You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This PR implements a comprehensive header injection system in Chromium that automatically adds WootzApp-specific headers to outgoing HTTP requests for internal domains after successful SAML authentication. This enables zero-trust browser identification and access control for internal resources.
🎯 Problem Statement
Previously, the system relied on User-Agent header modification for browser identification, which proved unreliable in Chromium. Internal URLs were accessible from any browser, lacking proper access control based on SAML authentication status.
✅ Solution
Implemented a robust header injection system that:
Integrates with Chromium's NetworkDelegate for reliable header injection
Triggers after SAML authentication to ensure proper access control
Uses custom headers instead of unreliable User-Agent modification
Provides extensive logging for debugging and monitoring
Here are some key observations to aid the review process:
⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 No relevant tests
🔒 Security concerns
Sensitive information exposure: Multiple INFO logs print user IDs, emails, full URLs, and all injected headers. These can leak PII and authentication context into logs. Recommend:
Gate such logs behind a debug/verbose flag or DCHECK_IS_ON.
Redact or hash PII fields and avoid logging header values like X-SAML-Auth-User-Email.
Avoid logging full URLs if they may contain sensitive paths or query params.
Additionally, the code injects headers with authentication state for any matching hostname. Ensure the internal domain list cannot be trivially controlled by an attacker (e.g., via subdomain tricks) and consider pinning to exact domains or PSL-aware matching.
User identifiers and emails are logged in plaintext during header generation and SAML processing; this may leak sensitive data in logs and should be redacted or gated behind debug-only logging.
Internal domains are hardcoded; consider sourcing from configuration or enterprise policy to avoid rebuilds for changes and reduce risk of stale values.
Extensive INFO-level request logging (including full URLs and injected headers) may flood logs and expose sensitive information; consider reducing log level, sampling, or redaction.
The network service reads SAML/auth state via static globals in SamlVerifier, but that state lives in a different process (and thread), causing broken behavior and violating Chromium layering by including components code in services/network. Replace the static, process-local state with per-profile, thread-safe state plumbed to the network service via Mojo/NetworkContext params or perform header injection in the browser process (e.g., URLLoaderThrottle) where the SAML state resides. This avoids layering violations, ensures correctness across processes, and prevents race conditions.
// In services/network (Network Process)classNetworkServiceNetworkDelegate {
OnBeforeStartTransaction(...) {
// Reads state from static variables in its own processif (saml_verifier::SamlVerifier::ShouldInjectWootzAppHeaders(hostname)) {
auto headers = saml_verifier::SamlVerifier::GetWootzAppHeaders(hostname);
// ... inject headers
}
}
}
// In components/saml_verifier (Browser Process)classSamlVerifier {
// State is stored in static variables, local to the browser processstaticbool saml_authenticated_;
ProcessSamlResponse(...) {
// State is written in the browser process
saml_authenticated_ = true;
}
}
After:
// Option 1: Plumb state via Mojo to Network Service// In browser process// NetworkContext is configured with the necessary state
network_context_params->wootzapp_auth_info = GetAuthInfo(); // Contains user ID, email, etc.
network_service->CreateNetworkContext(..., std::move(network_context_params));
// In services/network (Network Process)classCustomHeaderInjector {
// State is received from browser process and stored per-NetworkContext
WootzAppAuthInfo auth_info_;
InjectHeaders(request) {
// Uses local, correctly plumbed stateif (auth_info_.is_authenticated) {
// ... add headers
}
}
}
Suggestion importance[1-10]: 10
__
Why: This suggestion correctly identifies a critical architectural flaw: the use of process-local static variables for state shared between the browser process and the network service process, which will not work and is a major layering violation.
High
General
Remove unreachable code
There is unreachable code after the return statement. The second return false; will never be executed and should be removed to avoid compiler warnings and improve code clarity.
// Check if this is an internal domain
return SamlVerifier::ShouldInjectWootzAppHeaders(hostname);
-return false;-
Apply / Chat
Suggestion importance[1-10]: 4
__
Why: The suggestion correctly identifies and removes an unreachable return false; statement, which improves code clarity and prevents potential compiler warnings.
@1311-hack1 convert this code to new code architecture
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
📋 Overview
This PR implements a comprehensive header injection system in Chromium that automatically adds WootzApp-specific headers to outgoing HTTP requests for internal domains after successful SAML authentication. This enables zero-trust browser identification and access control for internal resources.
🎯 Problem Statement
Previously, the system relied on User-Agent header modification for browser identification, which proved unreliable in Chromium. Internal URLs were accessible from any browser, lacking proper access control based on SAML authentication status.
✅ Solution
Implemented a robust header injection system that:
🔧 Technical Implementation
C++ Code Changes
chromium/src/components/saml_verifier/saml_verifier.hchromium/src/components/saml_verifier/saml_verifier.ccGetWootzAppHeaders()function for header generationShouldInjectWootzAppHeaders()for domain validationX-WootzApp-Browser: truechromium/src/services/network/network_service_network_delegate.ccOnBeforeStartTransaction()to inject headers for internal domainsServer-Side Configuration
nginx.confX-WootzApp-BrowserandX-WootzApp-Versionheader forwardingsaml-bridge-service.pyX-WootzApp-Browserheader as alternative to User-Agent📦 Headers Injected
The system now injects the following headers for internal domains:
🔍 Logging and Debugging
Added comprehensive logging throughout the system:
Chromium C++ Logs
SAML Bridge Logs
🧪 Testing
Manual Testing
Test Scripts
manual_test_headers.shfor curl-based testingcheck_browser_headers.pyfor Python-based testingtest_header_debug.htmlfor client-side debugging🚀 Deployment
Prerequisites
Steps
🔒 Security Impact
📈 Performance Impact
🔄 Backward Compatibility
🐛 Known Issues
📚 Documentation
NGINX_AUTHENTICATION_GUIDE.mdwith header injection details🎉 Results
After implementation:
Related Issues: #123 (Header injection for internal domains)
Breaking Changes: None
Dependencies: Chromium build environment, Docker Compose
PR Type
Enhancement
Description
Implement WootzApp header injection system for internal domain access control
Integrate SAML authentication status with HTTP request headers
Add comprehensive logging for debugging and monitoring
Remove duplicate Android copy-paste snackbar implementation
Diagram Walkthrough
File Walkthrough
copy_paste_blocked_snackbar_bridge.cc
Remove duplicate copy-paste snackbar bridgesrc/chrome/browser/android/renderer_context_menu/copy_paste_blocked_snackbar_bridge.cc
saml_verifier.cc
Implement SAML-based header injection systemsrc/components/saml_verifier/saml_verifier.cc
GetWootzAppHeaders()function for header generationShouldInjectWootzAppHeaders()wootzapp_header_injector.cc
Add WootzApp header injection utilitiessrc/components/saml_verifier/wootzapp_header_injector.cc
InjectWootzAppHeaders()for URLRequest integrationnetwork_service_network_delegate.cc
Integrate header injection in network delegatesrc/services/network/network_service_network_delegate.cc
OnBeforeStartTransaction()to inject headerssaml_verifier.h
Add header injection interface declarationssrc/components/saml_verifier/saml_verifier.h
BUILD.gn
Update build configuration for header injectorsrc/components/saml_verifier/BUILD.gn
wootzapp_header_injector.ccto build sources