DescriptionCorrectly handle CORS access checks over cache-validating responses.
If a CORS-enabled load of a resource is also done conditionally, the
response may be a 304 (Not Modified.) That 304 response is not
required (nor expected) to have any CORS headers included, so arrange
for the required CORS access control check to be performed over the
cached resource having been (successfully) validated.
R=
BUG=339058
TEST=http/tests/security/script-crossorigin-fails-cross-origin-conditional
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=166188
Patch Set 1 #
Messages
Total messages: 14 (0 generated)
|