SameSite: Implement 'Strict'/'Lax' attribute parsing.

net/cookies/canonical_cookie.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Portions of this code based on Mozilla:
 //   (netwerk/cookie/src/nsCookieService.cpp)
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ skipping 116 matching lines @@
 CanonicalCookie::CanonicalCookie(const GURL& url,
                                  const std::string& name,
                                  const std::string& value,
                                  const std::string& domain,
                                  const std::string& path,
                                  const base::Time& creation,
                                  const base::Time& expiration,
                                  const base::Time& last_access,
                                  bool secure,
                                  bool httponly,
-                                 bool same_site,
+                                 CookieSameSite same_site,
                                  CookiePriority priority)
     : source_(url.SchemeIsFile() ? url : url.GetOrigin()),
       name_(name),
       value_(value),
       domain_(domain),
       path_(path),
       creation_date_(creation),
       expiry_date_(expiration),
       last_access_date_(last_access),
       secure_(secure),
       httponly_(httponly),
       same_site_(same_site),
       priority_(priority) {}
 
 CanonicalCookie::CanonicalCookie(const GURL& url, const ParsedCookie& pc)
     : source_(url.SchemeIsFile() ? url : url.GetOrigin()),
       name_(pc.Name()),
       value_(pc.Value()),
       path_(CanonPath(url, pc)),
       creation_date_(Time::Now()),
       last_access_date_(Time()),
       secure_(pc.IsSecure()),
       httponly_(pc.IsHttpOnly()),
-      same_site_(pc.IsSameSite()),
+      same_site_(pc.SameSite()),
       priority_(pc.Priority()) {
   if (pc.HasExpires())
     expiry_date_ = CanonExpiration(pc, creation_date_, creation_date_);
 
   // Do the best we can with the domain.
   std::string cookie_domain;
   std::string domain_string;
   if (pc.HasDomain()) {
     domain_string = pc.Domain();
   }
@@ skipping 98 matching lines @@
   if (!is_cookie_valid) {
     VLOG(kVlogSetCookies)
         << "Create() failed because the cookie violated prefix rules.";
     return nullptr;
   }
 
   return make_scoped_ptr(new CanonicalCookie(
       url, parsed_cookie.Name(), parsed_cookie.Value(), cookie_domain,
       cookie_path, creation_time, cookie_expires, creation_time,
       parsed_cookie.IsSecure(), parsed_cookie.IsHttpOnly(),
-      parsed_cookie.IsSameSite(), parsed_cookie.Priority()));
+      parsed_cookie.SameSite(), parsed_cookie.Priority()));
 }
 
 // static
 scoped_ptr<CanonicalCookie> CanonicalCookie::Create(
     const GURL& url,
     const std::string& name,
     const std::string& value,
     const std::string& domain,
     const std::string& path,
     const base::Time& creation,
     const base::Time& expiration,
     bool secure,
     bool http_only,
-    bool same_site,
+    CookieSameSite same_site,
     bool enforce_strict_secure,
     CookiePriority priority) {
   // Expect valid attribute tokens and values, as defined by the ParsedCookie
   // logic, otherwise don't create the cookie.
   std::string parsed_name = ParsedCookie::ParseTokenString(name);
   if (parsed_name != name)
     return nullptr;
   std::string parsed_value = ParsedCookie::ParseValueString(value);
   if (parsed_value != value)
     return nullptr;
@@ skipping 110 matching lines @@
   if (IsSecure() && !url.SchemeIsCryptographic())
     return false;
   // Don't include cookies for requests that don't apply to the cookie domain.
   if (!IsDomainMatch(url.host()))
     return false;
   // Don't include cookies for requests with a url path that does not path
   // match the cookie-path.
   if (!IsOnPath(url.path()))
     return false;
   // Don't include same-site cookies for cross-site requests.
-  if (IsSameSite() && !options.include_same_site())
+  //
+  // TODO(mkwst): This currently treats both "strict" and "lax" SameSite cookies
+  // in the same way. https://codereview.chromium.org/1783813002 will eventually
+  // distinguish between them based on attributes of the request.
+  if (SameSite() != CookieSameSite::NO_RESTRICTION &&
+      !options.include_same_site()) {
     return false;
+  }
 
   return true;
 }
 
 std::string CanonicalCookie::DebugString() const {
   return base::StringPrintf(
       "name: %s value: %s domain: %s path: %s creation: %" PRId64,
       name_.c_str(), value_.c_str(), domain_.c_str(), path_.c_str(),
       static_cast<int64_t>(creation_date_.ToTimeT()));
 }
@@ skipping 70 matching lines @@
   if (prefix == CanonicalCookie::COOKIE_PREFIX_SECURE)
     return parsed_cookie.IsSecure() && url.SchemeIsCryptographic();
   if (prefix == CanonicalCookie::COOKIE_PREFIX_HOST) {
     return parsed_cookie.IsSecure() && url.SchemeIsCryptographic() &&
            !parsed_cookie.HasDomain() && parsed_cookie.Path() == "/";
   }
   return true;
 }
 
 }  // namespace net