EFForg/https-everywhere — pull request #29 by semenko (2013-12-27 21:10:39+00:00)
Title: Remove onHeadersReceived listener

(for issue #12)

The onHeadersReceived listener served one purpose:
Secure cookies set via HTTPS (not HTTP, not JS)

This task is already handled by:
- onBeforeSendHeaders (blocking) which should secure cookies
- onCookieChanged (non-blocking) which secures any cookies on create/update

Moreover, the current function is broken:
- We look for a case-sensitive "Set-Cookie," but many servers send only a
lowercase "set-cookie" (e.g. Google, Twitter, ...)
- "; Secure" is frequently not the end of the cookie (old #L192)

By removing this function, here's what happens for different cookie types:

- Set by HTTP
No change, wasn't ever handled by onHeadersReceived

- Set by Javascript
No change, wasn't ever handled by onHeadersReceived

- Set by HTTPS
Now (as before) secured by onCookieChanged (non-blocking, so maybe a tiny window for a race to steal the cookie, but ...)
Secured by onBeforeSendHeaders (blocking)

FWIW, this race is even described in onBeforeSendHeaders. I see no reason why onHeadersReceived was ever written. Maybe the chrome.cookies API was released later on?

Signed-off-by: Nick Semenkovich