I'm not sure there's anything left to do here?

Extensions code uses a cookie store that lives int he browser process, since network process doesn't know about extensions scheme. I converted this a while ago.

Victor: please reopen if you think there's anything I'm missing.

Sadly, I don't think we're done here.

This issue appears to be about the renderer process. jsbell@ is currently putting together https://crrev.com/c/1062732 to have document.cookie use RestrictedCookieManager instead of RenderFrameMessageFilter. I'm looking at what needs to be done to make RestrictedCookieManager actually be restricted, so we can make it available without the Experimental Web Platform flag.

jam@: If I'm misunderstanding something, let's discuss.

The renderer process, with or without the network service, does mojo calls to the browser which does the security checks.

See RenderFrameMessageFilter::SetCookie
https://cs.chromium.org/chromium/src/content/browser/frame_host/render_frame_message_filter.cc?rcl=5e64c59cc7704c25c81311b5ec2c78ddb5ca9af9&l=491

so I think there's nothing else to do. Sending the restricted cookie manager to the renderer seems orthogonal (as that'll be used with or without the network service).

jam@: Thank you for explaining this to me in an offline conversation!