First-Party Cookies: Wire it up as an experimental web platform feature

net/url_request/url_request_http_job.cc

Index: net/url_request/url_request_http_job.cc
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index 49f45bb853495cff44e0648f343b1287d03160dc..33b29a6e19c17bb32848b550af27fedb9b36e1df 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -630,9 +630,12 @@ void URLRequestHttpJob::DoLoadCookies() {
   CookieOptions options;
   options.set_include_httponly();
 
-  // TODO(mkwst): Pipe a switch down here to allow us to decide whether we
-  // should enforce "first-party" cookies or not (by setting |options|'s
-  // first-party-url to the first-party-for-cookies value. crbug.com/459154
+  // TODO(mkwst): Drop this `if` once we decide whether or not to ship
+  // first-party cookies: https://crbug.com/459154
+  if (network_delegate()->FirstPartyCookieExperimentEnabled())
+    options.set_first_party_url(request_->first_party_for_cookies());

[mmenke, 2015/02/20 16:30:39]

As-is, these lines could be removed, or always set the first party URL, and
everything would still pass.  We should have integration tests for this. 
Suggest two where it's enabled (One where first party matches, one where it
doesn't), one where it's not (The second just out of paranoia).  Could make one
test for multiple, I'm fine either way.

Most integration tests of this nature are in url_request_unittest.cc.  The way
you'd write the tests is have one request set the cookie (May have to modify the
test server, may not.  If you do, taking the cookie to set as a query parameter
seems the most general), and then another request read the cookie - the test
server has a URL that makes the response body a request header of your choice,
so don't need to add anything for that.

[mmenke, 2015/02/20 16:30:39]

Ahh...This makes sense.  I hadn't realized it was just a toggle for the trial,
was imagining it would be something we set on non-main-frame navigations.

+  else
+    options.set_include_all_first_party();
 
   GetCookieStore()->GetCookiesWithOptionsAsync(
       request_->url(), options,