reviewed-by: default avatarSean Topping <seantopping@chromium.org>
Reviewed-by: default avatarJunbo Ke <juke@chromium.org>
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#908142}
parent bd9851d3
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment