Fix strict secure cookies bugs
This fixes a bug where strict secure cookies were showing up in content
settings, even though they were not added to the cookie monster. Also
adds a browser test to verify.
Also fixes a lack of checks for strict secure cookies in HTTP headers.
Adds that and adds a unit test to verify.
BUG=546820
[email protected]
Review URL: https://codereview.chromium.org/1497633002
Cr-Commit-Position: refs/heads/master@{#363392}
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index 5c4ddd1..bf9f63b 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -746,11 +746,17 @@
CookieOptions options;
options.set_include_httponly();
options.set_server_time(response_date_);
+
if (network_delegate() &&
network_delegate()->AreExperimentalCookieFeaturesEnabled()) {
options.set_enforce_prefixes();
}
+ if (network_delegate() &&
+ network_delegate()->AreStrictSecureCookiesEnabled()) {
+ options.set_enforce_strict_secure();
+ }
+
CookieStore::SetCookiesCallback callback(base::Bind(
&URLRequestHttpJob::OnCookieSaved, weak_factory_.GetWeakPtr(),
save_next_cookie_running, callback_pending));
