Prevents sending of 'orgin' in the "Access-Control-Request-Headers" when preflight requests are mad…

Source/core/loader/CrossOriginAccessControl.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 79 matching lines @@
     return headerSet.release();
 }
 
 bool isOnAccessControlResponseHeaderWhitelist(const String& name)
 {
     AtomicallyInitializedStatic(HTTPHeaderSet*, allowedCrossOriginResponseHeaders = createAllowedCrossOriginResponseHeadersSet().leakPtr());
 
     return allowedCrossOriginResponseHeaders->contains(name);
 }
 
+void updateRequestForAccessControl(ResourceRequest& request, StoredCredentials allowCredentials)
+{
+    request.removeCredentials();
+    request.setAllowCookies(allowCredentials == AllowStoredCredentials);
+}
+

[bbudge, 2013/07/12 19:10:11]

Why not allow a NULL securityOrigin parameter in the existing function?

[ancilgeorge, 2013/07/15 15:32:46]

Done. Could you please review the changes.

 void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* securityOrigin, StoredCredentials allowCredentials)
 {
     request.removeCredentials();
     request.setAllowCookies(allowCredentials == AllowStoredCredentials);
     request.setHTTPOrigin(securityOrigin->toString());
 }
 
 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& request, SecurityOrigin* securityOrigin)
 {
     ResourceRequest preflightRequest(request.url());
@@ skipping 64 matching lines @@
     Vector<String> headers;
     headerValue.split(',', false, headers);
     for (unsigned headerCount = 0; headerCount < headers.size(); headerCount++) {
         String strippedHeader = headers[headerCount].stripWhiteSpace();
         if (!strippedHeader.isEmpty())
             headerSet.add(strippedHeader);
     }
 }
 
 } // namespace WebCore