CEF3: OnBeforeNavigation never detects redirects

[dreijer]

My CEF3 (1138) browser is navigating to a location that redirects to a different URL (on the same domain). I get the callback for the second navigation in CefRenderProcessHandler::OnBeforeNavigation, but the 'is_redirect' parameter is always false. I see the same behavior in the cefclient test application.

Is this a bug or am I supposed to be looking elsewhere to detect this?

[magreenblatt]

The OnBeforeNavigation() callback comes from RenderViewImpl::decidePolicyForNavigation(). The |is_redirect| flag originates from WebDataSourceImpl::isRedirect().

Sounds like your problem may be related to https://code.google.com/p/chromiumembed ... ail?id=844.

[dreijer]

Uhoh, so there's no way of determining redirects at all currently?

[magreenblatt]

Uhoh, so there's no way of determining redirects at all currently?

You should be able to determine them at the network layer via CefRequestHandler::OnResourceRedirect().

[dreijer]

You should be able to determine them at the network layer via CefRequestHandler::OnResourceRedirect().

Hmm, so I'm not sure if that's going to work for me or not. I'm using CefRenderProcessHandler::OnBeforeNavigation to cover the scenario we talked about here: viewtopic.php?f=6&t=10394

Basically, I need to be able to catch the navigation request and determine if it's allowed or not. The redirect flag is a big part of that since in most cases I'm hitting up a preset URL, which I explicitly allow navigation to, and then that redirects me to a different URL that I know nothing about and thus cannot validate, but I know the navigation is allowed because it's simply a redirect from a "trusted" page.

How would I go about achieving this?

[magreenblatt]

Why should a redirect from a "trusted" page to an "untrusted" page be allowed when visiting that "untrusted" page directly from the original "trusted" page would be disallowed? Sounds like faulty logic to me. You should probably either trust the redirect page as well or disallow the redirect.

[dreijer]

The browser navigates to a trusted page with a predefined URL on our server. Our server then redirects to the actual page I'm supposed to be showing in the browser. I don't know what that actual page is, so I can't explicitly validate it. That is, I just allow the redirect because I know it came from the original navigation I allowed.

On the other hand, I want to explicitly disallow the user from navigating to any page he wants.

So in short, I have a list of allowed URLs and I'm allowing redirects from those pages, but nothing else.

[magreenblatt]

Unfortunately I don't have a great solution for you. You'll have to track the redirect state in your application somehow. Maybe if you're lucky the 'Referer' header will be set correctly on the redirect requests.

[dreijer]

Unfortunately I don't have a great solution for you. You'll have to track the redirect state in your application somehow. Maybe if you're lucky the 'Referer' header will be set correctly on the redirect requests.

Yeah, that's what I thought. I really just need the actual Chromium bug fix for the redirect parameter to be set properly. Do you know if it's anywhere on anybody's radar over at Chromium HQ? Or who I can give a big kiss to fix it?

[magreenblatt]

You can submit a patch for the WebKit issue. That's about it.