tree 9fc8e8de116fd1533af13db4724b687c2265d597
parent affce278661cc224f253d39d1baaf222a6fce6eb
author Antoine Musso <hashar@free.fr> 1679569034 +0100
committer Antoine Musso <hashar@free.fr> 1679569034 +0100

Fix CORS preflight interception

With Chromium 111 I have noticed the built-in rule to add
`Access-Control-Allow-Origin=*` to response headers was ineffective
which can easily be worked around by emitting it from web server serving
the plugins.

The plugin I wrote fetches from a foreign resource which triggers a
preflight request. Since the browser extension always inject
`Cache-Control` the preflight request is emitted with:

    Allow-Control-Request-Headers: cache-control

The browser then expect the response to contain:

    Allow-Control-Response-Headers: cache-control

That again can be fixed via the web server until one interact with a
server they have no control on (eg a production service).

What I found out is the `addReqHeader` and `addRespHeader` functions are
not effective for preflight requests. The rules are handled listener
methods added via:
- chrome.webRequest.onBeforeRequest.addListener
- chrome.webRequest.onHeadersReceived.addListener

The WebRequest API does not intercept preflights requests, the events
are thus never fired, the listeners never kick in and none of our
extension rules are applied. This result in a cascading list of error
such as missing `Access-Control-Allow-Origin: *`.

The root cause is Chrome 79 as described on the WebRequest API page:
https://developer.chrome.com/docs/extensions/reference/webRequest/

> Starting from Chrome 79, the webRequest API *does not* intercept CORS
> preflight requests and responses by default. A CORS preflight for a
> request URL is visible to an extension if there is a listener with
> `'extraHeaders'` specified in `opt_extraInfoSpec` for the request URL.
> `onBeforeRequest` can also take 'extraHeaders' from Chrome 79.

Add the 'extraHeaders' to `onBeforeRequest` fixes the preflight
requests and cause events to be fired thus restoring the headers
injection.

Bug: Issue 16795
Change-Id: Ic25427dd65ad03d0ba8e78eebf6d23cd35134af0