Get rid of net::DO_NOT_PROMPT_FOR_LOGIN

Used only in content layer

BUG=426442

Review URL: https://codereview.chromium.org/786423002

Cr-Commit-Position: refs/heads/master@{#311665}

26 files changed, 88 insertions, 65 deletions

diff --git a/chrome/browser/extensions/api/downloads/downloads_api.cc b/chrome/browser/extensions/api/downloads/downloads_api.cc
index 174ee78..ae841dc 100644
--- a/chrome/browser/extensions/api/downloads/downloads_api.cc
+++ b/chrome/browser/extensions/api/downloads/downloads_api.cc
@@ -1012,7 +1012,7 @@ bool DownloadsDownloadFunction::RunAsync() {
       &DownloadsDownloadFunction::OnStarted, this,
       creator_suggested_filename, options.conflict_action));
   // Prevent login prompts for 401/407 responses.
-  download_params->set_load_flags(net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
+  download_params->set_do_not_prompt_for_login(true);
 
   DownloadManager* manager = BrowserContext::GetDownloadManager(
       current_profile);
diff --git a/components/captive_portal/captive_portal_detector.cc b/components/captive_portal/captive_portal_detector.cc
index c9b8408..b7b8668 100644
--- a/components/captive_portal/captive_portal_detector.cc
+++ b/components/captive_portal/captive_portal_detector.cc
@@ -45,7 +45,6 @@ void CaptivePortalDetector::DetectCaptivePortal(
   // since then the connection may be reused without checking the cert.
   url_fetcher_->SetLoadFlags(
       net::LOAD_BYPASS_CACHE |
-      net::LOAD_DO_NOT_PROMPT_FOR_LOGIN |
       net::LOAD_DO_NOT_SAVE_COOKIES |
       net::LOAD_DO_NOT_SEND_COOKIES |
       net::LOAD_DO_NOT_SEND_AUTH_DATA);
diff --git a/components/password_manager/core/browser/affiliation_fetcher.cc b/components/password_manager/core/browser/affiliation_fetcher.cc
index 807379a..a1b4972 100644
--- a/components/password_manager/core/browser/affiliation_fetcher.cc
+++ b/components/password_manager/core/browser/affiliation_fetcher.cc
@@ -49,7 +49,7 @@ void AffiliationFetcher::StartRequest() {
   fetcher_->SetLoadFlags(
       net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES |
       net::LOAD_DO_NOT_SEND_AUTH_DATA | net::LOAD_BYPASS_CACHE |
-      net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
+      net::LOAD_DISABLE_CACHE);
   fetcher_->SetAutomaticallyRetryOn5xx(false);
   fetcher_->SetAutomaticallyRetryOnNetworkChanges(0);
   fetcher_->Start();
diff --git a/components/precache/core/precache_fetcher.cc b/components/precache/core/precache_fetcher.cc
index c854af8..49f84a2 100644
--- a/components/precache/core/precache_fetcher.cc
+++ b/components/precache/core/precache_fetcher.cc
@@ -123,7 +123,6 @@ PrecacheFetcher::Fetcher::Fetcher(
     : callback_(callback) {
   url_fetcher_.reset(URLFetcher::Create(url, URLFetcher::GET, this));
   url_fetcher_->SetRequestContext(request_context);
-  url_fetcher_->SetLoadFlags(net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
   url_fetcher_->Start();
 }
 
diff --git a/content/browser/download/download_manager_impl.cc b/content/browser/download/download_manager_impl.cc
index 70a51fa..f058c25 100644
--- a/content/browser/download/download_manager_impl.cc
+++ b/content/browser/download/download_manager_impl.cc
@@ -57,7 +57,6 @@ void BeginDownload(scoped_ptr<DownloadUrlParameters> params,
   scoped_ptr<net::URLRequest> request(
       params->resource_context()->GetRequestContext()->CreateRequest(
           params->url(), net::DEFAULT_PRIORITY, NULL, NULL));
-  request->SetLoadFlags(request->load_flags() | params->load_flags());
   request->set_method(params->method());
   if (!params->post_body().empty()) {
     const std::string& body = params->post_body();
@@ -129,6 +128,7 @@ void BeginDownload(scoped_ptr<DownloadUrlParameters> params,
       params->render_process_host_id(),
       params->render_view_host_routing_id(),
       params->prefer_cache(),
+      params->do_not_prompt_for_login(),
       save_info.Pass(),
       download_id,
       params->callback());
diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc
index 16393d1..31a53f7 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.cc
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc
@@ -595,6 +595,7 @@ DownloadInterruptReason ResourceDispatcherHostImpl::BeginDownload(
     int child_id,
     int route_id,
     bool prefer_cache,
+    bool do_not_prompt_for_login,
     scoped_ptr<DownloadSaveInfo> save_info,
     uint32 download_id,
     const DownloadStartedCallback& started_callback) {
@@ -657,6 +658,7 @@ DownloadInterruptReason ResourceDispatcherHostImpl::BeginDownload(
 
   ResourceRequestInfoImpl* extra_info =
       CreateRequestInfo(child_id, route_id, true, context);
+  extra_info->set_do_not_prompt_for_login(do_not_prompt_for_login);
   extra_info->AssociateWithRequest(request.get());  // Request takes ownership.
 
   if (request->url().SchemeIs(url::kBlobScheme)) {
@@ -1150,19 +1152,6 @@ void ResourceDispatcherHostImpl::BeginRequest(
     return;
   }
 
-  bool is_sync_load = sync_result != NULL;
-  int load_flags =
-      BuildLoadFlagsForRequest(request_data, child_id, is_sync_load);
-
-  // Sync loads should have maximum priority and should be the only
-  // requets that have the ignore limits flag set.
-  if (is_sync_load) {
-    DCHECK_EQ(request_data.priority, net::MAXIMUM_PRIORITY);
-    DCHECK_NE(load_flags & net::LOAD_IGNORE_LIMITS, 0);
-  } else {
-    DCHECK_EQ(load_flags & net::LOAD_IGNORE_LIMITS, 0);
-  }
-
   // Construct the request.
   net::CookieStore* cookie_store =
       GetContentClient()->browser()->OverrideCookieStoreForRenderProcess(
@@ -1189,8 +1178,6 @@ void ResourceDispatcherHostImpl::BeginRequest(
   headers.AddHeadersFromString(request_data.headers);
   new_request->SetExtraRequestHeaders(headers);
 
-  new_request->SetLoadFlags(load_flags);
-
   storage::BlobStorageContext* blob_context =
       GetBlobStorageContext(filter_->blob_storage_context());
   // Resolve elements from request_body and prepare upload data.
@@ -1216,6 +1203,39 @@ void ResourceDispatcherHostImpl::BeginRequest(
 
   bool allow_download = request_data.allow_download &&
       IsResourceTypeFrame(request_data.resource_type);
+  bool do_not_prompt_for_login = request_data.do_not_prompt_for_login;
+  bool is_sync_load = sync_result != NULL;
+  int load_flags =
+      BuildLoadFlagsForRequest(request_data, child_id, is_sync_load);
+  if (request_data.resource_type == RESOURCE_TYPE_PREFETCH ||
+      request_data.resource_type == RESOURCE_TYPE_FAVICON) {
+    do_not_prompt_for_login = true;
+  }
+  if (request_data.resource_type == RESOURCE_TYPE_IMAGE &&
+      HTTP_AUTH_RELATION_BLOCKED_CROSS ==
+          HttpAuthRelationTypeOf(request_data.url,
+                                 request_data.first_party_for_cookies)) {
+    // Prevent third-party image content from prompting for login, as this
+    // is often a scam to extract credentials for another domain from the user.
+    // Only block image loads, as the attack applies largely to the "src"
+    // property of the <img> tag. It is common for web properties to allow
+    // untrusted values for <img src>; this is considered a fair thing for an
+    // HTML sanitizer to do. Conversely, any HTML sanitizer that didn't
+    // filter sources for <script>, <link>, <embed>, <object>, <iframe> tags
+    // would be considered vulnerable in and of itself.
+    do_not_prompt_for_login = true;
+    load_flags |= net::LOAD_DO_NOT_USE_EMBEDDED_IDENTITY;
+  }
+
+  // Sync loads should have maximum priority and should be the only
+  // requets that have the ignore limits flag set.
+  if (is_sync_load) {
+    DCHECK_EQ(request_data.priority, net::MAXIMUM_PRIORITY);
+    DCHECK_NE(load_flags & net::LOAD_IGNORE_LIMITS, 0);
+  } else {
+    DCHECK_EQ(load_flags & net::LOAD_IGNORE_LIMITS, 0);
+  }
+  new_request->SetLoadFlags(load_flags);
 
   // Make extra info and read footer (contains request ID).
   ResourceRequestInfoImpl* extra_info =
@@ -1238,6 +1258,7 @@ void ResourceDispatcherHostImpl::BeginRequest(
           request_data.has_user_gesture,
           request_data.enable_load_timing,
           request_data.enable_upload_progress,
+          do_not_prompt_for_login,
           request_data.referrer_policy,
           request_data.visiblity_state,
           resource_context,
@@ -1481,9 +1502,9 @@ ResourceRequestInfoImpl* ResourceDispatcherHostImpl::CreateRequestInfo(
       0,
       request_id_,
       MSG_ROUTING_NONE,  // render_frame_id
-      false,     // is_main_frame
-      false,     // parent_is_main_frame
-      -1,        // parent_render_frame_id
+      false,             // is_main_frame
+      false,             // parent_is_main_frame
+      -1,                // parent_render_frame_id
       RESOURCE_TYPE_SUB_RESOURCE,
       ui::PAGE_TRANSITION_LINK,
       false,     // should_replace_current_entry
@@ -1493,6 +1514,7 @@ ResourceRequestInfoImpl* ResourceDispatcherHostImpl::CreateRequestInfo(
       false,     // has_user_gesture
       false,     // enable_load_timing
       false,     // enable_upload_progress
+      false,     // do_not_prompt_for_login
       blink::WebReferrerPolicyDefault,
       blink::WebPageVisibilityStateVisible,
       context,
@@ -1947,6 +1969,7 @@ void ResourceDispatcherHostImpl::BeginNavigationRequest(
           info.navigation_params.has_user_gesture,
           true,   // enable_load_timing
           false,  // enable_upload_progress
+          false,  // do_not_prompt_for_login
           params.referrer.policy,
           // TODO(davidben): This is only used for prerenders. Replace
           // is_showing with something for that. Or maybe it just comes from the
@@ -2321,24 +2344,7 @@ int ResourceDispatcherHostImpl::BuildLoadFlagsForRequest(
   } else if (request_data.resource_type == RESOURCE_TYPE_SUB_FRAME) {
     load_flags |= net::LOAD_SUB_FRAME;
   } else if (request_data.resource_type == RESOURCE_TYPE_PREFETCH) {
-    load_flags |= (net::LOAD_PREFETCH | net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
-  } else if (request_data.resource_type == RESOURCE_TYPE_FAVICON) {
-    load_flags |= net::LOAD_DO_NOT_PROMPT_FOR_LOGIN;
-  } else if (request_data.resource_type == RESOURCE_TYPE_IMAGE) {
-    // Prevent third-party image content from prompting for login, as this
-    // is often a scam to extract credentials for another domain from the user.
-    // Only block image loads, as the attack applies largely to the "src"
-    // property of the <img> tag. It is common for web properties to allow
-    // untrusted values for <img src>; this is considered a fair thing for an
-    // HTML sanitizer to do. Conversely, any HTML sanitizer that didn't
-    // filter sources for <script>, <link>, <embed>, <object>, <iframe> tags
-    // would be considered vulnerable in and of itself.
-    HttpAuthRelationType relation_type = HttpAuthRelationTypeOf(
-        request_data.url, request_data.first_party_for_cookies);
-    if (relation_type == HTTP_AUTH_RELATION_BLOCKED_CROSS) {
-      load_flags |= (net::LOAD_DO_NOT_USE_EMBEDDED_IDENTITY |
-                     net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
-    }
+    load_flags |= net::LOAD_PREFETCH;
   }
 
   if (is_sync_load)
diff --git a/content/browser/loader/resource_dispatcher_host_impl.h b/content/browser/loader/resource_dispatcher_host_impl.h
index a2631a2..34d02a3 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.h
+++ b/content/browser/loader/resource_dispatcher_host_impl.h
@@ -90,6 +90,7 @@ class CONTENT_EXPORT ResourceDispatcherHostImpl
       int child_id,
       int route_id,
       bool prefer_cache,
+      bool do_not_prompt_for_login,
       scoped_ptr<DownloadSaveInfo> save_info,
       uint32 download_id,
       const DownloadStartedCallback& started_callback) override;
diff --git a/content/browser/loader/resource_loader.cc b/content/browser/loader/resource_loader.cc
index ef7759d..b462a68 100644
--- a/content/browser/loader/resource_loader.cc
+++ b/content/browser/loader/resource_loader.cc
@@ -281,7 +281,8 @@ void ResourceLoader::OnAuthRequired(net::URLRequest* unused,
                                     net::AuthChallengeInfo* auth_info) {
   DCHECK_EQ(request_.get(), unused);
 
-  if (request_->load_flags() & net::LOAD_DO_NOT_PROMPT_FOR_LOGIN) {
+  ResourceRequestInfoImpl* info = GetRequestInfo();
+  if (info->do_not_prompt_for_login()) {
     request_->CancelAuth();
     return;
   }
diff --git a/content/browser/loader/resource_request_info_impl.cc b/content/browser/loader/resource_request_info_impl.cc
index 72f09f1..be8ffa0 100644
--- a/content/browser/loader/resource_request_info_impl.cc
+++ b/content/browser/loader/resource_request_info_impl.cc
@@ -61,6 +61,7 @@ void ResourceRequestInfo::AllocateForTesting(net::URLRequest* request,
           false,                             // has_user_gesture
           false,                             // enable load timing
           false,                             // enable upload progress
+          false,                             // do_not_prompt_for_login
           blink::WebReferrerPolicyDefault,   // referrer_policy
           blink::WebPageVisibilityStateVisible,  // visibility_state
           context,                           // context
@@ -117,6 +118,7 @@ ResourceRequestInfoImpl::ResourceRequestInfoImpl(
     bool has_user_gesture,
     bool enable_load_timing,
     bool enable_upload_progress,
+    bool do_not_prompt_for_login,
     blink::WebReferrerPolicy referrer_policy,
     blink::WebPageVisibilityState visibility_state,
     ResourceContext* context,
@@ -140,6 +142,7 @@ ResourceRequestInfoImpl::ResourceRequestInfoImpl(
       has_user_gesture_(has_user_gesture),
       enable_load_timing_(enable_load_timing),
       enable_upload_progress_(enable_upload_progress),
+      do_not_prompt_for_login_(do_not_prompt_for_login),
       was_ignored_by_handler_(false),
       counted_as_in_flight_request_(false),
       resource_type_(resource_type),
diff --git a/content/browser/loader/resource_request_info_impl.h b/content/browser/loader/resource_request_info_impl.h
index 6b75fcd..29f0d71 100644
--- a/content/browser/loader/resource_request_info_impl.h
+++ b/content/browser/loader/resource_request_info_impl.h
@@ -58,6 +58,7 @@ class ResourceRequestInfoImpl : public ResourceRequestInfo,
       bool has_user_gesture,
       bool enable_load_timing,
       bool enable_upload_progress,
+      bool do_not_prompt_for_login,
       blink::WebReferrerPolicy referrer_policy,
       blink::WebPageVisibilityState visibility_state,
       ResourceContext* context,
@@ -167,6 +168,11 @@ class ResourceRequestInfoImpl : public ResourceRequestInfo,
 
   bool is_upload_progress_enabled() const { return enable_upload_progress_; }
 
+  bool do_not_prompt_for_login() const { return do_not_prompt_for_login_; }
+  void set_do_not_prompt_for_login(bool do_not_prompt) {
+    do_not_prompt_for_login_ = do_not_prompt;
+  }
+
  private:
   FRIEND_TEST_ALL_PREFIXES(ResourceDispatcherHostTest,
                            DeletedFilterDetached);
@@ -192,6 +198,7 @@ class ResourceRequestInfoImpl : public ResourceRequestInfo,
   bool has_user_gesture_;
   bool enable_load_timing_;
   bool enable_upload_progress_;
+  bool do_not_prompt_for_login_;
   bool was_ignored_by_handler_;
   bool counted_as_in_flight_request_;
   ResourceType resource_type_;
diff --git a/content/browser/loader/resource_scheduler_unittest.cc b/content/browser/loader/resource_scheduler_unittest.cc
index b5c4681..2847fbf 100644
--- a/content/browser/loader/resource_scheduler_unittest.cc
+++ b/content/browser/loader/resource_scheduler_unittest.cc
@@ -191,6 +191,7 @@ class ResourceSchedulerTest : public testing::Test {
         false,                                   // has_user_gesture
         false,                                   // enable_load_timing
         false,                                   // enable_upload_progress
+        false,                                   // do_not_prompt_for_login
         blink::WebReferrerPolicyDefault,         // referrer_policy
         blink::WebPageVisibilityStateVisible,    // visibility_state
         NULL,                                    // context
diff --git a/content/browser/renderer_host/render_message_filter.cc b/content/browser/renderer_host/render_message_filter.cc
index 449afb4..30f33eb 100644
--- a/content/browser/renderer_host/render_message_filter.cc
+++ b/content/browser/renderer_host/render_message_filter.cc
@@ -871,6 +871,7 @@ void RenderMessageFilter::DownloadUrl(int render_view_id,
       render_process_id_,
       render_view_id,
       false,
+      false,
       save_info.Pass(),
       DownloadItem::kInvalidId,
       ResourceDispatcherHostImpl::DownloadStartedCallback());
diff --git a/content/child/request_info.cc b/content/child/request_info.cc
index f402405..3718923 100644
--- a/content/child/request_info.cc
+++ b/content/child/request_info.cc
@@ -24,6 +24,7 @@ RequestInfo::RequestInfo()
       fetch_credentials_mode(FETCH_CREDENTIALS_MODE_OMIT),
       enable_load_timing(false),
       enable_upload_progress(false),
+      do_not_prompt_for_login(false),
       extra_data(NULL) {
 }
 
diff --git a/content/child/request_info.h b/content/child/request_info.h
index b26e874..feb3437 100644
--- a/content/child/request_info.h
+++ b/content/child/request_info.h
@@ -96,6 +96,10 @@ struct CONTENT_EXPORT RequestInfo {
   // True if upload progress should be available.
   bool enable_upload_progress;
 
+  // True if login prompts for this request should be supressed. Cached
+  // credentials or default credentials may still be used for authentication.
+  bool do_not_prompt_for_login;
+
   // Extra data associated with this request.  We do not own this pointer.
   blink::WebURLRequest::ExtraData* extra_data;
 
diff --git a/content/child/resource_dispatcher.cc b/content/child/resource_dispatcher.cc
index 7cbc7fa..40b955c 100644
--- a/content/child/resource_dispatcher.cc
+++ b/content/child/resource_dispatcher.cc
@@ -136,6 +136,7 @@ IPCResourceLoaderBridge::IPCResourceLoaderBridge(
   request_.fetch_frame_type = request_info.fetch_frame_type;
   request_.enable_load_timing = request_info.enable_load_timing;
   request_.enable_upload_progress = request_info.enable_upload_progress;
+  request_.do_not_prompt_for_login = request_info.do_not_prompt_for_login;
 
   if ((request_info.referrer.policy == blink::WebReferrerPolicyDefault ||
        request_info.referrer.policy ==
diff --git a/content/child/web_url_loader_impl.cc b/content/child/web_url_loader_impl.cc
index 4e79dd5..59574b3 100644
--- a/content/child/web_url_loader_impl.cc
+++ b/content/child/web_url_loader_impl.cc
@@ -486,6 +486,10 @@ void WebURLLoaderImpl::Context::Start(const WebURLRequest& request,
   request_info.load_flags = GetLoadFlagsForWebURLRequest(request);
   request_info.enable_load_timing = true;
   request_info.enable_upload_progress = request.reportUploadProgress();
+  if (request.requestContext() == WebURLRequest::RequestContextXMLHttpRequest &&
+      (url.has_username() || url.has_password())) {
+    request_info.do_not_prompt_for_login = true;
+  }
   // requestor_pid only needs to be non-zero if the request originates outside
   // the render process, so we can use requestorProcessID even for requests
   // from in-process plugins.
diff --git a/content/child/web_url_request_util.cc b/content/child/web_url_request_util.cc
index 60a0f9a..145537e 100644
--- a/content/child/web_url_request_util.cc
+++ b/content/child/web_url_request_util.cc
@@ -209,10 +209,6 @@ int GetLoadFlagsForWebURLRequest(const blink::WebURLRequest& request) {
   if (!request.allowStoredCredentials())
     load_flags |= net::LOAD_DO_NOT_SEND_AUTH_DATA;
 
-  if (request.requestContext() == WebURLRequest::RequestContextXMLHttpRequest &&
-      (url.has_username() || url.has_password())) {
-    load_flags |= net::LOAD_DO_NOT_PROMPT_FOR_LOGIN;
-  }
   return load_flags;
 }
 
diff --git a/content/common/resource_messages.h b/content/common/resource_messages.h
index 3abea07..a57ef17 100644
--- a/content/common/resource_messages.h
+++ b/content/common/resource_messages.h
@@ -231,6 +231,9 @@ IPC_STRUCT_BEGIN(ResourceHostMsg_Request)
   // True if upload progress should be available for request.
   IPC_STRUCT_MEMBER(bool, enable_upload_progress)
 
+  // True if login prompts for this request should be supressed.
+  IPC_STRUCT_MEMBER(bool, do_not_prompt_for_login)
+
   // The routing id of the RenderFrame.
   IPC_STRUCT_MEMBER(int, render_frame_id)
 
diff --git a/content/public/browser/download_url_parameters.cc b/content/public/browser/download_url_parameters.cc
index d604a4d..e7c6328 100644
--- a/content/public/browser/download_url_parameters.cc
+++ b/content/public/browser/download_url_parameters.cc
@@ -20,14 +20,14 @@ DownloadUrlParameters::DownloadUrlParameters(
     int render_view_host_routing_id,
     ResourceContext* resource_context)
     : content_initiated_(false),
-      load_flags_(0),
       method_("GET"),
       post_id_(-1),
       prefer_cache_(false),
       render_process_host_id_(render_process_host_id),
       render_view_host_routing_id_(render_view_host_routing_id),
       resource_context_(resource_context),
-      url_(url) {
+      url_(url),
+      do_not_prompt_for_login_(false) {
 }
 
 DownloadUrlParameters::~DownloadUrlParameters() {
diff --git a/content/public/browser/download_url_parameters.h b/content/public/browser/download_url_parameters.h
index cf2d63ed..bc5dfd3 100644
--- a/content/public/browser/download_url_parameters.h
+++ b/content/public/browser/download_url_parameters.h
@@ -67,7 +67,6 @@ class CONTENT_EXPORT DownloadUrlParameters {
   void set_referrer_encoding(const std::string& referrer_encoding) {
     referrer_encoding_ = referrer_encoding;
   }
-  void set_load_flags(int load_flags) { load_flags_ |= load_flags; }
   void set_last_modified(const std::string& last_modified) {
     last_modified_ = last_modified;
   }
@@ -101,10 +100,12 @@ class CONTENT_EXPORT DownloadUrlParameters {
   void set_file(base::File file) {
     save_info_.file = file.Pass();
   }
+  void set_do_not_prompt_for_login(bool do_not_prompt) {
+    do_not_prompt_for_login_ = do_not_prompt;
+  }
 
   const OnStartedCallback& callback() const { return callback_; }
   bool content_initiated() const { return content_initiated_; }
-  int load_flags() const { return load_flags_; }
   const std::string& last_modified() const { return last_modified_; }
   const std::string& etag() const { return etag_; }
   const std::string& method() const { return method_; }
@@ -134,6 +135,7 @@ class CONTENT_EXPORT DownloadUrlParameters {
   const std::string& hash_state() const { return save_info_.hash_state; }
   bool prompt() const { return save_info_.prompt_for_save_location; }
   const GURL& url() const { return url_; }
+  bool do_not_prompt_for_login() const { return do_not_prompt_for_login_; }
 
   // Note that this is state changing--the DownloadUrlParameters object
   // will not have a file attached to it after this call.
@@ -143,7 +145,6 @@ class CONTENT_EXPORT DownloadUrlParameters {
   OnStartedCallback callback_;
   bool content_initiated_;
   RequestHeadersType request_headers_;
-  int load_flags_;
   std::string last_modified_;
   std::string etag_;
   std::string method_;
@@ -157,6 +158,7 @@ class CONTENT_EXPORT DownloadUrlParameters {
   ResourceContext* resource_context_;
   DownloadSaveInfo save_info_;
   GURL url_;
+  bool do_not_prompt_for_login_;
 
   DISALLOW_COPY_AND_ASSIGN(DownloadUrlParameters);
 };
diff --git a/content/public/browser/resource_dispatcher_host.h b/content/public/browser/resource_dispatcher_host.h
index 7db278c..3625abb 100644
--- a/content/public/browser/resource_dispatcher_host.h
+++ b/content/public/browser/resource_dispatcher_host.h
@@ -55,6 +55,7 @@ class CONTENT_EXPORT ResourceDispatcherHost {
       int child_id,
       int route_id,
       bool prefer_cache,
+      bool do_not_prompt_for_login,
       scoped_ptr<DownloadSaveInfo> save_info,
       uint32 download_id,
       const DownloadStartedCallback& started_callback) = 0;
diff --git a/ios/chrome/browser/net/image_fetcher.mm b/ios/chrome/browser/net/image_fetcher.mm
index 1434f77..89f59c7 100644
--- a/ios/chrome/browser/net/image_fetcher.mm
+++ b/ios/chrome/browser/net/image_fetcher.mm
@@ -89,7 +89,7 @@ void ImageFetcher::StartDownload(
   downloads_in_progress_[fetcher] = [callback copy];
   fetcher->SetLoadFlags(
       net::LOAD_DO_NOT_SEND_COOKIES | net::LOAD_DO_NOT_SAVE_COOKIES |
-      net::LOAD_DO_NOT_SEND_AUTH_DATA | net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
+      net::LOAD_DO_NOT_SEND_AUTH_DATA);
   fetcher->SetRequestContext(request_context_getter_.get());
   fetcher->SetReferrer(referrer);
   fetcher->SetReferrerPolicy(referrer_policy);
diff --git a/net/base/load_flags_list.h b/net/base/load_flags_list.h
index 2754326..7508287 100644
--- a/net/base/load_flags_list.h
+++ b/net/base/load_flags_list.h
@@ -101,23 +101,19 @@ LOAD_FLAG(PREFETCH, 1 << 21)
 // immediately.
 LOAD_FLAG(IGNORE_LIMITS, 1 << 22)
 
-// Suppress login prompts for this request. Cached credentials or
-// default credentials may still be used for authentication.
-LOAD_FLAG(DO_NOT_PROMPT_FOR_LOGIN, 1 << 23)
-
 // Indicates that the operation is somewhat likely to be due to an
 // explicit user action. This can be used as a hint to treat the
 // request with higher priority.
-LOAD_FLAG(MAYBE_USER_GESTURE, 1 << 24)
+LOAD_FLAG(MAYBE_USER_GESTURE, 1 << 23)
 
 // Indicates that the username:password portion of the URL should not
 // be honored, but that other forms of authority may be used.
-LOAD_FLAG(DO_NOT_USE_EMBEDDED_IDENTITY, 1 << 25)
+LOAD_FLAG(DO_NOT_USE_EMBEDDED_IDENTITY, 1 << 24)
 
 // Send request directly to the origin if the effective proxy is the data
 // reduction proxy.
 // TODO(rcs): Remove this flag as soon as http://crbug.com/339237 is resolved.
-LOAD_FLAG(BYPASS_DATA_REDUCTION_PROXY, 1 << 26)
+LOAD_FLAG(BYPASS_DATA_REDUCTION_PROXY, 1 << 25)
 
 // Indicates the the request is an asynchronous revalidation.
-LOAD_FLAG(ASYNC_REVALIDATION, 1 << 27)
+LOAD_FLAG(ASYNC_REVALIDATION, 1 << 26)
diff --git a/net/websockets/websocket_handshake_stream_create_helper_test.cc b/net/websockets/websocket_handshake_stream_create_helper_test.cc
index 5dff5cf..512de24 100644
--- a/net/websockets/websocket_handshake_stream_create_helper_test.cc
+++ b/net/websockets/websocket_handshake_stream_create_helper_test.cc
@@ -105,7 +105,7 @@ class WebSocketHandshakeStreamCreateHelperTest : public ::testing::Test {
     HttpRequestInfo request_info;
     request_info.url = GURL(socket_url);
     request_info.method = "GET";
-    request_info.load_flags = LOAD_DISABLE_CACHE | LOAD_DO_NOT_PROMPT_FOR_LOGIN;
+    request_info.load_flags = LOAD_DISABLE_CACHE;
     int rv = handshake->InitializeStream(
         &request_info, DEFAULT_PRIORITY, BoundNetLog(), CompletionCallback());
     EXPECT_EQ(OK, rv);
diff --git a/net/websockets/websocket_stream.cc b/net/websockets/websocket_stream.cc
index c0d0c4c..002d511 100644
--- a/net/websockets/websocket_stream.cc
+++ b/net/websockets/websocket_stream.cc
@@ -111,9 +111,7 @@ class StreamRequestImpl : public WebSocketStreamRequest {
     url_request_->SetUserData(
         WebSocketHandshakeStreamBase::CreateHelper::DataKey(),
         create_helper_);
-    url_request_->SetLoadFlags(LOAD_DISABLE_CACHE |
-                               LOAD_BYPASS_CACHE |
-                               LOAD_DO_NOT_PROMPT_FOR_LOGIN);
+    url_request_->SetLoadFlags(LOAD_DISABLE_CACHE | LOAD_BYPASS_CACHE);
   }
 
   // Destroying this object destroys the URLRequest, which cancels the request
diff --git a/rlz/lib/financial_ping.cc b/rlz/lib/financial_ping.cc
index f738693..66f8a7f 100644
--- a/rlz/lib/financial_ping.cc
+++ b/rlz/lib/financial_ping.cc
@@ -318,7 +318,6 @@ bool FinancialPing::PingServer(const char* request, std::string* response) {
 
   fetcher->SetLoadFlags(net::LOAD_DISABLE_CACHE |
                         net::LOAD_DO_NOT_SEND_AUTH_DATA |
-                        net::LOAD_DO_NOT_PROMPT_FOR_LOGIN |
                         net::LOAD_DO_NOT_SEND_COOKIES |
                         net::LOAD_DO_NOT_SAVE_COOKIES);