WIP: Teach "First-Party-Only" cookies about the requestor origin.

net/cookies/canonical_cookie.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Portions of this code based on Mozilla:
 //   (netwerk/cookie/src/nsCookieService.cpp)
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ skipping 33 matching lines @@
 
 #include "net/cookies/canonical_cookie.h"
 
 #include "base/basictypes.h"
 #include "base/format_macros.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
 #include "net/cookies/cookie_util.h"
 #include "net/cookies/parsed_cookie.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 #include "url/url_canon.h"
 
 using base::Time;
 using base::TimeDelta;
 
 namespace net {
 
 namespace {
 
 const int kVlogSetCookies = 7;
@@ skipping 333 matching lines @@
   if (IsSecure() && !url.SchemeIsCryptographic())
     return false;
   // Don't include cookies for requests that don't apply to the cookie domain.
   if (!IsDomainMatch(url.host()))
     return false;
   // Don't include cookies for requests with a url path that does not path
   // match the cookie-path.
   if (!IsOnPath(url.path()))
     return false;
 
-  // Include first-party-only cookies iff |options| tells us to include all of
-  // them, or if a first-party URL is set and its origin matches the origin of
-  // |url|.
-  if (IsFirstPartyOnly() && !options.include_first_party_only() &&
-      options.first_party_url().GetOrigin() != url.GetOrigin()) {
-    return false;
+  // Include first-party-only cookies if one of the following is true:
+  //
+  // 1. |options| tells us to include all of them
+  // 2. A first-party URL is set and its origin matches the origin of |url|,
+  //    _and_ that first-party URL is same-origin with the requestor origin.
+  if (IsFirstPartyOnly() && !options.include_first_party_only()) {
+    url::Origin first_party(options.first_party_url());
+    url::Origin request(url);
+    if (!first_party.IsSameOriginWith(request) || !options.requestor_origin().IsSameOriginWith(request)) {
+      return false;
+    }
   }
 
   return true;
 }
 
 std::string CanonicalCookie::DebugString() const {
   return base::StringPrintf(
       "name: %s value: %s domain: %s path: %s creation: %"
       PRId64,
       name_.c_str(), value_.c_str(),
@@ skipping 30 matching lines @@
   if (IsSecure() != other.IsSecure())
     return IsSecure();
 
   if (IsHttpOnly() != other.IsHttpOnly())
     return IsHttpOnly();
 
   return Priority() < other.Priority();
 }
 
 }  // namespace net