sec_header_helpers.cc 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211
  1. // Copyright 2019 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "services/network/sec_header_helpers.h"
  5. #include <algorithm>
  6. #include <string>
  7. #include "base/feature_list.h"
  8. #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
  9. #include "net/http/http_request_headers.h"
  10. #include "net/url_request/url_request.h"
  11. #include "services/network/public/cpp/cors/origin_access_list.h"
  12. #include "services/network/public/cpp/features.h"
  13. #include "services/network/public/cpp/initiator_lock_compatibility.h"
  14. #include "services/network/public/cpp/is_potentially_trustworthy.h"
  15. #include "services/network/public/cpp/request_destination.h"
  16. #include "services/network/public/cpp/request_mode.h"
  17. #include "services/network/public/mojom/fetch_api.mojom.h"
  18. #include "services/network/public/mojom/network_context.mojom.h"
  19. namespace network {
  20. namespace {
  21. const char kSecFetchMode[] = "Sec-Fetch-Mode";
  22. const char kSecFetchSite[] = "Sec-Fetch-Site";
  23. const char kSecFetchUser[] = "Sec-Fetch-User";
  24. const char kSecFetchDest[] = "Sec-Fetch-Dest";
  25. // Sec-Fetch-Site infrastructure:
  26. //
  27. // Note that the order of enum values below is significant - it is important for
  28. // std::max invocations that kSameOrigin < kSameSite < kCrossSite.
  29. enum class SecFetchSiteValue {
  30. kNoOrigin,
  31. kSameOrigin,
  32. kSameSite,
  33. kCrossSite,
  34. };
  35. const char* GetSecFetchSiteHeaderString(const SecFetchSiteValue& value) {
  36. switch (value) {
  37. case SecFetchSiteValue::kNoOrigin:
  38. return "none";
  39. case SecFetchSiteValue::kSameOrigin:
  40. return "same-origin";
  41. case SecFetchSiteValue::kSameSite:
  42. return "same-site";
  43. case SecFetchSiteValue::kCrossSite:
  44. return "cross-site";
  45. }
  46. }
  47. SecFetchSiteValue GetHeaderValueForTargetAndInitiator(
  48. const GURL& target_url,
  49. const url::Origin& initiator) {
  50. url::Origin target_origin = url::Origin::Create(target_url);
  51. if (target_origin == initiator)
  52. return SecFetchSiteValue::kSameOrigin;
  53. // Cross-scheme initiator should be considered cross-site (even if it's host
  54. // is same-site with the target). See also https://crbug.com/979257.
  55. if (initiator.scheme() == target_origin.scheme() &&
  56. net::registry_controlled_domains::SameDomainOrHost(
  57. initiator, target_origin,
  58. net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES)) {
  59. return SecFetchSiteValue::kSameSite;
  60. }
  61. return SecFetchSiteValue::kCrossSite;
  62. }
  63. SecFetchSiteValue GetHeaderValueForRequest(
  64. net::URLRequest* request,
  65. const GURL* pending_redirect_url,
  66. const mojom::URLLoaderFactoryParams& factory_params,
  67. const cors::OriginAccessList& origin_access_list) {
  68. // Browser-initiated requests with no initiator origin will send
  69. // `Sec-Fetch-Site: None`.
  70. if (!request->initiator().has_value()) {
  71. // CorsURLLoaderFactory::IsValidRequest verifies that only the browser
  72. // process may initiate requests with no request initiator.
  73. DCHECK_EQ(factory_params.process_id, mojom::kBrowserProcessId);
  74. return SecFetchSiteValue::kNoOrigin;
  75. }
  76. const url::Origin& initiator = request->initiator().value();
  77. // Privileged requests initiated from a "non-webby" context will send
  78. // `Sec-Fetch-Site: None` while unprivileged ones will send
  79. // `Sec-Fetch-Site: cross-site`.
  80. if (factory_params.unsafe_non_webby_initiator) {
  81. cors::OriginAccessList::AccessState access_state =
  82. origin_access_list.CheckAccessState(initiator, request->url());
  83. bool is_privileged =
  84. (access_state == cors::OriginAccessList::AccessState::kAllowed);
  85. return is_privileged ? SecFetchSiteValue::kNoOrigin
  86. : SecFetchSiteValue::kCrossSite;
  87. }
  88. // Other requests default to `kSameOrigin`, and walk through the request's URL
  89. // chain to calculate the correct value.
  90. auto header_value = SecFetchSiteValue::kSameOrigin;
  91. for (const GURL& target_url : request->url_chain()) {
  92. header_value = std::max(header_value, GetHeaderValueForTargetAndInitiator(
  93. target_url, initiator));
  94. }
  95. if (pending_redirect_url) {
  96. header_value = std::max(
  97. header_value,
  98. GetHeaderValueForTargetAndInitiator(*pending_redirect_url, initiator));
  99. }
  100. return header_value;
  101. }
  102. // Sec-Fetch-Site
  103. void SetSecFetchSiteHeader(net::URLRequest* request,
  104. const GURL* pending_redirect_url,
  105. const mojom::URLLoaderFactoryParams& factory_params,
  106. const cors::OriginAccessList& origin_access_list) {
  107. SecFetchSiteValue header_value = GetHeaderValueForRequest(
  108. request, pending_redirect_url, factory_params, origin_access_list);
  109. request->SetExtraRequestHeaderByName(
  110. kSecFetchSite, GetSecFetchSiteHeaderString(header_value),
  111. /* overwrite = */ true);
  112. }
  113. // Sec-Fetch-Mode
  114. void SetSecFetchModeHeader(net::URLRequest* request,
  115. network::mojom::RequestMode mode) {
  116. std::string header_value = RequestModeToString(mode);
  117. request->SetExtraRequestHeaderByName(kSecFetchMode, header_value, false);
  118. }
  119. // Sec-Fetch-User
  120. void SetSecFetchUserHeader(net::URLRequest* request, bool has_user_activation) {
  121. if (has_user_activation)
  122. request->SetExtraRequestHeaderByName(kSecFetchUser, "?1", true);
  123. else
  124. request->RemoveRequestHeaderByName(kSecFetchUser);
  125. }
  126. // Sec-Fetch-Dest
  127. void SetSecFetchDestHeader(net::URLRequest* request,
  128. network::mojom::RequestDestination dest) {
  129. // https://w3c.github.io/webappsec-fetch-metadata/#abstract-opdef-set-dest
  130. // If r's destination is the empty string, set header's value to the string
  131. // "empty". Otherwise, set header's value to r's destination.
  132. std::string header_value = dest == mojom::RequestDestination::kEmpty
  133. ? "empty"
  134. : RequestDestinationToString(dest);
  135. request->SetExtraRequestHeaderByName(kSecFetchDest, header_value, true);
  136. }
  137. } // namespace
  138. void SetFetchMetadataHeaders(
  139. net::URLRequest* request,
  140. network::mojom::RequestMode mode,
  141. bool has_user_activation,
  142. network::mojom::RequestDestination dest,
  143. const GURL* pending_redirect_url,
  144. const mojom::URLLoaderFactoryParams& factory_params,
  145. const cors::OriginAccessList& origin_access_list) {
  146. DCHECK(request);
  147. DCHECK_NE(0u, request->url_chain().size());
  148. // Only append the header to potentially trustworthy URLs.
  149. const GURL& target_url =
  150. pending_redirect_url ? *pending_redirect_url : request->url();
  151. if (!IsUrlPotentiallyTrustworthy(target_url))
  152. return;
  153. SetSecFetchSiteHeader(request, pending_redirect_url, factory_params,
  154. origin_access_list);
  155. SetSecFetchModeHeader(request, mode);
  156. SetSecFetchUserHeader(request, has_user_activation);
  157. SetSecFetchDestHeader(request, dest);
  158. }
  159. void MaybeRemoveSecHeaders(net::URLRequest* request,
  160. const GURL& pending_redirect_url) {
  161. DCHECK(request);
  162. // If our redirect destination is not trusted it would not have had sec-ch- or
  163. // sec-fetch- prefixed headers added to it. Our previous hops may have added
  164. // these headers if the current url is trustworthy though so we should try to
  165. // remove these now.
  166. if (IsUrlPotentiallyTrustworthy(request->url()) &&
  167. !IsUrlPotentiallyTrustworthy(pending_redirect_url)) {
  168. // Check each of our request headers and if it is a "sec-ch-" or
  169. // "sec-fetch-" prefixed header we'll remove it.
  170. const net::HttpRequestHeaders::HeaderVector request_headers =
  171. request->extra_request_headers().GetHeaderVector();
  172. for (const auto& header : request_headers) {
  173. if (StartsWith(header.key, "sec-ch-",
  174. base::CompareCase::INSENSITIVE_ASCII) ||
  175. StartsWith(header.key, "sec-fetch-",
  176. base::CompareCase::INSENSITIVE_ASCII)) {
  177. request->RemoveRequestHeaderByName(header.key);
  178. }
  179. }
  180. }
  181. }
  182. } // namespace network