Don't persist HPKP if PrivacyMode is enabled.

net/url_request/url_request_http_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
@@ skipping 777 matching lines @@
   TransportSecurityState* security_state =
       request_->context()->transport_security_state();
   const SSLInfo& ssl_info = response_info_->ssl_info;
 
   // Only accept HSTS headers on HTTPS connections that have no
   // certificate errors.
   if (!ssl_info.is_valid() || IsCertStatusError(ssl_info.cert_status) ||
       !security_state)
     return;
 
+  CookieOptions options;
+  options.set_include_httponly();
+  options.set_server_time(response_date_);
+  // Don't persist HSTS if cookies are not saved to avoid tracking.
+  if ((request_info_.load_flags & LOAD_DO_NOT_SAVE_COOKIES) ||
+      !CanSetCookie("", &options))
+    return;
   // http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec:
   //
   //   If a UA receives more than one STS header field in a HTTP response
   //   message over secure transport, then the UA MUST process only the
   //   first such header field.
   HttpResponseHeaders* headers = GetResponseHeaders();
   std::string value;
   if (headers->EnumerateHeader(NULL, "Strict-Transport-Security", &value))
     security_state->AddHSTSHeader(request_info_.url.host(), value);
 }
 
 void URLRequestHttpJob::ProcessPublicKeyPinsHeader() {
   DCHECK(response_info_);
   TransportSecurityState* security_state =
       request_->context()->transport_security_state();
   const SSLInfo& ssl_info = response_info_->ssl_info;
 
   // Only accept HPKP headers on HTTPS connections that have no
   // certificate errors.
   if (!ssl_info.is_valid() || IsCertStatusError(ssl_info.cert_status) ||
       !security_state)
     return;
 
+  CookieOptions options;
+  options.set_include_httponly();
+  options.set_server_time(response_date_);
+  // Don't persist HPKP if cookies are not saved to avoid tracking.
+  if ((request_info_.load_flags & LOAD_DO_NOT_SAVE_COOKIES) ||
+      !CanSetCookie("", &options))
+    return;
+
   // http://tools.ietf.org/html/draft-ietf-websec-key-pinning:
   //
   //   If a UA receives more than one PKP header field in an HTTP
   //   response message over secure transport, then the UA MUST process
   //   only the first such header field.
   HttpResponseHeaders* headers = GetResponseHeaders();
   std::string value;
   if (headers->EnumerateHeader(NULL, "Public-Key-Pins", &value))
     security_state->AddHPKPHeader(request_info_.url.host(), value, ssl_info);
 }
@@ skipping 56 matching lines @@
         return;
       }
     }
 
     SaveCookiesAndNotifyHeadersComplete(net::OK);
   } else if (IsCertificateError(result)) {
     // We encountered an SSL certificate error.  Ask our delegate to decide
     // what we should do.
 
     TransportSecurityState::DomainState domain_state;
+    bool allow_dynamic_state =
+        !(request_info_.load_flags & LOAD_DO_NOT_SEND_COOKIES) &&
+        CanGetCookies(CookieList());
     const URLRequestContext* context = request_->context();
-    const bool fatal = context->transport_security_state() &&
+    const bool fatal =
+        context->transport_security_state() &&
         context->transport_security_state()->GetDomainState(
             request_info_.url.host(),
             SSLConfigService::IsSNIAvailable(context->ssl_config_service()),
+            allow_dynamic_state,
             &domain_state) &&
         domain_state.ShouldSSLErrorsBeFatal();
     NotifySSLCertificateError(transaction_->GetResponseInfo()->ssl_info, fatal);
   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
     NotifyCertificateRequested(
         transaction_->GetResponseInfo()->cert_request_info.get());
   } else {
     NotifyStartError(URLRequestStatus(URLRequestStatus::FAILED, result));
   }
 }
@@ skipping 592 matching lines @@
 
 void URLRequestHttpJob::NotifyURLRequestDestroyed() {
   awaiting_callback_ = false;
 }
 
 void URLRequestHttpJob::OnDetachRequest() {
   http_transaction_delegate_->OnDetachRequest();
 }
 
 }  // namespace net