Experimental Feature: Allow-CSP-From header

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h

Index: third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
index 563fb6476f831848a91e1d0db80a92c3e5b236fd..906521368aae9a9818b35b83268a4c472ff905bf 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
@@ -353,6 +353,9 @@ class CORE_EXPORT ContentSecurityPolicy
 
   static bool isNonceableElement(const Element*);
 
+  static bool checkAllowBlanketEnforcement(const ResourceResponse&,

[Mike West, 2016/10/13 11:01:42]

Nit: Perhaps naming this something like `shouldEnforceEmbeddersPolicy()` would
be clearer? We can adjust the spec as well, as I'm no longer sure that "blanket
enforcement" is the right way to talk about this. :)

Nit2: Can you add a comment here describing what the method does, and perhaps
link to https://w3c.github.io/webappsec-csp/embedded/#origin-allowed as well?

+                                           const KURL&);

[Mike West, 2016/10/13 11:01:42]

1. As discussed below, passing an origin here would probably be better.
2. Please add a variable name for things like this, as it's not clear what
URL/Origin we're talking about.

+
   Document* document() const;
 
  private: