Ignore 'X-Frame-Options' inside '<meta>' tags.
We currently try to support 'X-Frame-Options' inside '<meta>' tags by
cancelling the page load when we parse the tag, and navigating to a
blank page instead. This is somewhat functional, but not exactly a
reliable protection.
In fact, all of our XFO implementation is somewhat unreliable, as it's
all implemented in Blink. We're working on migrating it up to the
browser process, but that's going to be difficult to do cleanly if we
need to support the '<meta>' implementation. We'll either need
implementations in both Blink and //content, or we'll need another IPC.
I'd prefer to simply remove the functionality.
If this lands, I'll remove the rest of the XFO plumbing in
https://codereview.chromium.org/1617043002 as part of moving everything
up out of Blink and into //content.
Intent to Remove: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/R1gkjKZI0J8
BUG=603002
Review URL: https://codereview.chromium.org/1889433003
Cr-Commit-Position: refs/heads/master@{#387381}
18 files changed
