angler-fishThe Vulnerability History Project

Support HttpOnly cookie on Web Socket

      Web Socket should send &quotHttpOnly&quot cookie when handshaking.
In WebKit/WebCore, WebSocketHandshake uses cookieRequestHeaderFieldValue() to
get cookies including HttpOnly cookie.  However, Chrome doesn't trunk renderer
process, so we're not allowed to access HttpOnly cookie in WebCore.
Thus, we handle HttpOnly cookies in browser process.

Add SocketStreamJob as interface for protocol specific handling on
SocketStream.
WebSocketJob implements Web Socket specific handling.  For now, it handles
cookies in Web Socket.  It checks Web Socket handshake request message
from renderer process, and replaces Cookie: header to include HttpOnly cookies.
It also checks Web Socket handshake response message, sets cookies if any,
and strips Set-Cookie: header, so that renderer process couldn't see
Set-Cookie: header.

BUG=35660
TEST=net_unittests and layout_tests passes

Review URL: http://codereview.chromium.org/601077

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@40250 0039d316-1c4b-4281-b951-d872f2087c98
    
commit 6a2c3677f12c18bcc1b57c37becd4e1149f0c8e4
-2
+2 -2
+2 -2
-7
+2 -2
+9 -12
-27
-87
-59
-40
-378
-98
-495
+4
-1
+3 -5
expand_less