WebURLRequest: Track the requesting document's URL through navigations.

WebURLRequest: Track the requesting document's URL through navigations.

We can harden the definition of 'First-Party-Only' cookies if we track
the requestor through navigations.

BUG=459154
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=195261

[Mike West, 2015-04-12 04:55:37]

mkwst@chromium.org changed reviewers:
+ jochen@chromium.org

[Mike West, 2015-04-12 04:55:38]

Jochen, WDYT about this patch? Storing the active document's URL along with the
request opens up some new avenues for filtering, both inside Blink and at the
//net layer.

[jochen (gone - plz use gerrit), 2015-04-13 13:07:03]

https://codereview.chromium.org/1071893003/diff/1/Source/core/loader/FrameLoa...
File Source/core/loader/FrameLoader.cpp (right):

https://codereview.chromium.org/1071893003/diff/1/Source/core/loader/FrameLoa...
Source/core/loader/FrameLoader.cpp:792:
request.resourceRequest().setFrameType(WebURLRequest::FrameTypeAuxiliary);
should this be in a different CL?

https://codereview.chromium.org/1071893003/diff/1/Source/platform/network/Res...
File Source/platform/network/ResourceRequest.cpp (right):

https://codereview.chromium.org/1071893003/diff/1/Source/platform/network/Res...
Source/platform/network/ResourceRequest.cpp:339: if (a.requestorURL() !=
b.requestorURL())
my main concern is whether this will negatively impact cache hit rates

https://codereview.chromium.org/1071893003/diff/1/public/platform/WebURLReque...
File public/platform/WebURLRequest.h (right):

https://codereview.chromium.org/1071893003/diff/1/public/platform/WebURLReque...
public/platform/WebURLRequest.h:170: BLINK_PLATFORM_EXPORT WebURL requestorURL()
const;
does the full URL actually matter (i.e. do you need username/password, reference
fragment, and query string, or just the security origin)?

[Mike West, 2015-04-21 12:46:23]

Split this into two CLs, and replace KURL with SecurityOrigin. WDYT?

https://codereview.chromium.org/1071893003/diff/1/Source/core/loader/FrameLoa...
File Source/core/loader/FrameLoader.cpp (right):

https://codereview.chromium.org/1071893003/diff/1/Source/core/loader/FrameLoa...
Source/core/loader/FrameLoader.cpp:792:
request.resourceRequest().setFrameType(WebURLRequest::FrameTypeAuxiliary);
On 2015/04/13 13:07:02, jochen wrote:
> should this be in a different CL?

As long as you don't mind reviewing two CreateWindow CLs, I can certainly move
it out. This makes the ASSERTs there true.

https://codereview.chromium.org/1071893003/diff/1/Source/platform/network/Res...
File Source/platform/network/ResourceRequest.cpp (right):

https://codereview.chromium.org/1071893003/diff/1/Source/platform/network/Res...
Source/platform/network/ResourceRequest.cpp:339: if (a.requestorURL() !=
b.requestorURL())
On 2015/04/13 13:07:02, jochen wrote:
> my main concern is whether this will negatively impact cache hit rates

That's a fair concern. I suppose we can drop this bit for now, and allow
coalescing requests for the same resource. If we end up with interesting
policies associated with the requestor, however, we'd need to break the caching
link. :/

https://codereview.chromium.org/1071893003/diff/1/public/platform/WebURLReque...
File public/platform/WebURLRequest.h (right):

https://codereview.chromium.org/1071893003/diff/1/public/platform/WebURLReque...
public/platform/WebURLRequest.h:170: BLINK_PLATFORM_EXPORT WebURL requestorURL()
const;
On 2015/04/13 13:07:02, jochen wrote:
> does the full URL actually matter (i.e. do you need username/password,
reference
> fragment, and query string, or just the security origin)?

Origin would be fine, now that you mention it. I'll make that change.

[Mike West, 2015-04-21 13:03:02]

(Bots on fire because I forgot that this depends on
https://codereview.chromium.org/1097303002)

[jochen (gone - plz use gerrit), 2015-04-22 14:44:19]

lgtm

[Mike West, 2015-05-12 13:19:46]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[Mike West, 2015-05-12 13:19:46]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org
Link to the patchset: https://codereview.chromium.org/1071893003/#ps80001
(title: "Ugh.")

[commit-bot: I haz the power, 2015-05-12 13:20:30]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1071893003/80001

[commit-bot: I haz the power, 2015-05-12 14:11:05]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-05-12 14:11:06]

Dry run: This issue passed the CQ dry run.

[Mike West, 2015-05-12 16:39:00]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2015-05-12 16:39:16]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1071893003/80001

[commit-bot: I haz the power, 2015-05-12 16:43:09]

Committed patchset #5 (id:80001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=195261