commit e2aea293a2a2f3d35708d6853e7cdd2058869ea6
author Joe DeBlasio <jdeblasio@chromium.org> Tue Nov 14 20:00:23 2023
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Nov 14 20:00:23 2023
tree d4b8162b722f5cce983b29a3cb6a5da89757b911
parent 7d630fef6b79bb3f32b9ab59931664d5c841df85

Add HSTS protection metrics to main-frame navigations

This CL records, for each top-level navigation, whether the navigation
is protected by HSTS or not, and whether it's currently using HTTPS or
not. (HTTP requests to hostnames protected by HSTS are internally
redirected shortly after this metric is recorded.)

This gives us some insight into the practical adoption of HSTS (not just
preloading), and thus is correlated with the risk of downgrade and
HTTPS- stripping attacks on hosts.

This metric isn't perfect, since even without HSTS, not all HTTPS
navigations are eligible to be downgraded. If the user navigates
explicitly to the HTTPS page, e.g. by clicking a HTTPS link on a
(HTTPS-protected) site, or choosing a bookmark that uses HTTPS, a
network attacker can't easily downgrade to HTTP. We're partly addressing
that limitation with additional metrics (in the omnibox and HTTPS
upgrading logic), but this metric gives us easiest access to HSTS status
of HTTPS-protected pages, so it has some unique value.

As implemented, this metric takes advantage of a layering violation
wherein stuff in net/ can see if an HTTP request is for a main frame
navigation. That's officially deprecated, and there was a dream to
remove the ability in crbug.com/516499, but that bug has been WontFix'd,
and I expect this metric to be temporary and removable before that work
is picked back up. So shame on me for the layering violation, but it
should be pretty harmless.

Bug: 1501170
Change-Id: I77f84079867fdf62a1c3450ce528a030a3a6f555
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5021059
Commit-Queue: David Schinazi <dschinazi@chromium.org>
Reviewed-by: David Schinazi <dschinazi@chromium.org>
Commit-Queue: Joe DeBlasio <jdeblasio@chromium.org>
Auto-Submit: Joe DeBlasio <jdeblasio@chromium.org>
Reviewed-by: David Schinazi <dschinazi@google.com>
Reviewed-by: Carlos IL <carlosil@chromium.org>
Reviewed-by: Matt Mueller <mattm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1224488}