third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp - Issue 1487343002: Set credentials mode "same-origin" when crossOrigin=anonymous is set.

Side by Side Diff: third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp

Issue 1487343002: Set credentials mode "same-origin" when crossOrigin=anonymous is set. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: rebase Created 5 years ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« no previous file with comments | « third_party/WebKit/Source/core/dom/ScriptLoader.cpp ('k') | third_party/WebKit/Source/core/fetch/FetchRequest.h » ('j') | no next file with comments »

OLD	NEW
1 /*	1 /*

2 * Copyright (C) 2008 Apple Inc. All Rights Reserved.	2 * Copyright (C) 2008 Apple Inc. All Rights Reserved.

3 *	3 *

4 * Redistribution and use in source and binary forms, with or without	4 * Redistribution and use in source and binary forms, with or without

5 * modification, are permitted provided that the following conditions	5 * modification, are permitted provided that the following conditions

6 * are met:	6 * are met:

7 * 1. Redistributions of source code must retain the above copyright	7 * 1. Redistributions of source code must retain the above copyright

8 * notice, this list of conditions and the following disclaimer.	8 * notice, this list of conditions and the following disclaimer.

9 * 2. Redistributions in binary form must reproduce the above copyright	9 * 2. Redistributions in binary form must reproduce the above copyright

10 * notice, this list of conditions and the following disclaimer in the	10 * notice, this list of conditions and the following disclaimer in the

(...skipping 48 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
59 {	59 {

60 AtomicallyInitializedStaticReference(HTTPHeaderSet, allowedCrossOriginRespon seHeaders, (createAllowedCrossOriginResponseHeadersSet().leakPtr()));	60 AtomicallyInitializedStaticReference(HTTPHeaderSet, allowedCrossOriginRespon seHeaders, (createAllowedCrossOriginResponseHeadersSet().leakPtr()));

61	61

62 return allowedCrossOriginResponseHeaders.contains(name);	62 return allowedCrossOriginResponseHeaders.contains(name);

63 }	63 }

64	64

65 void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* sec urityOrigin, StoredCredentials allowCredentials)	65 void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* sec urityOrigin, StoredCredentials allowCredentials)

66 {	66 {

67 request.removeCredentials();	67 request.removeCredentials();

68 request.setAllowStoredCredentials(allowCredentials == AllowStoredCredentials );	68 request.setAllowStoredCredentials(allowCredentials == AllowStoredCredentials );

69 request.setFetchCredentialsMode(allowCredentials == AllowStoredCredentials ? WebURLRequest::FetchCredentialsModeInclude : WebURLRequest::FetchCredentialsMod eOmit);

70	69

71 if (securityOrigin)	70 if (securityOrigin)

72 request.setHTTPOrigin(securityOrigin);	71 request.setHTTPOrigin(securityOrigin);

73 }	72 }

74	73

75 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque st, SecurityOrigin* securityOrigin)	74 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque st, SecurityOrigin* securityOrigin)

76 {	75 {

77 ResourceRequest preflightRequest(request.url());	76 ResourceRequest preflightRequest(request.url());

78 updateRequestForAccessControl(preflightRequest, securityOrigin, DoNotAllowSt oredCredentials);	77 updateRequestForAccessControl(preflightRequest, securityOrigin, DoNotAllowSt oredCredentials);

79 preflightRequest.setHTTPMethod("OPTIONS");	78 preflightRequest.setHTTPMethod("OPTIONS");

(...skipping 207 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
287 newRequest.setHTTPOrigin(securityOrigin);	286 newRequest.setHTTPOrigin(securityOrigin);

288 // If the user didn't request credentials in the first place, update our	287 // If the user didn't request credentials in the first place, update our

289 // state so we neither request them nor expect they must be allowed.	288 // state so we neither request them nor expect they must be allowed.

290 if (options.credentialsRequested == ClientDidNotRequestCredentials)	289 if (options.credentialsRequested == ClientDidNotRequestCredentials)

291 options.allowCredentials = DoNotAllowStoredCredentials;	290 options.allowCredentials = DoNotAllowStoredCredentials;

292 }	291 }

293 return true;	292 return true;

294 }	293 }

295	294

296 } // namespace blink	295 } // namespace blink

OLD	NEW