feat: disable https://android.clients.google.com requests in Chromium app

[iTrooz]

Linked: #205

This PR removes the https://android.clients.google.com requests made by the Chromium interceptor

Credits: CybercentreCanada/kangooroo#43

Note that this PR isn't tested, because I didn't figure out yet how to run httptoolkit-server. But it was tested by running chromium locally with these flags (See #145 (comment))

[CLAassistant]

All committers have signed the CLA.

[pimterry]

Thanks @iTrooz! This is really interesting and I haven't investigated it before.

That said, while in general I'd like to disable noise like this, we can only do that where it's not related to actual functionality. In cases where Chrome really does make requests to support web functionality, we need to keep the requests there and the functionality working so you can test things and see the real traffic involved.

In this case, I think GCM is required to support web push. I don't know exactly how that works internally, but activating push notifications on https://simple-push-demo.vercel.app/ does seem to actively connect to and use this API. We need sites like this to work, so you can debug that scenario with a normal real-world setup.

[iTrooz]

Oh, that's interesting.
I can't go against your wishes, but I tried Burpsuite & Zap proxy before, and both of them disabled all built-in browsers requests (including push notifications)

As a user, I know it's a feature I'd look for in an intercepting proxy, because all my use cases are debugging an app's http calls, not the browser's.

Have you had cases of users wanted to intercept these requests ?

[iTrooz]

Here's a PR removing some noisy requests made by Firefox: #207

How do you feel about disabling search autocomplete requests like Burpsuite ?

[pimterry]

I can't go against your wishes, but I tried Burpsuite & Zap proxy before, and both of them disabled all built-in browsers requests (including push notifications)

I've just tested and Burpsuite doesn't set this option. Here's the full list for Burp's built-in browser on my machine (you can check in chrome://version):

.../BurpSuiteCommunity/burpbrowser/146.0.7680.177/chrome --disable-ipc-flooding-protection --disable-xss-auditor --disable-bundled-ppapi-flash --disable-plugins-discovery --disable-default-apps --disable-prerender-local-predictor --disable-breakpad --disable-crash-reporter --disable-prerender-local-predictor --disk-cache-size=0 --disable-settings-window --disable-notifications --disable-speech-api --disable-file-system --disable-presentation-api --disable-permissions-api --disable-new-zip-unpacker --disable-media-session-api --no-experiments --no-events --no-first-run --no-default-browser-check --no-pings --no-service-autorun --media-cache-size=0 --use-fake-device-for-media-stream --dbus-stub --disable-background-networking --disable-features=ChromeWhatsNewUI,HttpsUpgrades,ImageServiceObserveSyncDownloadStatus,LensOverlay,RenderDocument,SessionRestoreInfobar,TrackingProtection3pcd --proxy-server=localhost:8080 --proxy-bypass-list=<-loopback> --user-agent=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 --user-data-dir=.../.BurpSuite/pre-wired-browser --ignore-certificate-errors --load-extension=.../.BurpSuite/burp-chromium-extension --ozone-platform=x11 chrome://newtab

I'm open to quieter setups, but nothing that breaks any websites. I'm going to close this for now, I think in practice we do need GCM to be working.

[iTrooz]

I've just tested and Burpsuite doesn't set this option. Here's the full list for Burp's built-in browser on my machine (you can check in chrome://version):

Yeah it doesn't set them as flags, instead they are bundling a custom build of Chrome (their build does not log these calls, while the system with the same flags one does)

I think in practice we do need GCM to be working

Ok !