Apply Referrer-Policy header when following redirects

net/url_request/url_request.h

Index: net/url_request/url_request.h
diff --git a/net/url_request/url_request.h b/net/url_request/url_request.h
index 97cf291eb25b6d923d1adf933f5e7ab73b131f4f..fffd1b9dd2c54b3ac20cfc4751a48ae604bffae9 100644
--- a/net/url_request/url_request.h
+++ b/net/url_request/url_request.h
@@ -85,11 +85,16 @@ class NET_EXPORT URLRequest : NON_EXPORTED_BASE(public base::NonThreadSafe),
   // referrer header might be cleared, if the protocol changes from HTTPS to
   // HTTP. This is the default behavior of URLRequest, corresponding to
   // CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE. Alternatively, the
-  // referrer policy can be set to strip the referrer down to an origin upon
-  // cross-origin navigation (ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN), or
-  // never change the referrer header (NEVER_CLEAR_REFERRER). Embedders will
-  // want to use these options when implementing referrer policy support
-  // (https://w3c.github.io/webappsec/specs/referrer-policy/).
+  // referrer policy can be set to:
+  // - strip the referrer down to an origin upon cross-origin navigation
+  //   (ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN),
+  // - never change the referrer header (NEVER_CLEAR_REFERRER),
+  // - strip the referrer down to an origin regardless of the redirect
+  //   location (ORIGIN), or
+  // - always clear the referrer regardless of the redirect location
+  //   (NO_REFERRER).

[mmenke, 2016/06/28 21:32:08]

optional:  Could move each of these to just before the constant it describes, so
you don't have to list the constants twice.  Would need to modify the old
comments similarly, though.  Up to you.

[estark, 2016/06/28 22:38:42]

Done.

+  // Embedders will want to use these options when implementing referrer policy
+  // support (https://w3c.github.io/webappsec/specs/referrer-policy/).
   //
   // REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN is a slight variant
   // on CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE: If the request
@@ -102,6 +107,9 @@ class NET_EXPORT URLRequest : NON_EXPORTED_BASE(public base::NonThreadSafe),
     REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
     ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
     NEVER_CLEAR_REFERRER,
+    ORIGIN,
+    NO_REFERRER,
+    MAX_REFERRER_POLICY
   };
 
   // First-party URL redirect policy: During server redirects, the first-party