Implement the "first-party-only" cookie flag.

net/url_request/url_request_http_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
@@ skipping 611 matching lines @@
         base::Bind(&URLRequestHttpJob::CheckCookiePolicyAndLoad,
                    weak_factory_.GetWeakPtr()));
   } else {
     DoStartTransaction();
   }
 }
 
 void URLRequestHttpJob::DoLoadCookies() {
   CookieOptions options;
   options.set_include_httponly();
+
+  // TODO(mkwst): Pipe a switch down here to allow us to decide whether we
+  // should enforce "first-party" cookies or not (by setting |options|'s
+  // first-party-url to the first-party-for-cookies value. crbug.com/459154

[mmenke, 2015/02/19 21:04:35]

So we already have URLRequest::FirstPartyURLPolicy and
URLRequest::ReferrerPolicy.  If we're going to be adding yet another, maybe
bundle them up in a struct and pass them all together?  I'm really not a big fan
of growing the size of URLRequest - it has a huge number of public methods, and
I'd really like to see us cut down on them.

+
   GetCookieStore()->GetCookiesWithOptionsAsync(
       request_->url(), options,
       base::Bind(&URLRequestHttpJob::OnCookiesLoaded,
                  weak_factory_.GetWeakPtr()));
 }
 
 void URLRequestHttpJob::CheckCookiePolicyAndLoad(
     const CookieList& cookie_list) {
   if (CanGetCookies(cookie_list))
     DoLoadCookies();
@@ skipping 857 matching lines @@
   return override_response_headers_.get() ?
              override_response_headers_.get() :
              transaction_->GetResponseInfo()->headers.get();
 }
 
 void URLRequestHttpJob::NotifyURLRequestDestroyed() {
   awaiting_callback_ = false;
 }
 
 }  // namespace net