Cancel credential request for authentication challenges with no UI.

If an authentication challenge is received by NetworkServiceClient --
implying that there were no cached credentials or ambient identity
around to respond to the challenge -- the authentication request should
be canceled. A typo resulted in this pending challenge being supplied an
empty username and password instead.

This condition applies to requests that are made in the absence of a
WebContents, and those made with an associated WebContents that went
away prior to the network service notified the client of the
authentication challenge.

Bug: 874790
Change-Id: Ib3c866d1074b2a431a5196614ac3397bf97ea132
Reviewed-on: https://chromium-review.googlesource.com/1252868Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Reviewed-by: Matt Menke <mmenke@chromium.org>
Commit-Queue: Asanka Herath <asanka@chromium.org>
Cr-Commit-Position: refs/heads/master@{#595930}

content/browser/network_service_browsertest.cc

@@ -23,8 +23,11 @@
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "net/dns/mock_host_resolver.h"
+#include "net/http/http_response_headers.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/simple_url_loader.h"
 
 #if defined(OS_ANDROID)
 #include "base/android/application_status_listener.h"
@@ -226,6 +229,32 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest,
   EXPECT_FALSE(FetchResource(file_url));
 }
 
+IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest,
+                       SimpleUrlLoader_NoAuthWhenNoWebContents) {
+  auto request = std::make_unique<network::ResourceRequest>();
+  request->url = embedded_test_server()->GetURL("/auth-basic?password=");
+  auto loader = network::SimpleURLLoader::Create(std::move(request),
+                                                 TRAFFIC_ANNOTATION_FOR_TESTS);
+  auto loader_factory = BrowserContext::GetDefaultStoragePartition(
+                            shell()->web_contents()->GetBrowserContext())
+                            ->GetURLLoaderFactoryForBrowserProcess();
+  scoped_refptr<net::HttpResponseHeaders> headers;
+  base::RunLoop loop;
+  loader->DownloadHeadersOnly(
+      loader_factory.get(),
+      base::BindOnce(
+          [](base::OnceClosure quit_closure,
+             scoped_refptr<net::HttpResponseHeaders>* rh_out,
+             scoped_refptr<net::HttpResponseHeaders> rh_in) {
+            *rh_out = rh_in;
+            std::move(quit_closure).Run();
+          },
+          loop.QuitClosure(), &headers));
+  loop.Run();
+  ASSERT_TRUE(headers.get());
+  ASSERT_EQ(headers->response_code(), 401);
+}
+
 #if defined(OS_ANDROID)
 IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest,
                        HttpCacheWrittenToDiskOnApplicationStateChange) {

content/browser/network_service_client.cc

@@ -340,8 +340,7 @@ void NetworkServiceClient::OnAuthRequired(
                  : base::Bind(WebContents::FromFrameTreeNodeId, routing_id);
 
   if (!web_contents_getter.Run()) {
-    std::move(auth_challenge_responder)
-        ->OnAuthCredentials(net::AuthCredentials());
+    std::move(auth_challenge_responder)->OnAuthCredentials(base::nullopt);
     return;
   }