commit 224ff964f4e15546d6a11fe39596e60cee2120d2
author Ian Clelland <iclelland@google.com> Thu Oct 12 18:09:20 2017
committer Commit Bot <commit-bot@chromium.org> Thu Oct 12 18:09:20 2017
tree 11a3646fdf0ee57f8928508e99b6f72d439d9d17
parent 76a6655c742d8d99c53d2972832a9414a5956dcc

Add SyncXHR as an experimental policy-controlled feature

This CL disables synchronous XHR in documents by throwing an
InvalidAccessError on open() if it is disallowed by feature policy.

SyncXHR is allowed by default in all frames; to disable in a particular
iframe, use the allow attribute, like

<iframe src="..." allow="sync-xhr 'none'"></iframe>

Or include a Feature-Policy HTTP header with a document which either
only allows synchronous XHR in certain origins:

Feature-Policy: sync-xhr 'self' https://example.com

or disallows it completely:

Feature-Policy: sync-xhr 'none'

The feature currently requires the 'FeaturePolicyExperimentalFeatures'
runtime flag.


Bug: 661283
Change-Id: If511e5990623670128f63f9c1d7233bca659b7e6
Reviewed-on: https://chromium-review.googlesource.com/656722
Commit-Queue: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Raymes Khoury <raymes@chromium.org>
Reviewed-by: Rick Byers <rbyers@chromium.org>
Cr-Commit-Position: refs/heads/master@{#508370}