From ed9fd6b3efdf87e9a8ef849ce7683d799d05287a Mon Sep 17 00:00:00 2001
From: Patrick Meenan <pmeenan@chromium.org>
Date: Wed, 03 Jun 2026 05:08:24 -0700
Subject: [PATCH] Update request parameters on prefetch redirect

When a prefetch loader is redirected, ensure that the underlying
ResourceRequest and its network anonymization key are updated using
the RedirectInfo.

Bug: 517607890
Change-Id: If5e75edbb4c3eed18264da7259d61f46e25358c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7888450
Commit-Queue: Patrick Meenan <pmeenan@chromium.org>
Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1640848}
---

diff --git a/content/browser/loader/prefetch_url_loader.cc b/content/browser/loader/prefetch_url_loader.cc
index 415957f..cb77523 100644
--- a/content/browser/loader/prefetch_url_loader.cc
+++ b/content/browser/loader/prefetch_url_loader.cc
@@ -212,10 +212,12 @@
             ->TakePrefetchedSignedExchangeCacheEntry());
   }
 
-  resource_request_.url = redirect_info.new_url;
-  resource_request_.site_for_cookies = redirect_info.new_site_for_cookies;
-  resource_request_.referrer = GURL(redirect_info.new_referrer);
-  resource_request_.referrer_policy = redirect_info.new_referrer_policy;
+  resource_request_.UpdateOnRedirect(redirect_info);
+  if (resource_request_.trusted_params) {
+    network_anonymization_key_ =
+        resource_request_.trusted_params->isolation_info
+            .network_anonymization_key();
+  }
   forwarding_client_->OnReceiveRedirect(redirect_info, std::move(head));
 }
 
diff --git a/content/browser/loader/prefetch_url_loader.h b/content/browser/loader/prefetch_url_loader.h
index 00b55ed..6755087 100644
--- a/content/browser/loader/prefetch_url_loader.h
+++ b/content/browser/loader/prefetch_url_loader.h
@@ -12,6 +12,7 @@
 #include "base/functional/callback.h"
 #include "base/unguessable_token.h"
 #include "content/browser/web_package/prefetched_signed_exchange_cache.h"
+#include "content/common/content_export.h"
 #include "content/public/browser/frame_tree_node_id.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
@@ -39,9 +40,9 @@
 
 // A URLLoader for loading a prefetch request, including <link rel="prefetch">.
 // It basically just keeps draining the data.
-class PrefetchURLLoader : public network::mojom::URLLoader,
-                          public network::mojom::URLLoaderClient,
-                          public mojo::DataPipeDrainer::Client {
+class CONTENT_EXPORT PrefetchURLLoader : public network::mojom::URLLoader,
+                                         public network::mojom::URLLoaderClient,
+                                         public mojo::DataPipeDrainer::Client {
  public:
   using URLLoaderThrottlesGetter = base::RepeatingCallback<
       std::vector<std::unique_ptr<blink::URLLoaderThrottle>>()>;
@@ -86,6 +87,14 @@
   void SendOnComplete(
       const network::URLLoaderCompletionStatus& completion_status);
 
+  const network::ResourceRequest& resource_request_for_testing() const {
+    return resource_request_;
+  }
+  const net::NetworkAnonymizationKey& network_anonymization_key_for_testing()
+      const {
+    return network_anonymization_key_;
+  }
+
  private:
   // network::mojom::URLLoader overrides:
   void FollowRedirect(
@@ -122,7 +131,7 @@
 
   network::mojom::URLResponseHeadPtr response_;
 
-  const net::NetworkAnonymizationKey network_anonymization_key_;
+  net::NetworkAnonymizationKey network_anonymization_key_;
 
   scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory_;
 
diff --git a/content/browser/loader/prefetch_url_loader_unittest.cc b/content/browser/loader/prefetch_url_loader_unittest.cc
new file mode 100644
index 0000000..b65ff600
--- /dev/null
+++ b/content/browser/loader/prefetch_url_loader_unittest.cc
@@ -0,0 +1,136 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/loader/prefetch_url_loader.h"
+
+#include <memory>
+#include <vector>
+
+#include "base/functional/bind.h"
+#include "base/unguessable_token.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/frame_tree_node_id.h"
+#include "content/public/test/test_renderer_host.h"
+#include "net/base/isolation_info.h"
+#include "net/base/load_flags.h"
+#include "net/base/network_anonymization_key.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
+#include "services/network/test/test_url_loader_client.h"
+#include "services/network/test/test_url_loader_factory.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/loader/url_loader_throttle.h"
+#include "url/gurl.h"
+#include "url/origin.h"
+
+namespace content {
+namespace {
+
+class PrefetchURLLoaderTest : public RenderViewHostTestHarness {
+ protected:
+  PrefetchURLLoaderTest() = default;
+  ~PrefetchURLLoaderTest() override = default;
+
+  void SetUp() override {
+    RenderViewHostTestHarness::SetUp();
+    test_shared_url_loader_factory_ =
+        base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
+            &test_url_loader_factory_);
+  }
+
+  network::TestURLLoaderFactory test_url_loader_factory_;
+  scoped_refptr<network::SharedURLLoaderFactory>
+      test_shared_url_loader_factory_;
+};
+
+TEST_F(PrefetchURLLoaderTest, RedirectIsolationInfoUpdate) {
+  // Initialize same-site resource request.
+  network::ResourceRequest request;
+  request.url = GURL("https://a.test/redirect");
+  request.method = "GET";
+  request.load_flags = net::LOAD_PREFETCH;
+
+  url::Origin referring_origin = url::Origin::Create(GURL("https://a.test"));
+  request.trusted_params = network::ResourceRequest::TrustedParams();
+  request.trusted_params->isolation_info = net::IsolationInfo::Create(
+      net::IsolationInfo::RequestType::kMainFrame, referring_origin,
+      referring_origin, net::SiteForCookies());
+
+  net::NetworkAnonymizationKey initial_nak =
+      request.trusted_params->isolation_info.network_anonymization_key();
+
+  network::TestURLLoaderClient forwarding_client;
+
+  auto prefetch_url_loader = std::make_unique<PrefetchURLLoader>(
+      /*request_id=*/0,
+      /*options=*/0,
+      /*frame_tree_node_id=*/main_rfh()->GetFrameTreeNodeId(), request,
+      initial_nak, forwarding_client.CreateRemote(),
+      net::MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS),
+      test_shared_url_loader_factory_, base::BindRepeating([]() {
+        return std::vector<std::unique_ptr<blink::URLLoaderThrottle>>();
+      }),
+      browser_context(),
+      /*prefetched_signed_exchange_cache=*/nullptr,
+      /*accept_langs=*/"", base::BindOnce([](const network::ResourceRequest&) {
+        return base::UnguessableToken::Create();
+      }));
+
+  // Verify initial request URL and IsolationInfo.
+  ASSERT_EQ(test_url_loader_factory_.NumPending(), 1);
+  auto* pending_req = test_url_loader_factory_.GetPendingRequest(0);
+  ASSERT_TRUE(pending_req);
+  EXPECT_EQ(pending_req->request.url, GURL("https://a.test/redirect"));
+
+  ASSERT_TRUE(pending_req->request.trusted_params.has_value());
+  EXPECT_EQ(
+      pending_req->request.trusted_params->isolation_info.top_frame_origin(),
+      referring_origin);
+  EXPECT_EQ(pending_req->request.trusted_params->isolation_info.frame_origin(),
+            referring_origin);
+
+  // Simulate redirect to cross-site target.
+  net::RedirectInfo redirect_info;
+  redirect_info.new_method = "GET";
+  redirect_info.new_referrer_policy =
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
+  redirect_info.new_url = GURL("https://b.test/target");
+
+  network::mojom::URLResponseHeadPtr redirect_head =
+      network::mojom::URLResponseHead::New();
+  redirect_head->headers =
+      net::HttpResponseHeaders::Builder(net::HttpVersion(1, 1), "302 Found")
+          .AddHeader("Location", redirect_info.new_url.spec())
+          .Build();

diff --git a/content/browser/loader/prefetch_url_loader_unittest.cc b/content/browser/loader/prefetch_url_loader_unittest.cc
new file mode 100644
index 0000000..b65ff600
--- /dev/null
+++ b/content/browser/loader/prefetch_url_loader_unittest.cc
@@ -0,0 +1,136 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/loader/prefetch_url_loader.h"
+
+#include <memory>
+#include <vector>
+
+#include "base/functional/bind.h"
+#include "base/unguessable_token.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/frame_tree_node_id.h"
+#include "content/public/test/test_renderer_host.h"
+#include "net/base/isolation_info.h"
+#include "net/base/load_flags.h"
+#include "net/base/network_anonymization_key.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
+#include "services/network/test/test_url_loader_client.h"
+#include "services/network/test/test_url_loader_factory.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/loader/url_loader_throttle.h"
+#include "url/gurl.h"
+#include "url/origin.h"
+
+namespace content {
+namespace {
+
+class PrefetchURLLoaderTest : public RenderViewHostTestHarness {
+ protected:
+  PrefetchURLLoaderTest() = default;
+  ~PrefetchURLLoaderTest() override = default;
+
+  void SetUp() override {
+    RenderViewHostTestHarness::SetUp();
+    test_shared_url_loader_factory_ =
+        base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
+            &test_url_loader_factory_);
+  }
+
+  network::TestURLLoaderFactory test_url_loader_factory_;
+  scoped_refptr<network::SharedURLLoaderFactory>
+      test_shared_url_loader_factory_;
+};
+
+TEST_F(PrefetchURLLoaderTest, RedirectIsolationInfoUpdate) {
+  // Initialize same-site resource request.
+  network::ResourceRequest request;
+  request.url = GURL("https://a.test/redirect");
+  request.method = "GET";
+  request.load_flags = net::LOAD_PREFETCH;
+
+  url::Origin referring_origin = url::Origin::Create(GURL("https://a.test"));
+  request.trusted_params = network::ResourceRequest::TrustedParams();
+  request.trusted_params->isolation_info = net::IsolationInfo::Create(
+      net::IsolationInfo::RequestType::kMainFrame, referring_origin,
+      referring_origin, net::SiteForCookies());
+
+  net::NetworkAnonymizationKey initial_nak =
+      request.trusted_params->isolation_info.network_anonymization_key();
+
+  network::TestURLLoaderClient forwarding_client;
+
+  auto prefetch_url_loader = std::make_unique<PrefetchURLLoader>(
+      /*request_id=*/0,
+      /*options=*/0,
+      /*frame_tree_node_id=*/main_rfh()->GetFrameTreeNodeId(), request,
+      initial_nak, forwarding_client.CreateRemote(),
+      net::MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS),
+      test_shared_url_loader_factory_, base::BindRepeating([]() {
+        return std::vector<std::unique_ptr<blink::URLLoaderThrottle>>();
+      }),
+      browser_context(),
+      /*prefetched_signed_exchange_cache=*/nullptr,
+      /*accept_langs=*/"", base::BindOnce([](const network::ResourceRequest&) {
+        return base::UnguessableToken::Create();
+      }));
+
+  // Verify initial request URL and IsolationInfo.
+  ASSERT_EQ(test_url_loader_factory_.NumPending(), 1);
+  auto* pending_req = test_url_loader_factory_.GetPendingRequest(0);
+  ASSERT_TRUE(pending_req);
+  EXPECT_EQ(pending_req->request.url, GURL("https://a.test/redirect"));
+
+  ASSERT_TRUE(pending_req->request.trusted_params.has_value());
+  EXPECT_EQ(
+      pending_req->request.trusted_params->isolation_info.top_frame_origin(),
+      referring_origin);
+  EXPECT_EQ(pending_req->request.trusted_params->isolation_info.frame_origin(),
+            referring_origin);
+
+  // Simulate redirect to cross-site target.
+  net::RedirectInfo redirect_info;
+  redirect_info.new_method = "GET";
+  redirect_info.new_referrer_policy =
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
+  redirect_info.new_url = GURL("https://b.test/target");
+
+  network::mojom::URLResponseHeadPtr redirect_head =
+      network::mojom::URLResponseHead::New();
+  redirect_head->headers =
+      net::HttpResponseHeaders::Builder(net::HttpVersion(1, 1), "302 Found")
+          .AddHeader("Location", redirect_info.new_url.spec())
+          .Build();
+
+  pending_req->client->OnReceiveRedirect(redirect_info,
+                                         std::move(redirect_head));
+  forwarding_client.RunUntilRedirectReceived();
+
+  // Verify updated IsolationInfo.
+  const network::ResourceRequest& updated_request =
+      prefetch_url_loader->resource_request_for_testing();
+  EXPECT_EQ(updated_request.url, GURL("https://b.test/target"));
+  ASSERT_TRUE(updated_request.trusted_params.has_value());
+
+  url::Origin expected_target_origin =
+      url::Origin::Create(GURL("https://b.test"));
+
+  EXPECT_EQ(updated_request.trusted_params->isolation_info.top_frame_origin(),
+            expected_target_origin);
+  EXPECT_EQ(updated_request.trusted_params->isolation_info.frame_origin(),
+            expected_target_origin);
+
+  // Verify updated NAK matches cross-site target NAK.
+  net::NetworkAnonymizationKey expected_nak =
+      updated_request.trusted_params->isolation_info
+          .network_anonymization_key();
+
+  EXPECT_EQ(prefetch_url_loader->network_anonymization_key_for_testing(),
+            expected_nak);
+}
+
+}  // namespace
+}  // namespace content
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 7967a34..97831ce 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -2787,6 +2787,7 @@
     "../browser/loader/navigation_early_hints_manager_unittest.cc",
     "../browser/loader/navigation_url_loader_impl_unittest.cc",
     "../browser/loader/navigation_url_loader_unittest.cc",
+    "../browser/loader/prefetch_url_loader_unittest.cc",
     "../browser/locks/lock_manager_unittest.cc",
     "../browser/manifest/manifest_icon_downloader_unittest.cc",
     "../browser/media/audible_metrics_unittest.cc",