Referrer Policy: Add new policies to URLRequest.

net/url_request/url_request_job.cc

Index: net/url_request/url_request_job.cc
diff --git a/net/url_request/url_request_job.cc b/net/url_request/url_request_job.cc
index 5d32c6f78447b4d5439b82793e79ec5c3df94cf8..013d5fd3b3871a40d66ca42c198f097aeab5bd3b 100644
--- a/net/url_request/url_request_job.cc
+++ b/net/url_request/url_request_job.cc
@@ -863,14 +863,40 @@ RedirectInfo URLRequestJob::ComputeRedirectInfo(const GURL& location,
         request_->first_party_for_cookies();
   }
 
-  // Suppress the referrer if we're redirecting out of https.
-  if (request_->referrer_policy() ==
-          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE &&
-      GURL(request_->referrer()).SchemeIsSecure() &&
-      !redirect_info.new_url.SchemeIsSecure()) {
-    redirect_info.new_referrer.clear();
-  } else {
-    redirect_info.new_referrer = request_->referrer();
+  // Alter the referrer if we're redirecting out of https or cross-origin.
+  GURL original_referrer(request_->referrer());
+  switch (request_->referrer_policy()) {
+    case URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+      if (original_referrer.SchemeIsSecure() &&
+          !redirect_info.new_url.SchemeIsSecure()) {
+        redirect_info.new_referrer.clear();
+      } else {
+        redirect_info.new_referrer = request_->referrer();
+      }
+      break;
+
+    case URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
+      if (original_referrer.SchemeIsSecure() &&
+          !redirect_info.new_url.SchemeIsSecure()) {
+        redirect_info.new_referrer.clear();
+      } else if (original_referrer.GetOrigin() !=
+                 redirect_info.new_url.GetOrigin()) {
+        redirect_info.new_referrer = original_referrer.GetOrigin().spec();
+      } else {
+        redirect_info.new_referrer = request_->referrer();
+      }
+      break;
+
+    case URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
+      if (original_referrer.GetOrigin() != redirect_info.new_url.GetOrigin())
+        redirect_info.new_referrer = original_referrer.GetOrigin().spec();
+      else
+        redirect_info.new_referrer = request_->referrer();
+      break;
+
+    case URLRequest::NEVER_CLEAR_REFERRER:
+      redirect_info.new_referrer = request_->referrer();
+      break;

[mmenke, 2014/11/19 16:29:03]

Suggestion:  This is basically a subset of the logic in
URLRequestJob::ComputeRedirectInfo, just in another form.

I suggest we make a new method with the logic here, and have them both share it
it.

GURL ComputeReferrerForRedirect(...);

IsReferrerInvalid() then becomes:

if (referrer_ != ComputeReferrerForRedirect(...))

And this code becomes:
redirect_info_new_referrer = ComputeReferrerForRedirect(...).

Then there's no need to carefully keep the logic in both methods identical, we
just get it for free.

I'm not quite sure where to put the new function - http_util would make sense,
except that at the "http/" level, except the polices are declared in
url_request/.  Maybe just a static method of job?

[Mike West, 2014/11/20 10:45:30]

That makes a ton of sense. I've done it as a static method of URLRequestJob, but
I agree that that's probably not the best place for it. If you come up with
other suggestions, I'm happy to move it around.

   }
 
   return redirect_info;