GitLab

This CL changes the CookiesWithoutSameSiteMustBeSecure flag's behavior.
Previously, a SameSite=None cookie set without Secure, would be treated
as Secure if set from a secure context, or rejected if set from an
insecure context. This CL changes that to always reject such a cookie
regardless of source scheme.

Bug: 954551
Change-Id: Ie035ebc97425f855665b81419ac717173e2dcba5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1594693
Commit-Queue: Lily Chen <chlily@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#656409}