Teach URLRequest about initiator checks for First-Party-Only cookies.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 
 #include "base/auto_reset.h"
@@ skipping 3210 matching lines @@
     blink::WebLocalFrame* frame,
     unsigned identifier,
     blink::WebURLRequest& request,
     const blink::WebURLResponse& redirect_response) {
   DCHECK(!frame_ || frame_ == frame);
   // The request my be empty during tests.
   if (request.url().isEmpty())
     return;
 
   // Set the first party for cookies url if it has not been set yet (new
-  // requests). For redirects, it is updated by WebURLLoaderImpl.
+  // requests). This value will be updated during redirects, consistent with
+  // https://tools.ietf.org/html/draft-west-first-party-cookies-04#section-2.1.1
   if (request.firstPartyForCookies().isEmpty()) {
     if (request.frameType() == blink::WebURLRequest::FrameTypeTopLevel) {
       request.setFirstPartyForCookies(request.url());
     } else {
       // TODO(nasko): When the top-level frame is remote, there is no document.
       // This is broken and should be fixed to propagate the first party.
       WebFrame* top = frame->top();
       if (top->isWebLocalFrame()) {
         request.setFirstPartyForCookies(
             frame->top()->document().firstPartyForCookies());
       }
     }
+
+    // If we need to set the first party, then we need to set the request's
+    // initiator as well; it will not be updated during redirects.
+    request.setRequestorOrigin(frame->document().securityOrigin());
   }
 
   WebDataSource* provisional_data_source = frame->provisionalDataSource();
   WebDataSource* data_source =
       provisional_data_source ? provisional_data_source : frame->dataSource();
 
   DocumentState* document_state = DocumentState::FromDataSource(data_source);
   DCHECK(document_state);
   InternalDocumentStateData* internal_data =
       InternalDocumentStateData::FromDocumentState(document_state);
@@ skipping 1944 matching lines @@
   mojo::ServiceProviderPtr service_provider;
   mojo::URLRequestPtr request(mojo::URLRequest::New());
   request->url = mojo::String::From(url);
   mojo_shell_->ConnectToApplication(request.Pass(), GetProxy(&service_provider),
                                     nullptr, nullptr,
                                     base::Bind(&OnGotContentHandlerID));
   return service_provider.Pass();
 }
 
 }  // namespace content