Network traffic annotation added to gaia_auth_fetcher.

google_apis/gaia/gaia_auth_fetcher.cc

Index: google_apis/gaia/gaia_auth_fetcher.cc
diff --git a/google_apis/gaia/gaia_auth_fetcher.cc b/google_apis/gaia/gaia_auth_fetcher.cc
index dcc6eb4e2aefe6c59eff45c4d6791dfe39476ccd..b72118ce14df988b9f9ba0bfdac6f5f0033c23fb 100644
--- a/google_apis/gaia/gaia_auth_fetcher.cc
+++ b/google_apis/gaia/gaia_auth_fetcher.cc
@@ -219,14 +219,16 @@ void GaiaAuthFetcher::CancelRequest() {
   fetch_pending_ = false;
 }
 
-void GaiaAuthFetcher::CreateAndStartGaiaFetcher(const std::string& body,
-                                                const std::string& headers,
-                                                const GURL& gaia_gurl,
-                                                int load_flags) {
+void GaiaAuthFetcher::CreateAndStartGaiaFetcher(
+    const std::string& body,
+    const std::string& headers,
+    const GURL& gaia_gurl,
+    int load_flags,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
   fetcher_ = net::URLFetcher::Create(
       0, gaia_gurl, body.empty() ? net::URLFetcher::GET : net::URLFetcher::POST,
-      this);
+      this, traffic_annotation);
   fetcher_->SetRequestContext(getter_);
   fetcher_->SetUploadData("application/x-www-form-urlencoded", body);
   gaia::MarkURLFetcherAsGaia(fetcher_.get());
@@ -519,8 +521,31 @@ void GaiaAuthFetcher::StartIssueAuthToken(const std::string& sid,
   VLOG(1) << "Starting IssueAuthToken for: " << service;
   requested_service_ = service;
   request_body_ = MakeIssueAuthTokenBody(sid, lsid, service);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:49]

Here and everywhere else: Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          description: "..."
+          trigger: "..."
+          data: "..."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(),
-                            issue_auth_token_gurl_, kLoadFlagsIgnoreCookies);
+                            issue_auth_token_gurl_, kLoadFlagsIgnoreCookies,
+                            traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartRevokeOAuth2Token(const std::string& auth_token) {
@@ -528,8 +553,30 @@ void GaiaAuthFetcher::StartRevokeOAuth2Token(const std::string& auth_token) {
 
   VLOG(1) << "Starting OAuth2 token revocation";
   request_body_ = MakeRevokeTokenBody(auth_token);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:50]

This request revokes an OAuth2 refresh token.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          trigger: "..."

[msarda, 2017/05/15 12:23:48]

Here and everywhere else: Same as the comment below at
StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:48]

The OAuth2 refresh token that should be revoked.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:50]

false

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:48]

Remove.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), oauth2_revoke_gurl_,
-                            kLoadFlagsIgnoreCookies);
+                            kLoadFlagsIgnoreCookies, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartCookieForOAuthLoginTokenExchange(
@@ -575,9 +622,31 @@ void GaiaAuthFetcher::StartCookieForOAuthLoginTokenExchange(
   }
 
   fetch_token_from_auth_code_ = fetch_token_from_auth_code;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(

[msarda, 2017/05/15 12:23:49]

What is "gaia_auth_" used for?

[Ramin Halavati, 2017/05/15 13:27:48]

It's the unique_id of this request, it can be used to collect stats on different
requests, debug network errors, etc.

+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:50]

This request exchanges exchange the cookies of a Google signed-in user session
for an OAuth2 refresh token.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          trigger: "..."
+          data: "..."

[msarda, 2017/05/15 12:23:50]

This request includes the following data: the Google console client ID of the
Chrome application, the ID of the device, the index of the session in the Google
authentication cookies.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

true

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), device_id_header,
                             client_login_to_oauth2_gurl_.Resolve(query_string),
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartAuthCodeForOAuth2TokenExchange(
@@ -592,8 +661,30 @@ void GaiaAuthFetcher::StartAuthCodeForOAuth2TokenExchangeWithDeviceId(
 
   VLOG(1) << "Starting OAuth token pair fetch";
   request_body_ = MakeGetTokenPairBody(auth_code, device_id);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request exchanges an authorization code for an Oauth 2.0 refresh token.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          trigger: "..."
+          data: "..."

[msarda, 2017/05/15 12:23:50]

This request includes the following data:
* the Google console client ID and client secret of the Chrome application
* the OAuth 2.0 authorization code
* the ID of the device

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

false

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), oauth2_token_gurl_,
-                            kLoadFlagsIgnoreCookies);
+                            kLoadFlagsIgnoreCookies, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartGetUserInfo(const std::string& lsid) {
@@ -601,8 +692,30 @@ void GaiaAuthFetcher::StartGetUserInfo(const std::string& lsid) {
 
   VLOG(1) << "Starting GetUserInfo for lsid=" << lsid;
   request_body_ = MakeGetUserInfoBody(lsid);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:50]

This request fetches user information of a Google account.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          trigger: "..."

[msarda, 2017/05/15 12:23:50]

This fetcher is only used after signing in with a child account.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:48]

The value of the Google authentication LSID cookie.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

false

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

?

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), get_user_info_gurl_,
-                            kLoadFlagsIgnoreCookies);
+                            kLoadFlagsIgnoreCookies, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartMergeSession(const std::string& uber_token,
@@ -622,9 +735,31 @@ void GaiaAuthFetcher::StartMergeSession(const std::string& uber_token,
   std::string continue_url("http://www.google.com");
   std::string query = MakeMergeSessionQuery(uber_token, external_cc_result,
                                             continue_url, source_);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request adds an account to the Google authentication cookies.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          trigger: "..."
+          data: "..."

[msarda, 2017/05/15 12:23:50]

This request includes the following data:
* the user-auth token
* a string containing the result of connection checks for various Google web
properties (optional)

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:48]

true

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:48]

?

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), std::string(),
                             merge_session_gurl_.Resolve(query),
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartTokenFetchForUberAuthExchange(
@@ -638,8 +773,31 @@ void GaiaAuthFetcher::StartTokenFetchForUberAuthExchange(
       base::StringPrintf(kOAuthHeaderFormat, access_token.c_str());
   int load_flags =
       is_bound_to_channel_id ? net::LOAD_NORMAL : kLoadFlagsIgnoreCookies;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:48]

Here and everywhere else: Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request exchanges an Oauth2 access token for an uber-auth token that. This
token may be used to add an account to the Google authentication cookies.

[Ramin Halavati, 2017/05/15 13:27:48]

Please elaborate more for a non-technical reader.

+          trigger: "..."

[msarda, 2017/05/15 12:23:49]

Same as the comment below at StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:49]

This request contains an OAuth2 access token. 

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

true or false

[Ramin Halavati, 2017/05/15 13:27:49]

Done, let's write 'True' is it's the privacy concerning case.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:49]

What should this be?

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), authentication_header,
-                            uberauth_token_gurl_, load_flags);
+                            uberauth_token_gurl_, load_flags,
+                            traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartOAuthLogin(const std::string& access_token,
@@ -649,31 +807,121 @@ void GaiaAuthFetcher::StartOAuthLogin(const std::string& access_token,
   request_body_ = MakeOAuthLoginBody(service, source_);
   std::string authentication_header =
       base::StringPrintf(kOAuth2BearerHeaderFormat, access_token.c_str());
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:48]

Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:50]

This request exchanges an OAuthLogin-scoped oauth2 access token for a
ClientLogin-style service tokens. The response to this request is the same as
the response to a ClientLogin request, except that captcha challenges are never
issued.

[Ramin Halavati, 2017/05/15 13:27:50]

Please elaborate for a less technical reader.

+          trigger: "..."

[msarda, 2017/05/15 12:23:50]

Same as the comment below at StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:48]

This request contains an OAuth2 access token and the service for which a
ClientLogin-style should be delivered. 

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

Here and everywhere else: What should this be?

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, authentication_header,
-                            oauth_login_gurl_, net::LOAD_NORMAL);
+                            oauth_login_gurl_, net::LOAD_NORMAL,
+                            traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartListAccounts() {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:48]

Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:48]

This request is used to list the accounts in the Google authentication cookies.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          trigger: "..."

[msarda, 2017/05/15 12:23:49]

Same as the comment below at StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:50]

None.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

true

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

What should this be?

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(" ",  // To force an HTTP POST.
                             "Origin: https://www.google.com",
-                            list_accounts_gurl_, net::LOAD_NORMAL);
+                            list_accounts_gurl_, net::LOAD_NORMAL,
+                            traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartLogOut() {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:50]

Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request is part of the Chrome - Google authentication API and allows its
callers to sign out all Google accounts from the content area.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          trigger: "..."

[msarda, 2017/05/15 12:23:48]

Same as the comment below at StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:50]

None.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

true

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

What should this be?

[Ramin Halavati, 2017/05/15 13:27:50]

If you don't modify it, the default is 'user'.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), logout_headers_, logout_gurl_,
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartGetCheckConnectionInfo() {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:48]

Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request is used to fetch from the Google authentication server the the list
of URLs to check its connection info.

[Ramin Halavati, 2017/05/15 13:27:49]

Could you please elaborate on the description?

+          trigger: "..."

[msarda, 2017/05/15 12:23:48]

It is not clear to me what to say here:
1. This is part of an API, so it may be called by any user, so we may leave this
as "Undefined - this is part of an API, so any caller may decide to call this
method."
2. Today, this method is called from
https://cs.chromium.org/chromium/src/components/signin/core/browser/gaia_cook...

So it is not clear to me if we want this to be specific about this call.

[Ramin Halavati, 2017/05/15 13:27:48]

I didn't get the description clearly, let's continue with trigger when that's
done.

+          data: "..."

[msarda, 2017/05/15 12:23:50]

None

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

false

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

Remove line

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), std::string(),
                             get_check_connection_info_url_,
-                            kLoadFlagsIgnoreCookies);
+                            kLoadFlagsIgnoreCookies, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartListIDPSessions(const std::string& scopes,

[msarda, 2017/05/15 12:23:49]

It looks like this method is never used - I would say we should probably remove
it instead of annotating it:
https://cs.chromium.org/chromium/src/google_apis/gaia/gaia_auth_fetcher.h?typ...

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

@@ -682,8 +930,30 @@ void GaiaAuthFetcher::StartListIDPSessions(const std::string& scopes,
 
   request_body_ = MakeListIDPSessionsBody(scopes, domain);
   requested_service_ = kListIdpServiceRequested;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."
+          trigger: "..."
+          data: "..."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), oauth2_iframe_url_,
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartGetTokenResponse(const std::string& scopes,

[msarda, 2017/05/15 12:23:50]

It looks like this method is never used - I would say we should probably remove
it instead of annotating it:
https://cs.chromium.org/chromium/src/google_apis/gaia/gaia_auth_fetcher.h?typ...

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

@@ -693,8 +963,30 @@ void GaiaAuthFetcher::StartGetTokenResponse(const std::string& scopes,
 
   request_body_ = MakeGetTokenResponseBody(scopes, domain, login_hint);
   requested_service_ = kGetTokenResponseRequested;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."
+          trigger: "..."
+          data: "..."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), oauth2_iframe_url_,
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 // static