Teach URLRequest about initiator checks for First-Party-Only cookies.

content/browser/loader/resource_dispatcher_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 
 #include <algorithm>
 #include <set>
@@ skipping 1221 matching lines @@
     return;
   }
 
   // Construct the request.
   scoped_ptr<net::URLRequest> new_request = request_context->CreateRequest(
       request_data.url, request_data.priority, NULL);
 
   new_request->set_method(request_data.method);
   new_request->set_first_party_for_cookies(
       request_data.first_party_for_cookies);
+  new_request->set_initiator(request_data.request_initiator);

[mmenke, 2015/10/21 15:36:38]

What about ServiceWorker script requests, which issue their own nested requests?
 Probably have to modify it to copy these fields, at least.

[mmenke, 2015/10/21 15:36:38]

What about AppCache?

[Mike West, 2015/10/22 13:17:02]

Yup. I missed that. They should copy over the request details in the same way
they copy the first party URL. I'll have to poke around a bit to make sure that
fetches from those contexts also grab the correct initiator, but I think this
might be magically taken care of by the fact that SWs somehow pretend to have a
document context.
What about it? :)

Does AppCache trigger requests on its own? I guess it does, right. Hrm. We can
use the origin of the manifest, I suppose. That's what it looks like we're doing
now for cookies.

I'm not sure that's sane, but it's status quo, and it looks like it matches
Firefox's behavior, which is a minor miracle. :)

[mmenke, 2015/10/22 19:41:05]

I can't comment on that...  Should we have some sort of tests to make sure we
aren't leaking cookies for SW's?

ServiceWorkerReadFromCacheJob does create nested requests for SW scripts, which
it should presumably also copy the new field to.

I'm far from an expert on SW or cookies.

 
   // If the request is a MAIN_FRAME request, the first-party URL gets updated on
   // redirects.
   if (request_data.resource_type == RESOURCE_TYPE_MAIN_FRAME) {
     new_request->set_first_party_url_policy(
         net::URLRequest::UPDATE_FIRST_PARTY_URL_ON_REDIRECT);
   }
 
   const Referrer referrer(request_data.referrer, request_data.referrer_policy);
   SetReferrerForRequest(new_request.get(), referrer);
@@ skipping 750 matching lines @@
   // requests that have the ignore limits flag set.
   DCHECK(!(load_flags & net::LOAD_IGNORE_LIMITS));
 
   scoped_ptr<net::URLRequest> new_request;
   new_request = request_context->CreateRequest(
       info.common_params.url, net::HIGHEST, nullptr);
 
   new_request->set_method(info.begin_params.method);
   new_request->set_first_party_for_cookies(
       info.first_party_for_cookies);
+  new_request->set_initiator(info.request_initiator);
   if (info.is_main_frame) {
     new_request->set_first_party_url_policy(
         net::URLRequest::UPDATE_FIRST_PARTY_URL_ON_REDIRECT);
   }
 
   SetReferrerForRequest(new_request.get(), info.common_params.referrer);
 
   net::HttpRequestHeaders headers;
   headers.AddHeadersFromString(info.begin_params.headers);
   new_request->SetExtraRequestHeaders(headers);
@@ skipping 404 matching lines @@
     load_flags |= net::LOAD_PREFETCH;
   }
 
   if (is_sync_load)
     load_flags |= net::LOAD_IGNORE_LIMITS;
 
   return load_flags;
 }
 
 }  // namespace content