Referrer Policy: Add new policies to URLRequest.

net/url_request/url_request_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_job.h"
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/message_loop/message_loop.h"
 #include "base/power_monitor/power_monitor.h"
@@ skipping 845 matching lines @@
 
   // Update the first-party URL if appropriate.
   if (request_->first_party_url_policy() ==
           URLRequest::UPDATE_FIRST_PARTY_URL_ON_REDIRECT) {
     redirect_info.new_first_party_for_cookies = redirect_info.new_url;
   } else {
     redirect_info.new_first_party_for_cookies =
         request_->first_party_for_cookies();
   }
 
-  // Suppress the referrer if we're redirecting out of https.
-  if (request_->referrer_policy() ==
-          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE &&
-      GURL(request_->referrer()).SchemeIsSecure() &&
-      !redirect_info.new_url.SchemeIsSecure()) {
-    redirect_info.new_referrer.clear();
-  } else {
-    redirect_info.new_referrer = request_->referrer();
+  // Alter the referrer if we're redirecting out of https or cross-origin.
+  GURL original_referrer(request_->referrer());
+  switch (request_->referrer_policy()) {
+    case URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+      if (original_referrer.SchemeIsSecure() &&
+          !redirect_info.new_url.SchemeIsSecure()) {
+        redirect_info.new_referrer.clear();
+      } else {
+        redirect_info.new_referrer = request_->referrer();
+      }
+      break;
+
+    case URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
+      if (original_referrer.SchemeIsSecure() &&
+          !redirect_info.new_url.SchemeIsSecure()) {
+        redirect_info.new_referrer.clear();
+      } else if (original_referrer.GetOrigin() !=
+                 redirect_info.new_url.GetOrigin()) {
+        redirect_info.new_referrer = original_referrer.GetOrigin().spec();
+      } else {
+        redirect_info.new_referrer = request_->referrer();
+      }
+      break;
+
+    case URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
+      if (original_referrer.GetOrigin() != redirect_info.new_url.GetOrigin())
+        redirect_info.new_referrer = original_referrer.GetOrigin().spec();
+      else
+        redirect_info.new_referrer = request_->referrer();
+      break;
+
+    case URLRequest::NEVER_CLEAR_REFERRER:
+      redirect_info.new_referrer = request_->referrer();
+      break;

[mmenke, 2014/11/19 16:29:03]

Suggestion:  This is basically a subset of the logic in
URLRequestJob::ComputeRedirectInfo, just in another form.

I suggest we make a new method with the logic here, and have them both share it
it.

GURL ComputeReferrerForRedirect(...);

IsReferrerInvalid() then becomes:

if (referrer_ != ComputeReferrerForRedirect(...))

And this code becomes:
redirect_info_new_referrer = ComputeReferrerForRedirect(...).

Then there's no need to carefully keep the logic in both methods identical, we
just get it for free.

I'm not quite sure where to put the new function - http_util would make sense,
except that at the "http/" level, except the polices are declared in
url_request/.  Maybe just a static method of job?

[Mike West, 2014/11/20 10:45:30]

That makes a ton of sense. I've done it as a static method of URLRequestJob, but
I agree that that's probably not the best place for it. If you come up with
other suggestions, I'm happy to move it around.

   }
 
   return redirect_info;
 }
 
 }  // namespace net