SameSite: Strict/Lax behavior.

net/cookies/canonical_cookie_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cookies/canonical_cookie.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "base/test/histogram_tester.h"
 #include "net/cookies/cookie_constants.h"
 #include "net/cookies/cookie_options.h"
@@ skipping 67 matching lines @@
       CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time, options);
   EXPECT_FALSE(cookie.get());
   CookieOptions httponly_options;
   httponly_options.set_include_httponly();
   cookie = CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time,
                                    httponly_options);
   EXPECT_TRUE(cookie->IsHttpOnly());
 
   // Test creating SameSite cookies.
   CookieOptions same_site_options;
-  same_site_options.set_include_same_site();
+  same_site_options.set_same_site_cookie_mode(
+      CookieOptions::SameSiteCookieMode::INCLUDE_STRICT_AND_LAX);
   cookie = CanonicalCookie::Create(url, "A=2; SameSite=Strict", creation_time,
                                    same_site_options);
   EXPECT_TRUE(cookie.get());
   EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
   cookie = CanonicalCookie::Create(url, "A=2; SameSite=Lax", creation_time,
                                    same_site_options);
   EXPECT_TRUE(cookie.get());
   EXPECT_EQ(CookieSameSite::LAX_MODE, cookie->SameSite());
   cookie = CanonicalCookie::Create(url, "A=2; SameSite", creation_time,
                                    same_site_options);
@@ skipping 339 matching lines @@
   options.set_include_httponly();
   cookie =
       CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time, options);
   EXPECT_TRUE(cookie->IsHttpOnly());
   EXPECT_TRUE(cookie->IncludeForRequestURL(url, options));
   options.set_exclude_httponly();
   EXPECT_FALSE(cookie->IncludeForRequestURL(url, options));
 }
 
 TEST(CanonicalCookieTest, IncludeSameSiteForSameSiteURL) {
-  GURL insecure_url("http://example.test");
-  GURL secure_url("https://example.test");
-  GURL secure_url_with_path("https://example.test/foo/bar/index.html");
-  GURL third_party_url("https://not-example.test");
+  GURL url("https://example.test");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
   scoped_ptr<CanonicalCookie> cookie;
 
-  // Same-site cookies are not included for cross-site requests,
-  // even if other properties match:
-  cookie = CanonicalCookie::Create(secure_url, "A=2; SameSite=Strict",
-                                   creation_time, options);
+  // `SameSite=Strict` cookies are included for a URL only if the options'
+  // SameSiteCookieMode is INCLUDE_STRICT_AND_LAX.
+  cookie = CanonicalCookie::Create(url, "A=2; SameSite=Strict", creation_time,
+                                   options);
   EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
-  EXPECT_FALSE(cookie->IncludeForRequestURL(secure_url, options));
-  cookie = CanonicalCookie::Create(secure_url, "A=2; Secure; SameSite=Strict",
-                                   creation_time, options);
-  EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
-  EXPECT_FALSE(cookie->IncludeForRequestURL(secure_url, options));
-  cookie = CanonicalCookie::Create(secure_url_with_path,
-                                   "A=2; SameSite=Strict; path=/foo/bar",
-                                   creation_time, options);
-  EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
-  EXPECT_FALSE(cookie->IncludeForRequestURL(secure_url, options));
+  options.set_same_site_cookie_mode(
+      CookieOptions::SameSiteCookieMode::DO_NOT_INCLUDE);
+  EXPECT_FALSE(cookie->IncludeForRequestURL(url, options));
+  options.set_same_site_cookie_mode(
+      CookieOptions::SameSiteCookieMode::INCLUDE_LAX);
+  EXPECT_FALSE(cookie->IncludeForRequestURL(url, options));
+  options.set_same_site_cookie_mode(
+      CookieOptions::SameSiteCookieMode::INCLUDE_STRICT_AND_LAX);
+  EXPECT_TRUE(cookie->IncludeForRequestURL(url, options));
 
-  // Same-site cookies are included for same-site requests:
-  options.set_include_same_site();
-  cookie = CanonicalCookie::Create(secure_url, "A=2; SameSite=Strict",
-                                   creation_time, options);
-  EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
-  EXPECT_TRUE(cookie->IncludeForRequestURL(secure_url, options));
-  cookie = CanonicalCookie::Create(secure_url, "A=2; Secure; SameSite=Strict",
-                                   creation_time, options);
-  EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
-  EXPECT_TRUE(cookie->IncludeForRequestURL(secure_url, options));
-  cookie = CanonicalCookie::Create(secure_url_with_path,
-                                   "A=2; SameSite=Strict; path=/foo/bar",
-                                   creation_time, options);
-  EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
-  EXPECT_TRUE(cookie->IncludeForRequestURL(secure_url_with_path, options));
+  // `SameSite=Lax` cookies are included for a URL only if the options'
+  // SameSiteCookieMode is INCLUDE_STRICT_AND_LAX.
+  cookie =
+      CanonicalCookie::Create(url, "A=2; SameSite=Lax", creation_time, options);
+  EXPECT_EQ(CookieSameSite::LAX_MODE, cookie->SameSite());
+  options.set_same_site_cookie_mode(
+      CookieOptions::SameSiteCookieMode::DO_NOT_INCLUDE);
+  EXPECT_FALSE(cookie->IncludeForRequestURL(url, options));
+  options.set_same_site_cookie_mode(
+      CookieOptions::SameSiteCookieMode::INCLUDE_LAX);
+  EXPECT_TRUE(cookie->IncludeForRequestURL(url, options));
+  options.set_same_site_cookie_mode(
+      CookieOptions::SameSiteCookieMode::INCLUDE_STRICT_AND_LAX);
+  EXPECT_TRUE(cookie->IncludeForRequestURL(url, options));
 }
 
 TEST(CanonicalCookieTest, PartialCompare) {
   GURL url("http://www.example.com");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
   scoped_ptr<CanonicalCookie> cookie(
       CanonicalCookie::Create(url, "a=b", creation_time, options));
   scoped_ptr<CanonicalCookie> cookie_different_path(
       CanonicalCookie::Create(url, "a=b; path=/foo", creation_time, options));
@@ skipping 215 matching lines @@
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
   EXPECT_TRUE(CanonicalCookie::Create(https_url, "__SecureA=B; Path=/; Secure",
                                       creation_time, options));
   histograms.ExpectBucketCount(kCookiePrefixHistogram,
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 2);
   histograms.ExpectBucketCount(kCookiePrefixBlockedHistogram,
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
 }
 
 }  // namespace net