Fix WebSocket to set first party for cookies

net/websockets/websocket_stream.cc

Index: net/websockets/websocket_stream.cc
diff --git a/net/websockets/websocket_stream.cc b/net/websockets/websocket_stream.cc
index 560cbad87b42fe0f8a2000b3028e6e9311f333d0..494da304ab5127d1bb959c14780402ef9d11cda8 100644
--- a/net/websockets/websocket_stream.cc
+++ b/net/websockets/websocket_stream.cc
@@ -86,6 +86,7 @@ class StreamRequestImpl : public WebSocketStreamRequest {
       const GURL& url,
       const URLRequestContext* context,
       const url::Origin& origin,
+      const GURL& first_party_for_cookies,
       std::unique_ptr<WebSocketStream::ConnectDelegate> connect_delegate,
       std::unique_ptr<WebSocketHandshakeStreamCreateHelper> create_helper)
       : delegate_(new Delegate(this)),
@@ -101,6 +102,7 @@ class StreamRequestImpl : public WebSocketStreamRequest {
     headers.SetHeader(websockets::kSecWebSocketVersion,
                       websockets::kSupportedVersion);
     url_request_->SetExtraRequestHeaders(headers);
+    url_request_->set_first_party_for_cookies(first_party_for_cookies);

[Mike West, 2016/06/28 11:25:37]

Could you set the initiator as well? `url_request_->set_initiator(origin);`
should do it.

[tyoshino (SeeGerritForStatus), 2016/06/30 08:24:13]

OK. My understanding is that so far even if we set the initiator, it doesn't
make any difference in IncludeForRequestURL() since it's subresource and
therefore origin mismatch in AddCookieHeaderAndStart() also means first party
mismatch. Is it correct?

[tyoshino (SeeGerritForStatus), 2016/06/30 08:28:23]

I noticed that setRequestorOrigin() is not called for all kinds of resource
loading. Maybe that's because it's not necessary for now? For navigation, yes,
it's called by RenderFrameImpl.

 
     // This passes the ownership of |create_helper_| to |url_request_|.
     url_request_->SetUserData(
@@ -332,6 +334,7 @@ std::unique_ptr<WebSocketStreamRequest> WebSocketStream::CreateAndConnectStream(
     const GURL& socket_url,
     const std::vector<std::string>& requested_subprotocols,
     const url::Origin& origin,
+    const GURL& first_party_for_cookies,
     URLRequestContext* url_request_context,
     const BoundNetLog& net_log,
     std::unique_ptr<ConnectDelegate> connect_delegate) {
@@ -339,8 +342,8 @@ std::unique_ptr<WebSocketStreamRequest> WebSocketStream::CreateAndConnectStream(
       new WebSocketHandshakeStreamCreateHelper(connect_delegate.get(),
                                                requested_subprotocols));
   std::unique_ptr<StreamRequestImpl> request(new StreamRequestImpl(
-      socket_url, url_request_context, origin, std::move(connect_delegate),
-      std::move(create_helper)));
+      socket_url, url_request_context, origin, first_party_for_cookies,
+      std::move(connect_delegate), std::move(create_helper)));
   request->Start(std::unique_ptr<base::Timer>(new base::Timer(false, false)));
   return std::move(request);
 }
@@ -355,8 +358,8 @@ std::unique_ptr<WebSocketStreamRequest> CreateAndConnectStreamForTesting(
     std::unique_ptr<WebSocketStream::ConnectDelegate> connect_delegate,
     std::unique_ptr<base::Timer> timer) {
   std::unique_ptr<StreamRequestImpl> request(new StreamRequestImpl(
-      socket_url, url_request_context, origin, std::move(connect_delegate),
-      std::move(create_helper)));
+      socket_url, url_request_context, origin, GURL("http://example.com/"),

[Mike West, 2016/06/28 11:25:37]

Hard-coded `http://example.com/`? Why not pass it in like you're already doing
with |origin|? That would let you write better unit tests in //net.

[tyoshino (SeeGerritForStatus), 2016/07/04 08:13:42]

Done.

+      std::move(connect_delegate), std::move(create_helper)));
   request->Start(std::move(timer));
   return std::move(request);
 }