Return securityToken to SecurityOrigin

third_party/WebKit/WebCore/page/SecurityOrigin.h

 /*
  * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 93 matching lines @@
         // lacks a path component.  The string representation does not encode
         // the value of the SecurityOrigin's domain property.  The empty
         // SecurityOrigin is represented with the null string.
         String toString() const;
 
         // Convert this SecurityOrigin into a string for use in the HTTP Origin
         // header. This is similar to toString(), except that the empty
         // SecurityOrigin is represented as the string "null".
         String toHTTPOrigin() const;
 
+        // Non-empty security tokens can be used for fast access checks.  If the
+        // return value is a non-empty string, it can be used to compare with
+        // another security origin's securityToken.  An empty security token is
+        // invalid and should not be used to check security.  Instead, you must
+        // call canAccess.
+        //
+        // CAVEATS:
+        //
+        //  1) If either of the tokens is empty or if the tokens are not equal,
+        //     you must call canAccess to see if they match.  The tokens can be
+        //     used for fast allow judgments, but cannot be used for deny
+        //     judgments.
+        //
+        //  2) If one of the SecurityOrigins modifies their document.domain
+        //     property after you read its securityToken, you might get false
+        //     allows.
+        //
+        String securityToken() const;
+
         // Serialize the security origin for storage in the database. This format is
         // deprecated and should be used only for compatibility with old databases;
         // use toString() and createFromString() instead.
         String databaseIdentifier() const;
 
         // This method checks for equality between SecurityOrigins, not whether
         // one origin can access another.  It is used for hash table keys.
         // For access checks, use canAccess().
         // FIXME: If this method is really only useful for hash table keys, it
         // should be refactored into SecurityOriginHash.
@@ skipping 12 matching lines @@
         String m_domain;
         unsigned short m_port;
         bool m_noAccess;
         bool m_domainWasSetInDOM;
         bool m_canLoadLocalResources;
     };
 
 } // namespace WebCore
 
 #endif // SecurityOrigin_h