features.h 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492
  1. // Copyright (c) 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_BASE_FEATURES_H_
  5. #define NET_BASE_FEATURES_H_
  6. #include <string>
  7. #include "base/feature_list.h"
  8. #include "base/metrics/field_trial_params.h"
  9. #include "base/strings/string_piece.h"
  10. #include "base/time/time.h"
  11. #include "build/build_config.h"
  12. #include "net/base/net_export.h"
  13. #include "net/net_buildflags.h"
  14. namespace net::features {
  15. // Enables ALPS extension of TLS 1.3 for HTTP/2, see
  16. // https://vasilvv.github.io/tls-alps/draft-vvv-tls-alps.html and
  17. // https://vasilvv.github.io/httpbis-alps/draft-vvv-httpbis-alps.html.
  18. NET_EXPORT extern const base::Feature kAlpsForHttp2;
  19. // Disable H2 reprioritization, in order to measure its impact.
  20. NET_EXPORT extern const base::Feature kAvoidH2Reprioritization;
  21. // When kCapReferrerToOriginOnCrossOrigin is enabled, HTTP referrers on cross-
  22. // origin requests are restricted to contain at most the source origin.
  23. NET_EXPORT extern const base::Feature kCapReferrerToOriginOnCrossOrigin;
  24. // Support for altering the parameters used for DNS transaction timeout. See
  25. // ResolveContext::SecureTransactionTimeout().
  26. NET_EXPORT extern const base::Feature kDnsTransactionDynamicTimeouts;
  27. // Multiplier applied to current fallback periods in determining a transaction
  28. // timeout.
  29. NET_EXPORT extern const base::FeatureParam<double>
  30. kDnsTransactionTimeoutMultiplier;
  31. NET_EXPORT extern const base::FeatureParam<base::TimeDelta>
  32. kDnsMinTransactionTimeout;
  33. // Enables DNS query-only experiments for HTTPSSVC or INTEGRITY records,
  34. // depending on feature parameters. Received responses never affect Chrome
  35. // behavior other than metrics.
  36. //
  37. // Not to be confused with `kUseDnsHttpsSvcb` which is querying HTTPS in order
  38. // to affect Chrome connection behavior.
  39. NET_EXPORT extern const base::Feature kDnsHttpssvc;
  40. // Determine which kind of record should be queried: HTTPSSVC or INTEGRITY. No
  41. // more than one of these feature parameters should be enabled at once. In the
  42. // event that both are enabled, |kDnsHttpssvcUseIntegrity| takes priority, and
  43. // |kDnsHttpssvcUseHttpssvc| will be ignored.
  44. NET_EXPORT extern const base::FeatureParam<bool> kDnsHttpssvcUseHttpssvc;
  45. NET_EXPORT extern const base::FeatureParam<bool> kDnsHttpssvcUseIntegrity;
  46. // Enable HTTPSSVC or INTEGRITY to be queried over insecure DNS.
  47. NET_EXPORT extern const base::FeatureParam<bool>
  48. kDnsHttpssvcEnableQueryOverInsecure;
  49. // If we are still waiting for an HTTPSSVC or INTEGRITY query after all the
  50. // other queries in a DnsTask have completed, we will compute a timeout for the
  51. // remaining query. The timeout will be the min of:
  52. // (a) |kDnsHttpssvcExtraTimeMs.Get()|
  53. // (b) |kDnsHttpssvcExtraTimePercent.Get() / 100 * t|, where |t| is the
  54. // number of milliseconds since the first query began.
  55. NET_EXPORT extern const base::FeatureParam<int> kDnsHttpssvcExtraTimeMs;
  56. NET_EXPORT extern const base::FeatureParam<int> kDnsHttpssvcExtraTimePercent;
  57. // These parameters, respectively, are the list of experimental and control
  58. // domains for which we will query HTTPSSVC or INTEGRITY records. We expect
  59. // valid INTEGRITY results for experiment domains. We expect no INTEGRITY
  60. // results for control domains.
  61. //
  62. // The format of both parameters is a comma-separated list of domains.
  63. // Whitespace around domain names is permitted. Trailing comma is optional.
  64. //
  65. // See helper functions:
  66. // |dns_httpssvc_experiment::GetDnsHttpssvcExperimentDomains| and
  67. // |dns_httpssvc_experiment::GetDnsHttpssvcControlDomains|.
  68. NET_EXPORT extern const base::FeatureParam<std::string>
  69. kDnsHttpssvcExperimentDomains;
  70. NET_EXPORT extern const base::FeatureParam<std::string>
  71. kDnsHttpssvcControlDomains;
  72. // This param controls how we determine whether a domain is an experimental or
  73. // control domain. When false, domains must be in |kDnsHttpssvcControlDomains|
  74. // to be considered a control. When true, we ignore |kDnsHttpssvcControlDomains|
  75. // and any non-experiment domain (not in |kDnsHttpssvcExperimentDomains|) is
  76. // considered a control domain.
  77. NET_EXPORT extern const base::FeatureParam<bool>
  78. kDnsHttpssvcControlDomainWildcard;
  79. namespace dns_httpssvc_experiment {
  80. // Get the value of |kDnsHttpssvcExtraTimeMs|.
  81. NET_EXPORT base::TimeDelta GetExtraTimeAbsolute();
  82. } // namespace dns_httpssvc_experiment
  83. // Enables querying HTTPS DNS records that will affect results from HostResolver
  84. // and may be used to affect connection behavior. Whether or not those results
  85. // are used (e.g. to connect via ECH) may be controlled by separate features.
  86. //
  87. // Not to be confused with `kDnsHttpssvc` which is for experiment-only queries
  88. // where received HTTPS results do not affect Chrome behavior and are only used
  89. // for metrics.
  90. NET_EXPORT extern const base::Feature kUseDnsHttpsSvcb;
  91. // Param to control whether or not presence of an HTTPS record for an HTTP
  92. // request will force an HTTP->HTTPS upgrade redirect.
  93. NET_EXPORT extern const base::FeatureParam<bool> kUseDnsHttpsSvcbHttpUpgrade;
  94. // Param to control whether or not HostResolver, when using Secure DNS, will
  95. // fail the entire connection attempt when receiving an inconclusive response to
  96. // an HTTPS query (anything except transport error, timeout, or SERVFAIL). Used
  97. // to prevent certain downgrade attacks against ECH behavior.
  98. NET_EXPORT extern const base::FeatureParam<bool>
  99. kUseDnsHttpsSvcbEnforceSecureResponse;
  100. // Param to control whether HTTPS queries will be allowed via Insecure DNS
  101. // (instead of just via Secure DNS).
  102. NET_EXPORT extern const base::FeatureParam<bool> kUseDnsHttpsSvcbEnableInsecure;
  103. // If we are still waiting for an HTTPS transaction after all the
  104. // other transactions in an insecure DnsTask have completed, we will compute a
  105. // timeout for the remaining transaction. The timeout will be
  106. // `kUseDnsHttpsSvcbInsecureExtraTimePercent.Get() / 100 * t`, where `t` is the
  107. // time delta since the first query began. And the timeout will additionally be
  108. // clamped by:
  109. // (a) `kUseDnsHttpsSvcbInsecureExtraTimeMin.Get()`
  110. // (b) `kUseDnsHttpsSvcbInsecureExtraTimeMax.Get()`
  111. //
  112. // Any param is ignored if zero, and if one of min/max is non-zero with a zero
  113. // percent param it will be used as an absolute timeout. If all are zero, there
  114. // is no timeout specific to HTTPS transactions, only the regular DNS query
  115. // timeout and server fallback.
  116. NET_EXPORT extern const base::FeatureParam<base::TimeDelta>
  117. kUseDnsHttpsSvcbInsecureExtraTimeMax;
  118. NET_EXPORT extern const base::FeatureParam<int>
  119. kUseDnsHttpsSvcbInsecureExtraTimePercent;
  120. NET_EXPORT extern const base::FeatureParam<base::TimeDelta>
  121. kUseDnsHttpsSvcbInsecureExtraTimeMin;
  122. // Same as `kUseDnsHttpsSvcbInsecureExtraTime...` except for secure DnsTasks.
  123. //
  124. // If `kUseDnsHttpsSvcbEnforceSecureResponse` is enabled, the timeouts will not
  125. // be used because there is no sense killing a transaction early if that will
  126. // just kill the entire request.
  127. NET_EXPORT extern const base::FeatureParam<base::TimeDelta>
  128. kUseDnsHttpsSvcbSecureExtraTimeMax;
  129. NET_EXPORT extern const base::FeatureParam<int>
  130. kUseDnsHttpsSvcbSecureExtraTimePercent;
  131. NET_EXPORT extern const base::FeatureParam<base::TimeDelta>
  132. kUseDnsHttpsSvcbSecureExtraTimeMin;
  133. // Deprecated in favor of `kUseDnsHttpsSvcbInsecureExtraTime...` and
  134. // `kUseDnsHttpsSvcbSecureExtraTime...` params. Ignored for insecure DnsTasks if
  135. // any `kUseDnsHttpsSvcbInsecureExtraTime...` params are non-zero, and ignored
  136. // for secure DnsTasks if any `kUseDnsHttpsSvcbSecureExtraTime...` params are
  137. // non-zero.
  138. NET_EXPORT extern const base::FeatureParam<base::TimeDelta>
  139. kUseDnsHttpsSvcbExtraTimeAbsolute;
  140. NET_EXPORT extern const base::FeatureParam<int>
  141. kUseDnsHttpsSvcbExtraTimePercent;
  142. // Update protocol using ALPN information in HTTPS DNS records.
  143. NET_EXPORT extern const base::Feature kUseDnsHttpsSvcbAlpn;
  144. // Enables TLS 1.3 early data.
  145. NET_EXPORT extern const base::Feature kEnableTLS13EarlyData;
  146. // Enables the TLS Encrypted ClientHello feature.
  147. // https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-13
  148. NET_EXPORT extern const base::Feature kEncryptedClientHello;
  149. // Enables optimizing the network quality estimation algorithms in network
  150. // quality estimator (NQE).
  151. NET_EXPORT extern const base::Feature kNetworkQualityEstimator;
  152. // Splits cache entries by the request's includeCredentials.
  153. NET_EXPORT extern const base::Feature kSplitCacheByIncludeCredentials;
  154. // Splits cache entries by the request's NetworkIsolationKey if one is
  155. // available.
  156. NET_EXPORT extern const base::Feature kSplitCacheByNetworkIsolationKey;
  157. // Splits host cache entries by the DNS request's NetworkIsolationKey if one is
  158. // available. Also prevents merging live DNS lookups when there is a NIK
  159. // mismatch.
  160. NET_EXPORT extern const base::Feature kSplitHostCacheByNetworkIsolationKey;
  161. // Partitions connections based on the NetworkIsolationKey associated with a
  162. // request.
  163. NET_EXPORT extern const base::Feature
  164. kPartitionConnectionsByNetworkIsolationKey;
  165. // Forces the `frame_origin` value in IsolationInfo to the `top_level_origin`
  166. // value when an IsolationInfo instance is created. This is to enable
  167. // expirimenting with double keyed network partitions.
  168. NET_EXPORT extern const base::Feature
  169. kForceIsolationInfoFrameOriginToTopLevelFrame;
  170. // Partitions HttpServerProperties based on the NetworkIsolationKey associated
  171. // with a request.
  172. NET_EXPORT extern const base::Feature
  173. kPartitionHttpServerPropertiesByNetworkIsolationKey;
  174. // Partitions TLS sessions and QUIC server configs based on the
  175. // NetworkIsolationKey associated with a request.
  176. //
  177. // This feature requires kPartitionConnectionsByNetworkIsolationKey to be
  178. // enabled to work.
  179. NET_EXPORT extern const base::Feature
  180. kPartitionSSLSessionsByNetworkIsolationKey;
  181. // Partitions Expect-CT data by NetworkIsolationKey. This only affects the
  182. // Expect-CT data itself. Regardless of this value, reports will be uploaded
  183. // using the associated NetworkIsolationKey, when one's available.
  184. //
  185. // This feature requires kPartitionConnectionsByNetworkIsolationKey,
  186. // kPartitionHttpServerPropertiesByNetworkIsolationKey, and
  187. // kPartitionConnectionsByNetworkIsolationKey to all be enabled to work.
  188. NET_EXPORT extern const base::Feature
  189. kPartitionExpectCTStateByNetworkIsolationKey;
  190. // Partitions Network Error Logging and Reporting API data by
  191. // NetworkIsolationKey. Also partitions all reports generated by other consumers
  192. // of the reporting API. Applies the NetworkIsolationKey to reports uploads as
  193. // well.
  194. //
  195. // When disabled, the main entry points of the reporting and NEL services ignore
  196. // NetworkIsolationKey parameters, and they're cleared while loading from the
  197. // cache, but internal objects can be created with them (e.g., endpoints), for
  198. // testing.
  199. NET_EXPORT extern const base::Feature
  200. kPartitionNelAndReportingByNetworkIsolationKey;
  201. // Creates a <double key + is_cross_site> NetworkAnonymizationKey which is used
  202. // to partition the network state. This double key will have the following
  203. // properties: `top_frame_site` -> the schemeful site of the top level page.
  204. // `frame_site ` -> nullopt
  205. // `is_cross_site` -> true if the `top_frame_site` is cross site when compared
  206. // to the frame site. The frame site will not be stored in this key so the value
  207. // of is_cross_site will be computed at key construction. This feature overrides
  208. // `kEnableDoubleKeyNetworkAnonymizationKey` if both are enabled.
  209. NET_EXPORT extern const base::Feature
  210. kEnableCrossSiteFlagNetworkAnonymizationKey;
  211. // Creates a double keyed NetworkAnonymizationKey which is used to partition the
  212. // network state. This double key will have the following properties:
  213. // `top_frame_site` -> the schemeful site of the top level page.
  214. // `frame_site ` -> nullopt
  215. // `is_cross_site` -> nullopt
  216. NET_EXPORT extern const base::Feature kEnableDoubleKeyNetworkAnonymizationKey;
  217. // Enables limiting the size of Expect-CT table.
  218. NET_EXPORT extern const base::Feature kExpectCTPruning;
  219. // FeatureParams associated with kExpectCTPruning.
  220. // Expect-CT pruning runs when this many entries are hit.
  221. NET_EXPORT extern const base::FeatureParam<int> kExpectCTPruneMax;
  222. // The Expect-CT pruning logic attempts to reduce entries to at most this many.
  223. NET_EXPORT extern const base::FeatureParam<int> kExpectCTPruneMin;
  224. // Non-transient entries with |enforce| set are safe from being pruned if
  225. // they're less than this many days old, unless the number of entries exceeds
  226. // |kExpectCTMaxEntriesPerNik|.
  227. NET_EXPORT extern const base::FeatureParam<int> kExpectCTSafeFromPruneDays;
  228. // If, after pruning transient, non-enforced, old Expect-CT entries,
  229. // kExpectCTPruneMin is still exceeded, then all NetworkIsolationKeys will be
  230. // capped to this many entries, based on last observation date.
  231. NET_EXPORT extern const base::FeatureParam<int> kExpectCTMaxEntriesPerNik;
  232. // Minimum delay between successive prunings of Expect-CT entries, in seconds.
  233. NET_EXPORT extern const base::FeatureParam<int> kExpectCTPruneDelaySecs;
  234. // Enables sending TLS 1.3 Key Update messages on TLS 1.3 connections in order
  235. // to ensure that this corner of the spec is exercised. This is currently
  236. // disabled by default because we discovered incompatibilities with some
  237. // servers.
  238. NET_EXPORT extern const base::Feature kTLS13KeyUpdate;
  239. // Enables permuting TLS extensions in the ClientHello, to reduce the risk of
  240. // non-compliant servers ossifying parts of the ClientHello and interfering with
  241. // deployment of future security improvements.
  242. NET_EXPORT extern const base::Feature kPermuteTLSExtensions;
  243. // Enables CECPQ2, a post-quantum key-agreement, in TLS 1.3 connections.
  244. NET_EXPORT extern const base::Feature kPostQuantumCECPQ2;
  245. // Enables CECPQ2, a post-quantum key-agreement, in TLS 1.3 connections for a
  246. // subset of domains. (This is intended as Finch kill-switch. For testing
  247. // compatibility with large ClientHello messages, use |kPostQuantumCECPQ2|.)
  248. NET_EXPORT extern const base::Feature kPostQuantumCECPQ2SomeDomains;
  249. NET_EXPORT extern const base::FeatureParam<std::string>
  250. kPostQuantumCECPQ2Prefix;
  251. // Changes the timeout after which unused sockets idle sockets are cleaned up.
  252. NET_EXPORT extern const base::Feature kNetUnusedIdleSocketTimeout;
  253. // When enabled, the time threshold for Lax-allow-unsafe cookies will be lowered
  254. // from 2 minutes to 10 seconds. This time threshold refers to the age cutoff
  255. // for which cookies that default into SameSite=Lax, which are newer than the
  256. // threshold, will be sent with any top-level cross-site navigation regardless
  257. // of HTTP method (i.e. allowing unsafe methods). This is a convenience for
  258. // integration tests which may want to test behavior of cookies older than the
  259. // threshold, but which would not be practical to run for 2 minutes.
  260. NET_EXPORT extern const base::Feature kShortLaxAllowUnsafeThreshold;
  261. // When enabled, the SameSite by default feature does not add the
  262. // "Lax-allow-unsafe" behavior. Any cookies that do not specify a SameSite
  263. // attribute will be treated as Lax only, i.e. POST and other unsafe HTTP
  264. // methods will not be allowed at all for top-level cross-site navigations.
  265. // This only has an effect if the cookie defaults to SameSite=Lax.
  266. NET_EXPORT extern const base::Feature kSameSiteDefaultChecksMethodRigorously;
  267. #if BUILDFLAG(BUILTIN_CERT_VERIFIER_FEATURE_SUPPORTED)
  268. // When enabled, use the builtin cert verifier instead of the platform verifier.
  269. NET_EXPORT extern const base::Feature kCertVerifierBuiltinFeature;
  270. #if BUILDFLAG(IS_MAC)
  271. NET_EXPORT extern const base::FeatureParam<int> kCertVerifierBuiltinImpl;
  272. NET_EXPORT extern const base::FeatureParam<int> kCertVerifierBuiltinCacheSize;
  273. #endif /* BUILDFLAG(IS_MAC) */
  274. #endif /* BUILDFLAG(BUILTIN_CERT_VERIFIER_FEATURE_SUPPORTED) */
  275. #if BUILDFLAG(TRIAL_COMPARISON_CERT_VERIFIER_SUPPORTED)
  276. NET_EXPORT extern const base::Feature kCertDualVerificationTrialFeature;
  277. #if BUILDFLAG(IS_MAC)
  278. NET_EXPORT extern const base::FeatureParam<int> kCertDualVerificationTrialImpl;
  279. NET_EXPORT extern const base::FeatureParam<int>
  280. kCertDualVerificationTrialCacheSize;
  281. #endif /* BUILDFLAG(IS_MAC) */
  282. #if BUILDFLAG(BUILTIN_CERT_VERIFIER_FEATURE_SUPPORTED) && \
  283. BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED)
  284. // If both builtin verifier+system roots and builtin verifier+CRS flags are
  285. // supported in the same build, this param can be used to choose which to test
  286. // in the trial.
  287. NET_EXPORT extern const base::FeatureParam<bool>
  288. kCertDualVerificationTrialUseCrs;
  289. #endif
  290. #endif /* BUILDFLAG(TRIAL_COMPARISON_CERT_VERIFIER_SUPPORTED) */
  291. #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED)
  292. // When enabled, use the Chrome Root Store instead of the system root store
  293. NET_EXPORT extern const base::Feature kChromeRootStoreUsed;
  294. #endif /* BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED) */
  295. // Turns off streaming media caching to disk when on battery power.
  296. NET_EXPORT extern const base::Feature kTurnOffStreamingMediaCachingOnBattery;
  297. // Turns off streaming media caching to disk always.
  298. NET_EXPORT extern const base::Feature kTurnOffStreamingMediaCachingAlways;
  299. // When enabled this feature will cause same-site calculations to take into
  300. // account the scheme of the site-for-cookies and the request/response url.
  301. NET_EXPORT extern const base::Feature kSchemefulSameSite;
  302. // Enables a process-wide limit on "open" UDP sockets. See
  303. // udp_socket_global_limits.h for details on what constitutes an "open" socket.
  304. NET_EXPORT extern const base::Feature kLimitOpenUDPSockets;
  305. // FeatureParams associated with kLimitOpenUDPSockets.
  306. // Sets the maximum allowed open UDP sockets. Provisioning more sockets than
  307. // this will result in a failure (ERR_INSUFFICIENT_RESOURCES).
  308. NET_EXPORT extern const base::FeatureParam<int> kLimitOpenUDPSocketsMax;
  309. // Enables a timeout on individual TCP connect attempts, based on
  310. // the parameter values.
  311. NET_EXPORT extern const base::Feature kTimeoutTcpConnectAttempt;
  312. // FeatureParams associated with kTimeoutTcpConnectAttempt.
  313. // When there is an estimated RTT available, the experimental TCP connect
  314. // attempt timeout is calculated as:
  315. //
  316. // clamp(kTimeoutTcpConnectAttemptMin,
  317. // kTimeoutTcpConnectAttemptMax,
  318. // <Estimated RTT> * kTimeoutTcpConnectAttemptRTTMultiplier);
  319. //
  320. // Otherwise the TCP connect attempt timeout is set to
  321. // kTimeoutTcpConnectAttemptMax.
  322. NET_EXPORT extern const base::FeatureParam<double>
  323. kTimeoutTcpConnectAttemptRTTMultiplier;
  324. NET_EXPORT extern const base::FeatureParam<base::TimeDelta>
  325. kTimeoutTcpConnectAttemptMin;
  326. NET_EXPORT extern const base::FeatureParam<base::TimeDelta>
  327. kTimeoutTcpConnectAttemptMax;
  328. #if BUILDFLAG(ENABLE_REPORTING)
  329. // When enabled this feature will allow a new Reporting-Endpoints header to
  330. // configure reporting endpoints for report delivery. This is used to support
  331. // the new Document Reporting spec.
  332. NET_EXPORT extern const base::Feature kDocumentReporting;
  333. #endif // BUILDFLAG(ENABLE_REPORTING)
  334. #if BUILDFLAG(IS_POSIX) || BUILDFLAG(IS_FUCHSIA)
  335. // When enabled, UDPSocketPosix increments the global counter of bytes received
  336. // every time bytes are received, instead of using a timer to batch updates.
  337. // This should reduce the number of wake ups and improve battery consumption.
  338. // TODO(https://crbug.com/1189805): Cleanup the feature after verifying that it
  339. // doesn't negatively affect performance.
  340. NET_EXPORT extern const base::Feature kUdpSocketPosixAlwaysUpdateBytesReceived;
  341. #endif // BUILDFLAG(IS_POSIX) || BUILDFLAG(IS_FUCHSIA)
  342. // When this feature is enabled, redirected requests will be considered
  343. // cross-site for the purpose of SameSite cookies if any redirect hop was
  344. // cross-site to the target URL, even if the original initiator of the
  345. // redirected request was same-site with the target URL (and the
  346. // site-for-cookies).
  347. // See spec changes in https://github.com/httpwg/http-extensions/pull/1348
  348. NET_EXPORT extern const base::Feature kCookieSameSiteConsidersRedirectChain;
  349. // When enabled, cookies with the SameParty attribute are treated as
  350. // "first-party" when in same-party contexts, for the purposes of third-party
  351. // cookie blocking. (Note that as a consequence, some cookies may be blocked
  352. // while others are allowed on a cross-site, same-party request. Additionally,
  353. // privacy mode is disabled in same-party contexts.)
  354. NET_EXPORT extern const base::Feature kSamePartyCookiesConsideredFirstParty;
  355. // When enabled, sites can opt-in to having their cookies partitioned by
  356. // top-level site with the Partitioned attribute. Partitioned cookies will only
  357. // be sent when the browser is on the same top-level site that it was on when
  358. // the cookie was set.
  359. NET_EXPORT extern const base::Feature kPartitionedCookies;
  360. // Flag to bypass the origin trial opt-in to use Partitioned cookies. This
  361. // allows developers to test Partitioned cookies manually in development
  362. // environments.
  363. // TODO(crbug.com/1296161): Remove this feature when the CHIPS OT ends.
  364. NET_EXPORT extern const base::Feature kPartitionedCookiesBypassOriginTrial;
  365. // When enabled, then we allow partitioned cookies even if kPartitionedCookies
  366. // is disabled only if the cookie partition key contains a nonce. So far, this
  367. // is used to create temporary cookie jar partitions for fenced and anonymous
  368. // frames.
  369. NET_EXPORT extern const base::Feature kNoncedPartitionedCookies;
  370. // When enabled, additional cookie-related APIs will perform cookie field size
  371. // and character set validation to enforce stricter conformance with RFC6265bis.
  372. // TODO(crbug.com/1243852) Eventually enable this permanently and remove the
  373. // feature flag, assuming no breakage occurs with it enabled.
  374. NET_EXPORT extern const base::Feature kExtraCookieValidityChecks;
  375. // Enable recording UMAs for network activities which can wake-up radio on
  376. // Android.
  377. NET_EXPORT extern const base::Feature kRecordRadioWakeupTrigger;
  378. // When enabled, cookies cannot have an expiry date further than 400 days in the
  379. // future.
  380. NET_EXPORT extern const base::Feature kClampCookieExpiryTo400Days;
  381. // Controls whether static key pinning is enforced.
  382. NET_EXPORT extern const base::Feature kStaticKeyPinningEnforcement;
  383. // When enabled, cookies with a non-ASCII domain attribute will be rejected.
  384. NET_EXPORT extern const base::Feature kCookieDomainRejectNonASCII;
  385. // Blocks the 'Set-Cookie' request header on outbound fetch requests.
  386. NET_EXPORT extern const base::Feature kBlockSetCookieHeader;
  387. NET_EXPORT extern const base::Feature kOptimizeNetworkBuffers;
  388. NET_EXPORT
  389. extern const base::FeatureParam<int> kOptimizeNetworkBuffersBytesReadLimit;
  390. NET_EXPORT extern const base::FeatureParam<int>
  391. kOptimizeNetworkBuffersMaxInputStreamBytesToReadWhenAvailableUnknown;
  392. NET_EXPORT extern const base::FeatureParam<int>
  393. kOptimizeNetworkBuffersFilterSourceStreamBufferSize;
  394. NET_EXPORT extern const base::FeatureParam<bool>
  395. kOptimizeNetworkBuffersInputStreamCheckAvailable;
  396. // Enable the Storage Access API. https://crbug.com/989663.
  397. NET_EXPORT extern const base::Feature kStorageAccessAPI;
  398. // Set the default number of "automatic" implicit storage access grants per
  399. // third party origin that can be granted. This can be overridden via
  400. // experimentation to allow for field trials to validate the default setting.
  401. NET_EXPORT extern const int kStorageAccessAPIDefaultImplicitGrantLimit;
  402. NET_EXPORT extern const base::FeatureParam<int>
  403. kStorageAccessAPIImplicitGrantLimit;
  404. // Whether the Storage Access API can grant access to storage (even if it is
  405. // unpartitioned). When this feature is disabled, access to storage is only
  406. // granted if the storage is partitioned.
  407. NET_EXPORT extern const base::FeatureParam<bool>
  408. kStorageAccessAPIGrantsUnpartitionedStorage;
  409. NET_EXPORT extern const base::Feature kThirdPartyStoragePartitioning;
  410. } // namespace net::features
  411. #endif // NET_BASE_FEATURES_H_