Allows AwCookieManager to block ThirdParty cookies

android_webview/browser/aw_cookie_access_policy.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ANDROID_WEBVIEW_BROWSER_AW_COOKIE_ACCESS_POLICY_H_
 #define ANDROID_WEBVIEW_BROWSER_AW_COOKIE_ACCESS_POLICY_H_
 
 #include "base/basictypes.h"
 #include "base/lazy_instance.h"
 #include "base/synchronization/lock.h"
+#include "net/base/static_cookie_policy.h"
 #include "net/cookies/canonical_cookie.h"
+#include "net/url_request/url_request.h"
 
 namespace content {
 class ResourceContext;
 }
 
 namespace net {
 class CookieOptions;
-class URLRequest;
 }
 
 class GURL;
 
 namespace android_webview {
 
 // Manages the cookie access (both setting and getting) policy for WebView.
+// We have two bits of state but only three different cases:
+// If !GlobalAllowAccess then reject all cookies.
+// If GlobalAllowAccess and !ThirdPartyAllowAccess then allow first party only.
+// If GlobalAllowAccess and ThirdPartyAllowAccess then allow all cookies.
 class AwCookieAccessPolicy {
  public:
   static AwCookieAccessPolicy* GetInstance();
 
   // These manage the global access state shared across requests regardless of
   // source (i.e. network or JavaScript).
   bool GetGlobalAllowAccess();
   void SetGlobalAllowAccess(bool allow);
 
+  // These allow more fine grained control over requests depending on whether
+  // the cookie is third party or not.
+  bool GetThirdPartyAllowAccess();
+  void SetThirdPartyAllowAccess(bool allow);
+
   // These are the functions called when operating over cookies from the
   // network. See NetworkDelegate for further descriptions.
   bool OnCanGetCookies(const net::URLRequest& request,
                        const net::CookieList& cookie_list);
   bool OnCanSetCookie(const net::URLRequest& request,
                       const std::string& cookie_line,
                       net::CookieOptions* options);
 
   // These are the functions called when operating over cookies from the
   // renderer. See ContentBrowserClient for further descriptions.
@@ skipping 10 matching lines @@
                       int render_process_id,
                       int render_frame_id,
                       net::CookieOptions* options);
 
  private:
   friend struct base::DefaultLazyInstanceTraits<AwCookieAccessPolicy>;
 
   AwCookieAccessPolicy();
   ~AwCookieAccessPolicy();
   bool allow_access_;
+  bool allow_third_party_access_;
   base::Lock lock_;
 
+  // Get the current policy (one of net::StaticCookiePolicy::ALLOW_ALL_COOKIES,
+  // BLOCK_ALL_COOKIES and BLOCK_ALL_THIRD_PARTY_COOKIES) depending on

[mkosiba (inactive), 2014/04/17 18:27:30]

this is a bit too detailed - you can see all this from looking a the code. Maybe
move the bit you added at the top of the class here?

[hjd_google, 2014/04/22 13:34:41]

Done.

+  // GetGlobalAllowAccess() and GetThirdPartyAllowAccess() as outlined at the
+  // top of the file.
+  net::StaticCookiePolicy::Type GetPolicy(void);
+
+  // Given the requested url and the first party url these return true if we
+  // are allowed to get/set that cookie.

[mkosiba (inactive), 2014/04/17 18:27:30]

redundant comment - you can infer as much from the name.

[hjd_google, 2014/04/22 13:34:41]

Done.

+  bool AllowGet(const GURL& url, const GURL& first_party);
+  bool AllowSet(const GURL& url, const GURL& first_party);
+
   DISALLOW_COPY_AND_ASSIGN(AwCookieAccessPolicy);
 };
 
 }  // namespace android_webview
 
 #endif  // ANDROID_WEBVIEW_BROWSER_AW_COOKIE_ACCESS_POLICY_H_