Disable 3p dynamic HSTS | Expect-CT | PKP headers

[jumde]

Description:

Headers like "Strict-Transport-Security", "Expect-CT", "Public-Key-Pins", "Public-Key-Pins-Report-Only" can be used for fingerprinting in 3p context.

For more info: brave/brave-browser#3419

Repro steps:

1. Disable HTTPS Everywhere
2. Navigate to https://jsfiddle.net/x5mqb807/ - This loads content from avatars2.githubusercontent.com which sets the Strict-Transport-Security header.

[tildelowengrimm]

Is the solution that we'll remember headers set by third parties but only apply them to first parties, or that we'd only remember or apply when the site is a first party?

[jumde]

See: brave/browser-laptop#12223 (comment)

[ShivanKaul]

Public Key Pins and Expect-CT are deprecated headers, and for HSTS, we follow Safari which does partition the HSTS cache.