WEBDIENSTE/openswarm
1
0
Fork 0
mirror of https://github.com/openswarm-ai/openswarm.git synced 2026-08-24 13:32:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

[eric] browser: strip the Electron token from every request UA in the browser partition, so out-of-process sign-in iframes stop reading as an embedded browser (ENG-238)

Browse Source
This commit is contained in:
ciregenz
2026-08-11 02:44:22 -07:00
parent 6afa7a1a1d
commit c4ded9a3ab
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
electron/main.js
+6
View File
@@ -2242,6 +2242,12 @@ app.whenReady().then(async () => {
const lk = k.toLowerCase();
if (lk === 'sec-ch-ua' || lk === 'sec-ch-ua-full-version-list') {
headers[k] = addGoogleChromeBrand(headers[k]);
} else if (lk === 'user-agent' && /\bElectron\//i.test(headers[k]) && !borrowed) {
// The webview `useragent` attribute misses out-of-process iframes (Google's GSI sign-in
// button runs in one), which then send the DEFAULT UA carrying the Electron token, and
// Google refuses sign-in from an "embedded browser" (ENG-238, measured on pinterest.com).
// Stripping it at the header covers every frame, worker and process in the partition.
headers[k] = headers[k].replace(/\s*Electron\/\S+/i, '');
} else if (borrowed && lk === 'user-agent') {
const swapped = bareChromeUserAgent(headers[k]);
// Once per site: proof the swap actually fired, so "borrowed but still signed out" can be