x-chrome-connected can be added to Access-Control-Request-Headers when service worker intercepts a request |
||||||||
Issue descriptionSee internal bug b/28803517 When #enable-account-consistency is enabled to chrome://flags, Chrome adds the x-chrome-connected header to some requests. When a service worker intercepts such a request and later calls fetch(request), and this causes a preflight request to be built, the x-chrome-connected header is added to Access-Control-Request-Headers. This can cause sites to break when they use service worker, since the server does not expect this header in ACRH. rogerta@: How likely is the x-chrome-connected header to be added in the wild? Is it is here to stay? What's the level of support and usage of #enable-account-consistency?
,
Jun 3 2016
rogerta: Is the x-chrome-connected header sent only if #enable-account-consistency is enabled?
,
Dec 19 2016
--Chrome Identity automated triaging-- This bug is Assigned and has gone one month without any activity, so it is being moved to Available to indicate that it is not actively being worked on. If you are working on this bug, please mark yourself as the owner and move back to Assigned. Please see https://goo.gl/78kbny for more details. Please remove the Services>SignIn or UI>Browser>Profiles components if this bug isn't related to Chrome Identity. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 5 2017
I think we just need to call "x-chrome-connected" a "simple header" and it'll be excluded from ACRH thanks to issue 601092 . These means even if script adds the header it won't appear in ACRH but it's the same thing we're doing for the Chrome-injected Save-Data header.
,
Apr 13 2017
Apparently we should also whitelist x-wap-profile
,
Apr 14 2017
,
Apr 17 2017
#2: Looks it's set also when IsDriveOrigin() or gaia::IsGaiaSignonRealm() returns true (see IsUrlEligibleForXChromeConnectedHeader()), but yes, turning on #enable-account-consistency lets Chrome send it widely to various google and youtube domains. #4: I'm not sure if allowing scripts to send a x-chrome-connected header with its value set to a script authored value without getting clear approval from the server is fine. Can we check this point with the account/Identity consistency team (if rogerta is busy, msarda?)?
,
Apr 18 2017
Sorry for causing thrashing. I think this should be fixed automatically when servicified service worker arrives, because the header injection would come after the request has been directed to service worker. Since this isn't blocking anyone currently we can probably wait until then. The alternative would be to add x-chrome-connected as a special whitelist in Blink which is bad for code health and could have security implications.
,
Jun 9 2018
Issue 851142 has been merged into this issue.
,
Jun 9 2018
I expect this should be fixed with service worker + NetworkService ( issue 715640 ).
,
Jul 9
--Chrome Identity automated triaging-- This bug is Assigned and has gone one month without any activity, so it is being moved to Available to indicate that it is not actively being worked on. If you are working on this bug, please mark yourself as the owner and move back to Assigned. Please see https://goo.gl/78kbny for more details. Please remove the Services>SignIn or UI>Browser>Profiles components if this bug isn't related to Chrome Identity. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 2
,
Sep 3
--Chrome Identity automated triaging-- This bug is Assigned and has gone one month without any activity, so it is being moved to Available to indicate that it is not actively being worked on. If you are working on this bug, please mark yourself as the owner and move back to Assigned. Please see https://goo.gl/78kbny for more details. Please remove the Services>SignIn or UI>Browser>Profiles components if this bug isn't related to Chrome Identity. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by falken@chromium.org
, May 20 2016