Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/public/common/content_switches.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/content_switches.h"
 
 namespace switches {
 
 // By default, file:// URIs cannot read other file:// URIs. This is an
 // override for developers who need the old behavior for testing.
@@ skipping 224 matching lines @@
 // Cause the OS X sandbox write to syslog every time an access to a resource
 // is denied by the sandbox.
 const char kEnableSandboxLogging[]          = "enable-sandbox-logging";
 
 // Enable the seccomp sandbox (Linux only)
 const char kEnableSeccompSandbox[]          = "enable-seccomp-sandbox";
 
 // Enables StatsTable, logging statistics to a global named shared memory table.
 const char kEnableStatsTable[]              = "enable-stats-table";
 
-// Experimentally ensure each renderer process has pages from only one site.
+// Experimentally ensures that each renderer process:
+// 1) Only handles rendering for a single page.
+// (Note that a page can reference content from multiple origins due to images,
+// iframes, etc).
+// 2) Only has authority to see or use cookies for the page's top-level origin.
+// (So if a.com iframe's b.com, the b.com network request will be sent without
+// cookies).
 // This is expected to break compatibility with many pages for now.
 const char kEnableStrictSiteIsolation[]     = "enable-strict-site-isolation";
 
 // Enable multithreaded GPU compositing of web content.
 const char kEnableThreadedCompositing[]     = "enable-threaded-compositing";
 
 // Enable use of experimental TCP sockets API for sending data in the
 // SYN packet.
 const char kEnableTcpFastOpen[]             = "enable-tcp-fastopen";
 
@@ skipping 288 matching lines @@
 // instead of NSS for SSL.
 const char kUseSystemSSL[]                  = "use-system-ssl";
 #endif
 
 #if !defined(OFFICIAL_BUILD)
 // Causes the renderer process to throw an assertion on launch.
 const char kRendererCheckFalseTest[]        = "renderer-check-false-test";
 #endif
 
 }  // namespace switches