Ship the `Sec-Fetch-{Mode,Site,User}` request headers.
Spec: https://mikewest.github.io/sec-metadata/
Intent to Ship: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/yQgJlq5PEOQ/erexYRWHBgAJ
Bug: 843478
Change-Id: Iae3bbaa9c908f9f8f281cd97ba94b1601556cb93
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1547515
Commit-Queue: Mike West <mkwst@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#652776}diff --git a/services/network/public/cpp/features.cc b/services/network/public/cpp/features.cc
index f7bf09f21..1950a61 100644
--- a/services/network/public/cpp/features.cc
+++ b/services/network/public/cpp/features.cc
@@ -61,7 +61,7 @@
// Implementation of https://mikewest.github.io/sec-metadata/
const base::Feature kFetchMetadata{"FetchMetadata",
- base::FEATURE_DISABLED_BY_DEFAULT};
+ base::FEATURE_ENABLED_BY_DEFAULT};
// The `Sec-Fetch-Dest` header is split out from the main "FetchMetadata"
// feature so we can ship the broader feature without this specifific bit
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index a256002..2bd0c84d 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -549,7 +549,7 @@
},
{
name: "FetchMetadata",
- status: "experimental"
+ status: "stable"
},
{
name: "FetchMetadataDestination",
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt
index 54d1f09..a5fefdbd 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-get-expected.txt
@@ -14,4 +14,6 @@
HTTP_CONNECTION = keep-alive
HTTP_HOST = localhost:8080
HTTP_REFERER = http://127.0.0.1:8000/navigation/form-targets-cross-site-frame-get.html
+HTTP_SEC_FETCH_MODE = nested-navigate
+HTTP_SEC_FETCH_SITE = cross-site
HTTP_UPGRADE_INSECURE_REQUESTS = 1
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-no-referrer-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-no-referrer-expected.txt
index d6199c1..373bd2c 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-no-referrer-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-no-referrer-expected.txt
@@ -15,4 +15,6 @@
HTTP_CONNECTION = keep-alive
HTTP_HOST = localhost:8080
HTTP_ORIGIN = null
+HTTP_SEC_FETCH_MODE = nested-navigate
+HTTP_SEC_FETCH_SITE = cross-site
HTTP_UPGRADE_INSECURE_REQUESTS = 1
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-post-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-post-expected.txt
index 9f5e396..50ea2e6 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-post-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-targets-cross-site-frame-post-expected.txt
@@ -16,4 +16,6 @@
HTTP_HOST = localhost:8080
HTTP_ORIGIN = http://127.0.0.1:8000
HTTP_REFERER = http://127.0.0.1:8000/navigation/form-targets-cross-site-frame-post.html
+HTTP_SEC_FETCH_MODE = nested-navigate
+HTTP_SEC_FETCH_SITE = cross-site
HTTP_UPGRADE_INSECURE_REQUESTS = 1
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-with-enctype-targets-cross-site-frame-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-with-enctype-targets-cross-site-frame-expected.txt
index fadc4c7..b3d8e08a 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-with-enctype-targets-cross-site-frame-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/form-with-enctype-targets-cross-site-frame-expected.txt
@@ -16,4 +16,6 @@
HTTP_HOST = localhost:8080
HTTP_ORIGIN = http://127.0.0.1:8000
HTTP_REFERER = http://127.0.0.1:8000/navigation/form-with-enctype-targets-cross-site-frame.html
+HTTP_SEC_FETCH_MODE = nested-navigate
+HTTP_SEC_FETCH_SITE = cross-site
HTTP_UPGRADE_INSECURE_REQUESTS = 1
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-basic-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-basic-expected.txt
index 72298a0..a514a41 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-basic-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-basic-expected.txt
@@ -12,6 +12,8 @@
HTTP_HOST = 127.0.0.1:8000
HTTP_ORIGIN = http://127.0.0.1:8000
HTTP_REFERER = http://127.0.0.1:8000/navigation/resources/page-that-posts.html
+HTTP_SEC_FETCH_MODE = navigate
+HTTP_SEC_FETCH_SITE = same-origin
HTTP_UPGRADE_INSECURE_REQUESTS = 1
============== Back Forward List ==============
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-frames-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-frames-expected.txt
index 218a33e..4b2c14b 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-frames-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-frames-expected.txt
@@ -17,6 +17,8 @@
HTTP_HOST = 127.0.0.1:8000
HTTP_ORIGIN = http://127.0.0.1:8000
HTTP_REFERER = http://127.0.0.1:8000/navigation/resources/page-that-posts.html
+HTTP_SEC_FETCH_MODE = nested-navigate
+HTTP_SEC_FETCH_SITE = same-origin
HTTP_UPGRADE_INSECURE_REQUESTS = 1
============== Back Forward List ==============
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-frames-goback1-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-frames-goback1-expected.txt
index 863d0ca5..f774a68 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-frames-goback1-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-frames-goback1-expected.txt
@@ -16,6 +16,8 @@
HTTP_HOST = 127.0.0.1:8000
HTTP_ORIGIN = http://127.0.0.1:8000
HTTP_REFERER = http://127.0.0.1:8000/navigation/post-frames-goback1.html
+HTTP_SEC_FETCH_MODE = nested-navigate
+HTTP_SEC_FETCH_SITE = same-origin
HTTP_UPGRADE_INSECURE_REQUESTS = 1
============== Back Forward List ==============
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-goback1-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-goback1-expected.txt
index d7b0e125d..4aabcfc 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-goback1-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/post-goback1-expected.txt
@@ -12,6 +12,8 @@
HTTP_HOST = 127.0.0.1:8000
HTTP_ORIGIN = http://127.0.0.1:8000
HTTP_REFERER = http://127.0.0.1:8000/navigation/resources/page-that-posts.html
+HTTP_SEC_FETCH_MODE = navigate
+HTTP_SEC_FETCH_SITE = same-origin
HTTP_UPGRADE_INSECURE_REQUESTS = 1
============== Back Forward List ==============
diff --git a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/rename-subframe-goback-expected.txt b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/rename-subframe-goback-expected.txt
index 1657767..358d7e2 100644
--- a/third_party/blink/web_tests/virtual/stable/http/tests/navigation/rename-subframe-goback-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/http/tests/navigation/rename-subframe-goback-expected.txt
@@ -20,4 +20,6 @@
HTTP_HOST = 127.0.0.1:8000
HTTP_ORIGIN = http://127.0.0.1:8000
HTTP_REFERER = http://127.0.0.1:8000/navigation/resources/page-that-posts.html
+HTTP_SEC_FETCH_MODE = nested-navigate
+HTTP_SEC_FETCH_SITE = same-origin
HTTP_UPGRADE_INSECURE_REQUESTS = 1
