Rename first-party-only cookies to same-site cookies.

net/cookies/canonical_cookie_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cookies/canonical_cookie.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "base/test/histogram_tester.h"
 #include "net/cookies/cookie_constants.h"
 #include "net/cookies/cookie_options.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
 namespace net {
 
 TEST(CanonicalCookieTest, Constructor) {
   GURL url("http://www.example.com/test");
   base::Time current_time = base::Time::Now();
 
   CanonicalCookie cookie(url, "A", "2", "www.example.com", "/test",
                          current_time, base::Time(), current_time, false, false,
                          false, COOKIE_PRIORITY_DEFAULT);
   EXPECT_EQ(url.GetOrigin(), cookie.Source());
   EXPECT_EQ("A", cookie.Name());
   EXPECT_EQ("2", cookie.Value());
   EXPECT_EQ("www.example.com", cookie.Domain());
   EXPECT_EQ("/test", cookie.Path());
   EXPECT_FALSE(cookie.IsSecure());
   EXPECT_FALSE(cookie.IsHttpOnly());
-  EXPECT_FALSE(cookie.IsFirstPartyOnly());
+  EXPECT_FALSE(cookie.IsSameSite());
 
   CanonicalCookie cookie2(url, "A", "2", std::string(), std::string(),
                           current_time, base::Time(), current_time, false,
                           false, false, COOKIE_PRIORITY_DEFAULT);
   EXPECT_EQ(url.GetOrigin(), cookie.Source());
   EXPECT_EQ("A", cookie2.Name());
   EXPECT_EQ("2", cookie2.Value());
   EXPECT_EQ("", cookie2.Domain());
   EXPECT_EQ("", cookie2.Path());
   EXPECT_FALSE(cookie2.IsSecure());
   EXPECT_FALSE(cookie2.IsHttpOnly());
-  EXPECT_FALSE(cookie2.IsFirstPartyOnly());
+  EXPECT_FALSE(cookie2.IsSameSite());
 }
 
 TEST(CanonicalCookieTest, Create) {
   // Test creating cookies from a cookie string.
   GURL url("http://www.example.com/test/foo.html");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
 
   scoped_ptr<CanonicalCookie> cookie(
       CanonicalCookie::Create(url, "A=2", creation_time, options));
@@ skipping 23 matching lines @@
   cookie =
       CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time, options);
   EXPECT_FALSE(cookie.get());
   CookieOptions httponly_options;
   httponly_options.set_include_httponly();
   cookie = CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time,
                                    httponly_options);
   EXPECT_TRUE(cookie->IsHttpOnly());
 
   // Test creating http only cookies.
-  CookieOptions first_party_options;
-  first_party_options.set_include_first_party_only_cookies();
-  cookie = CanonicalCookie::Create(url, "A=2; First-Party-Only", creation_time,
-                                   httponly_options);
+  CookieOptions same_site_options;
+  same_site_options.set_include_same_site();
+  cookie = CanonicalCookie::Create(url, "A=2; SameSite", creation_time,
+                                   same_site_options);
   EXPECT_TRUE(cookie.get());
-  EXPECT_TRUE(cookie->IsFirstPartyOnly());
+  EXPECT_TRUE(cookie->IsSameSite());
 
   // Test the creating cookies using specific parameter instead of a cookie
   // string.
   cookie = CanonicalCookie::Create(url, "A", "2", "www.example.com", "/test",
                                    creation_time, base::Time(), false, false,
                                    false, false, COOKIE_PRIORITY_DEFAULT);
   EXPECT_EQ(url.GetOrigin(), cookie->Source());
   EXPECT_EQ("A", cookie->Name());
   EXPECT_EQ("2", cookie->Value());
   EXPECT_EQ(".www.example.com", cookie->Domain());
   EXPECT_EQ("/test", cookie->Path());
   EXPECT_FALSE(cookie->IsSecure());
   EXPECT_FALSE(cookie->IsHttpOnly());
-  EXPECT_FALSE(cookie->IsFirstPartyOnly());
+  EXPECT_FALSE(cookie->IsSameSite());
 
   cookie = CanonicalCookie::Create(url, "A", "2", ".www.example.com", "/test",
                                    creation_time, base::Time(), false, false,
                                    false, false, COOKIE_PRIORITY_DEFAULT);
   EXPECT_EQ(url.GetOrigin(), cookie->Source());
   EXPECT_EQ("A", cookie->Name());
   EXPECT_EQ("2", cookie->Value());
   EXPECT_EQ(".www.example.com", cookie->Domain());
   EXPECT_EQ("/test", cookie->Path());
   EXPECT_FALSE(cookie->IsSecure());
   EXPECT_FALSE(cookie->IsHttpOnly());
-  EXPECT_FALSE(cookie->IsFirstPartyOnly());
+  EXPECT_FALSE(cookie->IsSameSite());
 }
 
 TEST(CanonicalCookieTest, EmptyExpiry) {
   GURL url("http://www7.ipdl.inpit.go.jp/Tokujitu/tjkta.ipdl?N0000=108");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
 
   std::string cookie_line =
       "ACSTM=20130308043820420042; path=/; domain=ipdl.inpit.go.jp; Expires=";
   scoped_ptr<CanonicalCookie> cookie(
@@ skipping 24 matching lines @@
   GURL url("http://www.example.com/");
   std::string cookie_name = "A";
   std::string cookie_value = "2EDA-EF";
   std::string cookie_domain = ".www.example.com";
   std::string cookie_path = "/";
   base::Time creation_time = base::Time::Now();
   base::Time last_access_time = creation_time;
   base::Time expiration_time = creation_time + base::TimeDelta::FromDays(2);
   bool secure(false);
   bool httponly(false);
-  bool firstparty(false);
+  bool same_site(false);
 
   // Test that a cookie is equivalent to itself.
   scoped_ptr<CanonicalCookie> cookie(new CanonicalCookie(
       url, cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
+      expiration_time, last_access_time, secure, httponly, same_site,
       COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsEquivalent(*cookie));
 
   // Test that two identical cookies are equivalent.
   scoped_ptr<CanonicalCookie> other_cookie(new CanonicalCookie(
       url, cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
+      expiration_time, last_access_time, secure, httponly, same_site,
       COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
 
   // Tests that use different variations of attribute values that
   // DON'T affect cookie equivalence.
   other_cookie.reset(
       new CanonicalCookie(url, cookie_name, "2", cookie_domain, cookie_path,
                           creation_time, expiration_time, last_access_time,
-                          secure, httponly, firstparty, COOKIE_PRIORITY_HIGH));
+                          secure, httponly, same_site, COOKIE_PRIORITY_HIGH));
   EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
 
   base::Time other_creation_time =
       creation_time + base::TimeDelta::FromMinutes(2);
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, "2", cookie_domain, cookie_path, other_creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
+      expiration_time, last_access_time, secure, httponly, same_site,
       COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, true, httponly, firstparty,
+      expiration_time, last_access_time, true, httponly, same_site,
       COOKIE_PRIORITY_LOW));
   EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, secure, true, firstparty,
+      expiration_time, last_access_time, secure, true, same_site,
       COOKIE_PRIORITY_LOW));
   EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
       expiration_time, last_access_time, secure, httponly, true,
       COOKIE_PRIORITY_LOW));
   EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
 
   // Tests that use different variations of attribute values that
   // DO affect cookie equivalence.
-  other_cookie.reset(new CanonicalCookie(
-      url, "B", cookie_value, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
-      COOKIE_PRIORITY_MEDIUM));
+  other_cookie.reset(
+      new CanonicalCookie(url, "B", cookie_value, cookie_domain, cookie_path,
+                          creation_time, expiration_time, last_access_time,
+                          secure, httponly, same_site, COOKIE_PRIORITY_MEDIUM));
   EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_value, "www.example.com", cookie_path,
       creation_time, expiration_time, last_access_time, secure, httponly,
-      firstparty, COOKIE_PRIORITY_MEDIUM));
+      same_site, COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsDomainCookie());
   EXPECT_FALSE(other_cookie->IsDomainCookie());
   EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_value, ".example.com", cookie_path,
       creation_time, expiration_time, last_access_time, secure, httponly,
-      firstparty, COOKIE_PRIORITY_MEDIUM));
+      same_site, COOKIE_PRIORITY_MEDIUM));
   EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_value, cookie_domain, "/test/0", creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
+      expiration_time, last_access_time, secure, httponly, same_site,
       COOKIE_PRIORITY_MEDIUM));
   EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
 }
 
 TEST(CanonicalCookieTest, IsEquivalentForSecureCookieMatching) {
   GURL url("http://www.example.com/");
   std::string cookie_name = "A";
   std::string cookie_value = "2EDA-EF";
   std::string cookie_domain = ".www.example.com";
   std::string cookie_path = "/";
   base::Time creation_time = base::Time::Now();
   base::Time last_access_time = creation_time;
   base::Time expiration_time = creation_time + base::TimeDelta::FromDays(2);
   bool secure(false);
   bool httponly(false);
-  bool firstparty(false);
+  bool same_site(false);
 
   // Test that a cookie is equivalent to itself.
   scoped_ptr<CanonicalCookie> cookie(new CanonicalCookie(
       url, cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
+      expiration_time, last_access_time, secure, httponly, same_site,
       COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*cookie));
 
   // Test that two identical cookies are equivalent.
   scoped_ptr<CanonicalCookie> other_cookie(new CanonicalCookie(
       url, cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
+      expiration_time, last_access_time, secure, httponly, same_site,
       COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   // Tests that use different variations of attribute values that
   // DON'T affect cookie equivalence. Differs from the IsEquivalent tests above
   // as follows:
   //    * Should return true even if paths differ.
   //    * Should return true if the domains "domain-match" (but are not
   //      identical).
   other_cookie.reset(
       new CanonicalCookie(url, cookie_name, "2", cookie_domain, cookie_path,
                           creation_time, expiration_time, last_access_time,
-                          secure, httponly, firstparty, COOKIE_PRIORITY_HIGH));
+                          secure, httponly, same_site, COOKIE_PRIORITY_HIGH));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   base::Time other_creation_time =
       creation_time + base::TimeDelta::FromMinutes(2);
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, "2", cookie_domain, cookie_path, other_creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
+      expiration_time, last_access_time, secure, httponly, same_site,
       COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, true, httponly, firstparty,
+      expiration_time, last_access_time, true, httponly, same_site,
       COOKIE_PRIORITY_LOW));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, secure, true, firstparty,
+      expiration_time, last_access_time, secure, true, same_site,
       COOKIE_PRIORITY_LOW));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
       expiration_time, last_access_time, secure, httponly, true,
       COOKIE_PRIORITY_LOW));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   // The following 3 tests' expected results differ from their IsEquivalent
   // counterparts above.
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_value, cookie_domain, "/test/0", creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
+      expiration_time, last_access_time, secure, httponly, same_site,
       COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_value, "www.example.com", cookie_path,
       creation_time, expiration_time, last_access_time, secure, httponly,
-      firstparty, COOKIE_PRIORITY_MEDIUM));
+      same_site, COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsDomainCookie());
   EXPECT_FALSE(other_cookie->IsDomainCookie());
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   other_cookie.reset(new CanonicalCookie(
       url, cookie_name, cookie_value, ".example.com", cookie_path,
       creation_time, expiration_time, last_access_time, secure, httponly,
-      firstparty, COOKIE_PRIORITY_MEDIUM));
+      same_site, COOKIE_PRIORITY_MEDIUM));
   EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 
   // Tests that use different variations of attribute values that
   // DO affect cookie equivalence. Note that unlike the IsEquivalent tests
   // above, this does *not* include tests for differing paths or domains that
   // "domain-match".
-  other_cookie.reset(new CanonicalCookie(
-      url, "B", cookie_value, cookie_domain, cookie_path, creation_time,
-      expiration_time, last_access_time, secure, httponly, firstparty,
-      COOKIE_PRIORITY_MEDIUM));
+  other_cookie.reset(
+      new CanonicalCookie(url, "B", cookie_value, cookie_domain, cookie_path,
+                          creation_time, expiration_time, last_access_time,
+                          secure, httponly, same_site, COOKIE_PRIORITY_MEDIUM));
   EXPECT_FALSE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
 }
 
 TEST(CanonicalCookieTest, IsDomainMatch) {
   GURL url("http://www.example.com/test/foo.html");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
 
   scoped_ptr<CanonicalCookie> cookie(
       CanonicalCookie::Create(url, "A=2", creation_time, options));
@@ skipping 80 matching lines @@
   // is set on the cookie options.
   options.set_include_httponly();
   cookie =
       CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time, options);
   EXPECT_TRUE(cookie->IsHttpOnly());
   EXPECT_TRUE(cookie->IncludeForRequestURL(url, options));
   options.set_exclude_httponly();
   EXPECT_FALSE(cookie->IncludeForRequestURL(url, options));
 }
 
-TEST(CanonicalCookieTest, IncludeFirstPartyForFirstPartyURL) {
+TEST(CanonicalCookieTest, IncludeSameSiteForSameSiteURL) {
   GURL insecure_url("http://example.test");
   GURL secure_url("https://example.test");
   GURL secure_url_with_path("https://example.test/foo/bar/index.html");
   GURL third_party_url("https://not-example.test");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
   scoped_ptr<CanonicalCookie> cookie;
 
-  // First-party-only cookies are not included for non-first-party requests,
+  // Same-site cookies are not included for cross-site requests,
   // even if other properties match:
-  cookie = CanonicalCookie::Create(secure_url, "A=2; First-Party-Only",
+  cookie = CanonicalCookie::Create(secure_url, "A=2; SameSite", creation_time,
+                                   options);
+  EXPECT_TRUE(cookie->IsSameSite());
+  EXPECT_FALSE(cookie->IncludeForRequestURL(secure_url, options));
+  cookie = CanonicalCookie::Create(secure_url, "A=2; Secure; SameSite",
                                    creation_time, options);
-  EXPECT_TRUE(cookie->IsFirstPartyOnly());
-  EXPECT_FALSE(cookie->IncludeForRequestURL(secure_url, options));
-  cookie = CanonicalCookie::Create(secure_url, "A=2; Secure; First-Party-Only",
-                                   creation_time, options);
-  EXPECT_TRUE(cookie->IsFirstPartyOnly());
+  EXPECT_TRUE(cookie->IsSameSite());
   EXPECT_FALSE(cookie->IncludeForRequestURL(secure_url, options));
   cookie = CanonicalCookie::Create(secure_url_with_path,
-                                   "A=2; First-Party-Only; path=/foo/bar",
+                                   "A=2; SameSite; path=/foo/bar",
                                    creation_time, options);
-  EXPECT_TRUE(cookie->IsFirstPartyOnly());
+  EXPECT_TRUE(cookie->IsSameSite());
   EXPECT_FALSE(cookie->IncludeForRequestURL(secure_url, options));
 
-  // First-party-only cookies are included for first-party requests:
-  options.set_include_first_party_only_cookies();
-  cookie = CanonicalCookie::Create(secure_url, "A=2; First-Party-Only",
+  // Same-site cookies are included for same-site requests:
+  options.set_include_same_site();
+  cookie = CanonicalCookie::Create(secure_url, "A=2; SameSite", creation_time,
+                                   options);
+  EXPECT_TRUE(cookie->IsSameSite());
+  EXPECT_TRUE(cookie->IncludeForRequestURL(secure_url, options));
+  cookie = CanonicalCookie::Create(secure_url, "A=2; Secure; SameSite",
                                    creation_time, options);
-  EXPECT_TRUE(cookie->IsFirstPartyOnly());
-  EXPECT_TRUE(cookie->IncludeForRequestURL(secure_url, options));
-  cookie = CanonicalCookie::Create(secure_url, "A=2; Secure; First-Party-Only",
-                                   creation_time, options);
-  EXPECT_TRUE(cookie->IsFirstPartyOnly());
+  EXPECT_TRUE(cookie->IsSameSite());
   EXPECT_TRUE(cookie->IncludeForRequestURL(secure_url, options));
   cookie = CanonicalCookie::Create(secure_url_with_path,
-                                   "A=2; First-Party-Only; path=/foo/bar",
+                                   "A=2; SameSite; path=/foo/bar",
                                    creation_time, options);
-  EXPECT_TRUE(cookie->IsFirstPartyOnly());
+  EXPECT_TRUE(cookie->IsSameSite());
   EXPECT_TRUE(cookie->IncludeForRequestURL(secure_url_with_path, options));
 }
 
 TEST(CanonicalCookieTest, PartialCompare) {
   GURL url("http://www.example.com");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
   scoped_ptr<CanonicalCookie> cookie(
       CanonicalCookie::Create(url, "a=b", creation_time, options));
   scoped_ptr<CanonicalCookie> cookie_different_path(
@@ skipping 216 matching lines @@
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
   EXPECT_TRUE(CanonicalCookie::Create(https_url, "__SecureA=B; Path=/; Secure",
                                       creation_time, options));
   histograms.ExpectBucketCount(kCookiePrefixHistogram,
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 2);
   histograms.ExpectBucketCount(kCookiePrefixBlockedHistogram,
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
 }
 
 }  // namespace net