[downloads] Set initiator when handling downloads via a[download]

content/browser/download/download_request_core.cc

Index: content/browser/download/download_request_core.cc
diff --git a/content/browser/download/download_request_core.cc b/content/browser/download/download_request_core.cc
index f23dcda4bf2270fd276a3f387260bdb0b76bbd3c..cbe34be868f224ac4455acabff8b236e10c0f7e5 100644
--- a/content/browser/download/download_request_core.cc
+++ b/content/browser/download/download_request_core.cc
@@ -181,6 +181,14 @@ std::unique_ptr<net::URLRequest> DownloadRequestCore::CreateRequestOnIOThread(
         "If-Range", has_etag ? params->etag() : params->last_modified(), true);
   }
 
+  // Downloads are treated as top level navigations. Hence the first-party
+  // origin for cookies is always based on the target URL and is updated on
+  // redirects.
+  request->set_first_party_for_cookies(params->url());
+  request->set_first_party_url_policy(
+      net::URLRequest::UPDATE_FIRST_PARTY_URL_ON_REDIRECT);
+  request->set_initiator(params->initiator());

[clamy, 2016/12/14 16:25:38]

Sanity check: Does this happen before or after
URLRequestHttpJob::AddCookieHeaderAndStart? If before, the initiator won't
necessarily be the same as url & first_party_for_cookies, meaning that we may
not set the strict cookies. Is that ok?

[asanka, 2016/12/14 18:21:29]

Yup. This happens prior to request->Start() being called. The URLRequestJob
substrates including URLRequestHttpJob are only instantiated after
URLRequest::Start() is called. The request is started only after it is handed
over to the ResourceLoader stack or URLDownloader. We are just setting up the
URLRequest at this stage.

The initiator and first_party_for_cookies can be different for downloads that
cross origins. SameSite=Strict cookies not being sent for these requests is the
intended effect.

+
   for (const auto& header : params->request_headers())
     request->SetExtraRequestHeaderByName(header.first, header.second,
                                          false /*overwrite*/);