Make incognito windows not inherit HSTS state from the main profile.

chrome/browser/profiles/off_the_record_profile_io_data.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/off_the_record_profile_io_data.h"
 
 #include "base/bind.h"
+#include "base/command_line.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/io_thread.h"
 #include "chrome/browser/net/chrome_net_log.h"
 #include "chrome/browser/net/chrome_network_delegate.h"
 #include "chrome/browser/net/chrome_url_request_context.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "content/browser/resource_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "net/base/default_origin_bound_cert_store.h"
 #include "net/base/origin_bound_cert_service.h"
 #include "net/ftp/ftp_network_layer.h"
 #include "net/http/http_cache.h"
 #include "net/http/http_server_properties_impl.h"
@@ skipping 120 matching lines @@
     ProfileParams* profile_params) const {
   ChromeURLRequestContext* main_context = main_request_context();
   ChromeURLRequestContext* extensions_context = extensions_request_context();
 
   IOThread* const io_thread = profile_params->io_thread;
   IOThread::Globals* const io_thread_globals = io_thread->globals();
 
   ApplyProfileParamsToContext(main_context);
   ApplyProfileParamsToContext(extensions_context);
 
-  main_context->set_transport_security_state(transport_security_state());
-  extensions_context->set_transport_security_state(transport_security_state());
+  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+  transport_security_state_.reset(new net::TransportSecurityState(
+      command_line.GetSwitchValueASCII(switches::kHstsHosts)));
+
+  main_context->set_transport_security_state(transport_security_state_.get());

[wtc, 2012/01/06 18:45:52]

One reason I am confused is this code: it seems to make the
main profile use the transport security state of the incognito
mode.  Is main_context not the URL request context of the main
profile?

[agl, 2012/01/06 19:08:47]

I don't believe so. There's a main_context (a.k.a. main_request_context_) per
profile, which means that it's specific to the Incognito profile.

It's "main" simply in contrast to the extensions request context (which is also
profile specific.) It's not "main" as in "main profile".

+  extensions_context->set_transport_security_state(
+      transport_security_state_.get());
 
   main_context->set_net_log(io_thread->net_log());
   extensions_context->set_net_log(io_thread->net_log());
 
   main_context->set_network_delegate(network_delegate());
 
   main_context->set_host_resolver(
       io_thread_globals->host_resolver.get());
   main_context->set_cert_verifier(
       io_thread_globals->cert_verifier.get());
@@ skipping 91 matching lines @@
 scoped_refptr<ChromeURLRequestContext>
 OffTheRecordProfileIOData::AcquireIsolatedAppRequestContext(
     scoped_refptr<ChromeURLRequestContext> main_context,
     const std::string& app_id) const {
   // We create per-app contexts on demand, unlike the others above.
   scoped_refptr<ChromeURLRequestContext> app_request_context =
       InitializeAppRequestContext(main_context, app_id);
   DCHECK(app_request_context);
   return app_request_context;
 }