SameSite: Strict/Lax behavior.

net/cookies/cookie_options.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Brought to you by number 42.
 
 #ifndef NET_COOKIES_COOKIE_OPTIONS_H_
 #define NET_COOKIES_COOKIE_OPTIONS_H_
 
 #include "base/time/time.h"
 #include "net/base/net_export.h"
+#include "net/cookies/cookie_constants.h"
 #include "url/gurl.h"
 
 namespace net {
 
 class NET_EXPORT CookieOptions {
  public:
+  enum class SameSiteMode {
+    INCLUDE_STRICT_AND_LAX,
+    INCLUDE_LAX,
+    DO_NOT_INCLUDE

[mmenke, 2016/03/17 19:15:56]

SameSiteMode::DO_NOT_INCLUDE seems weird...Maybe SameSiteCookieMode?  The
"cookie" may seem redundant, but it's not a mode for what we do if the site is
the same, but what we do for same site cookies, so think it's clearer, if rather
verbose.

[Mike West, 2016/03/17 19:57:12]

I come from Blink. I was born in verbosity. :)

[Mike West, 2016/03/18 14:27:17]

Done.

+  };
+
   // Creates a CookieOptions object which:
   //
   // * Excludes HttpOnly cookies
   // * Excludes SameSite cookies
   // * Does not enforce prefix restrictions (e.g. "$Secure-*")
   // * Updates last-accessed time.
   //
   // These settings can be altered by calling:
   //
   // * |set_{include,exclude}_httponly()|
-  // * |set_include_same_site()|
+  // * |set_same_site_mode(CookieOptions::SameSiteMode::INCLUDE_STRICT_AND_LAX)|
   // * |set_enforce_prefixes()|
   // * |set_do_not_update_access_time()|
   CookieOptions();
 
   void set_exclude_httponly() { exclude_httponly_ = true; }
   void set_include_httponly() { exclude_httponly_ = false; }
   bool exclude_httponly() const { return exclude_httponly_; }
 
   // Default is to exclude 'same_site' cookies.
-  void set_include_same_site() { include_same_site_ = true; }
-  bool include_same_site() const { return include_same_site_; }
+  void set_same_site_mode(SameSiteMode mode) { same_site_mode_ = mode; }
+  SameSiteMode same_site_mode() const { return same_site_mode_; }
 
   // TODO(jww): Remove once we decide whether to ship modifying 'secure' cookies
   // only from secure schemes. https://crbug.com/546820
   void set_enforce_strict_secure() { enforce_strict_secure_ = true; }
   bool enforce_strict_secure() const { return enforce_strict_secure_; }
 
   // |server_time| indicates what the server sending us the Cookie thought the
   // current time was when the cookie was produced.  This is used to adjust for
   // clock skew between server and host.
   void set_server_time(const base::Time& server_time) {
     server_time_ = server_time;
   }
   bool has_server_time() const { return !server_time_.is_null(); }
   base::Time server_time() const { return server_time_; }
 
   void set_do_not_update_access_time() { update_access_time_ = false; }
   bool update_access_time() const { return update_access_time_; }
 
  private:
   bool exclude_httponly_;
-  bool include_same_site_;
+  SameSiteMode same_site_mode_;
   bool enforce_strict_secure_;
   bool update_access_time_;
   base::Time server_time_;
 };
 
 }  // namespace net
 
 #endif  // NET_COOKIES_COOKIE_OPTIONS_H_