Drop Set-Cookie from XHR response headers

chrome/common/render_messages.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_RENDER_MESSAGES_H_
 #define CHROME_COMMON_RENDER_MESSAGES_H_
 
 #include <string>
 #include <vector>
 #include <map>
@@ skipping 1369 matching lines @@
       l->append(L")");
     }
   }
 };
 
 template <>
 struct ParamTraits<scoped_refptr<net::HttpResponseHeaders>> {
   typedef scoped_refptr<net::HttpResponseHeaders> param_type;
   static void Write(Message* m, const param_type& p) {
     WriteParam(m, p.get() != NULL);
-    if (p)
-      p->Persist(m, false);
+    if (p) {
+      // Do not disclose Set-Cookie headers over IPC.
+      p->Persist(m, net::HttpResponseHeaders::PERSIST_SANS_COOKIES);
+    }
   }
   static bool Read(const Message* m, void** iter, param_type* r) {
     bool has_object;
     if (!ReadParam(m, iter, &has_object))
       return false;
     if (has_object)
       *r = new net::HttpResponseHeaders(*m, iter);
     return true;
   }
   static void Log(const param_type& p, std::wstring* l) {
@@ skipping 301 matching lines @@
       ReadParam(m, iter, &p->available_rect);
   }
   static void Log(const param_type& p, std::wstring* l) {
     l->append(L"<webkit_glue::ScreenInfo>");
   }
 };
 
 }  // namespace IPC
 
 #endif  // CHROME_COMMON_RENDER_MESSAGES_H_