CREDENTIAL: Teach Fetch to handle PasswordCredential objects.

third_party/WebKit/Source/modules/fetch/Request.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/fetch/Request.h"
 
 #include "bindings/core/v8/Dictionary.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
@@ skipping 298 matching lines @@
             r->headers()->append("Content-Type", init.contentType, exceptionState);
         }
         if (exceptionState.hadException())
             return nullptr;
     }
 
     // "33. Set |r|'s body to |temporaryBody|.
     if (temporaryBody)
         r->m_request->setBuffer(temporaryBody);
 
+    // https://w3c.github.io/webappsec-credential-management/#monkey-patching-fetch-3
+    // "If |init|'s body member is a 'Credential' object:"
+    if (init.isCredentialRequest) {
+        // "1. If |r|'s url is not the same as |r|'s client’s origin, throw a TypeError."
+        if (!origin->canRequest(r->url())) {
+            exceptionState.throwTypeError("Credentials may only be submitted to same-origin endpoints.");
+            return nullptr;
+        }
+        // "2. Set |r|'s redirect mode to "error"."
+        r->m_request->setRedirect(WebURLRequest::FetchRedirectModeError);
+        // "3. Set |r|'s skip-service-worker flag."
+        // TODO(mkwst): Set this flag.
+        // "4. Set |r|'s opaque flag."
+        r->setOpaque();
+    }
+
     // "34. Set |r|'s MIME type to the result of extracting a MIME type from
     // |r|'s request's header list."
     r->m_request->setMIMEType(r->m_request->headerList()->extractMIMEType());
 
     // "35. If |input| is a Request object and |input|'s body is non-null, run
     // these substeps:"
     // We set bodyUsed even when the body is null in spite of the
     // spec. See https://github.com/whatwg/fetch/issues/61 for details.
     if (inputRequest) {
         // "1. Set |input|'s body to null."
@@ skipping 274 matching lines @@
 }
 
 DEFINE_TRACE(Request)
 {
     Body::trace(visitor);
     visitor->trace(m_request);
     visitor->trace(m_headers);
 }
 
 } // namespace blink