Is there a security reason to disable extensions from reading or
Yes, the headers are used as a means of protection in some or the other form. So innately protecting these headers from tinkering inherits priority.
How could an extension act malicious if it could
read/write these values?it's unclear to me why some of these headers are completely
inaccessible to extensions, instead of allowing setting a value or
appending a value, even if read access is not granted.
How I have tried to come up with below answer: I have elaborated the extension to give a context of use followed by accumulation of information enough to define the associated risk and attack vectors to the headers and list them. Feel free to edit the answer OR enlighten me if you find any information is outdated or not on point.
The HTTP Authorization request header contains the credentials to authenticate a user agent with a server, usually, but not necessarily, after the server has responded with a 401 Unauthorized status and the WWW-Authenticate header.
The attacker can write the value of authorization with his session's authorization value to make a victim pay for attacker's check out. Reading this value allows the attacker to steal identity and impersonate the user or make actions on his behalf.
Cache-ControlThe Cache-Control HTTP header holds directives (instructions) for caching in both requests and responses. A given directive in a request does not mean the same directive should be in the response.
If this value can be set, then attacker can allow the cache of sensitive information to be stored on browser and access it at later point in time.
ConnectionThe Connection general header controls whether or not the network connection stays open after the current transaction finishes. If the value sent is keep-alive, the connection is persistent and not closed, allowing for subsequent requests to the same server to be done.
Persistent connections also have drawbacks; even when idling they consume server resources, and under heavy load, DoS attacks can be conducted.
Content-LengthThe Content-Length entity header indicates the size of the entity-body, in bytes, sent to the recipient.
The Content-Length header is used for HTTP 1.1 so that the receiving party knows when the current response* has finished, so the connection can be reused for another request. Again if the connection is hold for long, it consumes resources and may lead to DoS.
HostThe Host request header specifies the host and port number of the server to which the request is being sent.
If host header is changed on the fly then the entire request will land on an evil server hosted by attacker, ending up sharing cookie and other sensitive data.
If-Modified-SinceThe If-Modified-Since request HTTP header makes the request conditional: the server will send back the requested resource, with a 200 status, only if it has been last modified after the given date.
Attacker may target GET and HEAD requests for specific host/hosts and alter this particular header to achieve DoS.
If-None-MatchThe If-None-Match HTTP request header makes the request conditional. For GET and HEAD methods, the server will send back the requested resource, with a 200 status, only if it doesn't have an ETag matching the given ones.
Same as If-Modified-Since, attacker may target GET and HEAD requests for specific host/hosts and alter this particular header to achieve DoS.
If-RangeThe If-Range HTTP request header makes a range request conditional: if the condition is fulfilled, the range request will be issued and the server sends back a 206 Partial Content answer with the appropriate body.
Similar to If-Modified-Since, attacker may target requests for specific host/hosts and alter this particular header to achieve DoS attack.
Partial-DataThe Range HTTP request header indicates the part of a document that the server should return. If the server sends back ranges, it uses the 206 Partial Content for the response.
Since the typical overhead between parts of a multipart/byte-ranges payload is around 80 bytes, depending on the selected representation's media type and the chosen boundary parameter length, it can be less efficient to transfer many small disjoint parts than it is to transfer the entire selected representation. A client that cannot process a multipart/byteranges response MUST NOT generate a request that asks for multiple ranges. When a multipart response payload is generated, the server SHOULD send the parts in the same order that the corresponding byte-range-spec appeared in the received Range header field excluding those ranges that were deemed unjustifiable or that were coalesced into other ranges.
PragmaIt is used for backwards compatibility with HTTP/1.0 caches where the Cache-Control HTTP/1.1 header is not yet present. When the Cache-Control header field is also present and understood in a request, Pragma is ignored.
Pragma: no-cache forces caches to submit the request to the origin server for validation before releasing a cached copy. If this is altered successfully, injection in browser can be executed, especially old ones.
Proxy-AuthorizationThe HTTP Proxy-Authorization request header contains the credentials to authenticate a user agent to a proxy server, usually after the server has responded with a 407 Proxy Authentication Required status and the Proxy-Authenticate header.
Similar to Authorization header. The attacker may read the value of this header and use it for malicious purposes.
Proxy-Connection The Proxy-Connection specifies whether the connection is to be kept open after the request has been sent. If the value indicates that the connection can be kept open, the HTTP 1.1 proxy will accept subsequent requests that can be executed against the server URI.
Similar to Connection header, persistent connections also have drawbacks; even when idling they consume server resources, and under heavy load, DoS attacks can be conducted.
Transfer-EncodingThe Transfer-Encoding header specifies the form of encoding used to safely transfer the payload body to the user.
Similar to discussion on Partial-Data header, Transfer-Encoding is a hop-by-hop header, that is applied to a message between two nodes, not to a resource itself.
for example, chunked encoding is useful when larger amounts of data are sent to the client and the total size of the response may not be known until the request has been fully processed. If the value of this header is changed, it may cause problem with parsing of the data similar to Partial-Data header.