Don't persist HPKP if PrivacyMode is enabled.

net/url_request/url_request_http_job.cc

Index: net/url_request/url_request_http_job.cc
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index de1943830afb9a5a8fd0698b4fd46a7e13b4457b..234358e6d54cccdfed2d17e7a6038868deb0c48f 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -783,6 +783,13 @@ void URLRequestHttpJob::ProcessStrictTransportSecurityHeader() {
       !security_state)
     return;
 
+  CookieOptions options;
+  options.set_include_httponly();
+  options.set_server_time(response_date_);
+  // Don't persist HSTS if cookies are not saved to avoid tracking.
+  if ((request_info_.load_flags & LOAD_DO_NOT_SAVE_COOKIES) ||
+      !CanSetCookie("", &options))
+    return;
   // http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec:
   //
   //   If a UA receives more than one STS header field in a HTTP response
@@ -806,6 +813,14 @@ void URLRequestHttpJob::ProcessPublicKeyPinsHeader() {
       !security_state)
     return;
 
+  CookieOptions options;
+  options.set_include_httponly();
+  options.set_server_time(response_date_);
+  // Don't persist HPKP if cookies are not saved to avoid tracking.
+  if ((request_info_.load_flags & LOAD_DO_NOT_SAVE_COOKIES) ||
+      !CanSetCookie("", &options))
+    return;
+
   // http://tools.ietf.org/html/draft-ietf-websec-key-pinning:
   //
   //   If a UA receives more than one PKP header field in an HTTP
@@ -882,11 +897,16 @@ void URLRequestHttpJob::OnStartCompleted(int result) {
     // what we should do.
 
     TransportSecurityState::DomainState domain_state;
+    bool allow_dynamic_state =
+        !(request_info_.load_flags & LOAD_DO_NOT_SEND_COOKIES) &&
+        CanGetCookies(CookieList());
     const URLRequestContext* context = request_->context();
-    const bool fatal = context->transport_security_state() &&
+    const bool fatal =
+        context->transport_security_state() &&
         context->transport_security_state()->GetDomainState(
             request_info_.url.host(),
             SSLConfigService::IsSNIAvailable(context->ssl_config_service()),
+            allow_dynamic_state,
             &domain_state) &&
         domain_state.ShouldSSLErrorsBeFatal();
     NotifySSLCertificateError(transaction_->GetResponseInfo()->ssl_info, fatal);