https://cs.chromium.org/chromium/src/third_party/WebKit/public/platform/WebURLLoaderClient.h?q=blink::WebURLLoaderClient&sq=package:chromium&dr=Ss&l=47
Comments mention that |newRequest| may be modified in the willFollowRedirect() callback, but this is misleading since the caller (WebURLLoaderImpl::Context::OnReceivedRedirect()) is not actually propagating changes back to the browser process.
To be precise, modifications to fields used in WebURLLoaderImpl::Context::Start() to initialize content::ResourceRequest will be invalid, since it's not updated in browser process after the callback.

WebURLLoaderClient implementations have been modifying |newRequest| but the behavior might be different from expected.
For example, if |newRequest.m_allowStoredCredentials| is changed in ResourceFetcher::willFollowRedirect(), load flags for the next request should in turn be modified (see content::GetLoadFlagsForWebURLRequest()), but this is not the case.

To behave as documented, we should actually propagate changes back to browser through IPC.
Otherwise it would be better to make |newRequest| const to make it simply a reference for implementations to decide whether to follow redirect or not.