Ignore cookies with invalid 'SameSite' attribute values.

net/cookies/cookie_constants.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cookies/cookie_constants.h"
 
 #include "base/logging.h"
 #include "base/strings/string_util.h"
 
 namespace net {
@@ skipping 32 matching lines @@
     return COOKIE_PRIORITY_MEDIUM;
   if (priority_comp == kPriorityLow)
     return COOKIE_PRIORITY_LOW;
 
   return COOKIE_PRIORITY_DEFAULT;
 }
 
 CookieSameSite StringToCookieSameSite(const std::string& same_site) {
   if (base::EqualsCaseInsensitiveASCII(same_site, kSameSiteLax))
     return CookieSameSite::LAX_MODE;
   if (base::EqualsCaseInsensitiveASCII(same_site, kSameSiteStrict))

[mmenke, 2016/04/06 15:16:30]

From spec:

1. If "cookie-av"'s "attribute-value" is not a case-sensitive match for "Strict"
or "Lax", ignore the "cookie-av".

Either the spec is wrong, or this code is.  Given that the next line mentions a
case-insensitive comparison to "Lax", I suspect it's the spec.

     return CookieSameSite::STRICT_MODE;
-  return CookieSameSite::DEFAULT_MODE;
+  return CookieSameSite::INVALID_MODE;
 }
 
 }  // namespace net