First-Party Cookies: Wire it up as an experimental web platform feature

net/url_request/url_request_http_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
@@ skipping 612 matching lines @@
                    weak_factory_.GetWeakPtr()));
   } else {
     DoStartTransaction();
   }
 }
 
 void URLRequestHttpJob::DoLoadCookies() {
   CookieOptions options;
   options.set_include_httponly();
 
-  // TODO(mkwst): Pipe a switch down here to allow us to decide whether we
-  // should enforce "first-party" cookies or not (by setting |options|'s
-  // first-party-url to the first-party-for-cookies value. crbug.com/459154
+  // TODO(mkwst): Drop this `if` once we decide whether or not to ship
+  // first-party cookies: https://crbug.com/459154
+  if (network_delegate()->FirstPartyCookieExperimentEnabled())
+    options.set_first_party_url(request_->first_party_for_cookies());

[mmenke, 2015/02/20 16:30:39]

As-is, these lines could be removed, or always set the first party URL, and
everything would still pass.  We should have integration tests for this. 
Suggest two where it's enabled (One where first party matches, one where it
doesn't), one where it's not (The second just out of paranoia).  Could make one
test for multiple, I'm fine either way.

Most integration tests of this nature are in url_request_unittest.cc.  The way
you'd write the tests is have one request set the cookie (May have to modify the
test server, may not.  If you do, taking the cookie to set as a query parameter
seems the most general), and then another request read the cookie - the test
server has a URL that makes the response body a request header of your choice,
so don't need to add anything for that.

[mmenke, 2015/02/20 16:30:39]

Ahh...This makes sense.  I hadn't realized it was just a toggle for the trial,
was imagining it would be something we set on non-main-frame navigations.

+  else
+    options.set_include_all_first_party();
 
   GetCookieStore()->GetCookiesWithOptionsAsync(
       request_->url(), options,
       base::Bind(&URLRequestHttpJob::OnCookiesLoaded,
                  weak_factory_.GetWeakPtr()));
 }
 
 void URLRequestHttpJob::CheckCookiePolicyAndLoad(
     const CookieList& cookie_list) {
   if (CanGetCookies(cookie_list))
@@ skipping 858 matching lines @@
   return override_response_headers_.get() ?
              override_response_headers_.get() :
              transaction_->GetResponseInfo()->headers.get();
 }
 
 void URLRequestHttpJob::NotifyURLRequestDestroyed() {
   awaiting_callback_ = false;
 }
 
 }  // namespace net