Commit fa4ae7e8 authored by Łukasz Anforowicz's avatar Łukasz Anforowicz Committed by Commit Bot

Revert "Document origin for neither-GET-no-HEAD request made by extensions"

This reverts commit 68e96adf.

Reason for revert: See https://crbug.com/966223#c28

Original change's description:
> Document origin for neither-GET-no-HEAD request made by extensions
> 
> Bug: 1036458, 966223
> Change-Id: Ia32c5256376bd7ead965b0ade24f48e76b35acb9
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1980655
> Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
> Reviewed-by: Łukasz Anforowicz <lukasza@chromium.org>
> Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#729209}

TBR=yhirano@chromium.org,rdevlin.cronin@chromium.org,lukasza@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: 1036458, 966223
Change-Id: Ib76bda52d3c173f9dd7140e408185b5820163f3c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2082607Reviewed-by: default avatarŁukasz Anforowicz <lukasza@chromium.org>
Reviewed-by: default avatarYutaka Hirano <yhirano@chromium.org>
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Cr-Commit-Position: refs/heads/master@{#746462}
parent 8d409070
......@@ -243,19 +243,3 @@ default policy doesn't restrict connections to hosts, be careful when explicitly
adding either the <code>connect-src</code> or <code>default-src</code>
directives.
</p>
<h2 id="origin-neither-GET-nor-HEAD">Origin header for requests with neither
GET nor HEAD methods</h2>
<p>A request with an HTTP method that is neither GET nor HEAD (such as POST)
always has an Origin header, regardless of whether the request is cross-origin.
<span class="availability">Starting from Chrome 80</span>, the origin of
the destination URL, not the extension's security origin, is attached to the
header if all of the following conditions are met:
<ul>
<li>The request is made in a frame with the extension's security origin, such as
the background page, the popup, or an extension tab.</li>
<li>The request has a method that is neither GET nor HEAD.</li>
<li>The extension has cross-origin permission to the destination URL.</li>
</ul>
</p>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment