Apply Referrer-Policy header when following redirects

net/url_request/url_request.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 461 matching lines @@
   GURL referrer_url(referrer);
   if (referrer_url.is_valid()) {
     referrer_ = referrer_url.GetAsReferrer().spec();
   } else {
     referrer_ = referrer;
   }
 }
 
 void URLRequest::set_referrer_policy(ReferrerPolicy referrer_policy) {
   DCHECK(!is_pending_);
+  // External callers shouldn't be setting NO_REFERRER or
+  // ORIGIN. |referrer_policy_| is only applied during server redirects,
+  // so external callers must set the referrer themselves using
+  // SetReferrer() for the initial request. Once the referrer has been
+  // set to an origin or to an empty string, there is no point in
+  // setting the policy to NO_REFERRER or ORIGIN as it would have the
+  // same effect as using NEVER_CLEAR_REFERRER across redirects.
+  DCHECK_NE(referrer_policy, NO_REFERRER);
+  DCHECK_NE(referrer_policy, ORIGIN);
   referrer_policy_ = referrer_policy;
 }
 
 void URLRequest::set_delegate(Delegate* delegate) {
   DCHECK(!delegate_);
   DCHECK(delegate);
   delegate_ = delegate;
 }
 
 void URLRequest::Start() {
@@ skipping 479 matching lines @@
   // TODO(jww): This is a layering violation and should be refactored somewhere
   // up into //net's embedder. https://crbug.com/471397
   if (!url::Origin(redirect_info.new_url)
            .IsSameOriginWith(url::Origin(url())) &&
       extra_request_headers_.HasHeader(HttpRequestHeaders::kOrigin)) {
     extra_request_headers_.SetHeader(HttpRequestHeaders::kOrigin,
                                      url::Origin().Serialize());
   }
 
   referrer_ = redirect_info.new_referrer;
+  referrer_policy_ = redirect_info.new_referrer_policy;
   first_party_for_cookies_ = redirect_info.new_first_party_for_cookies;
   token_binding_referrer_ = redirect_info.referred_token_binding_host;
 
   url_chain_.push_back(redirect_info.new_url);
   --redirect_limit_;
 
   Start();
   return OK;
 }
 
@@ skipping 195 matching lines @@
 }
 
 void URLRequest::GetConnectionAttempts(ConnectionAttempts* out) const {
   if (job_)
     job_->GetConnectionAttempts(out);
   else
     out->clear();
 }
 
 }  // namespace net