Prevents sending of 'orgin' in the "Access-Control-Request-Headers" when preflight requests are mad…

Source/core/loader/DocumentThreadableLoader.cpp

Index: Source/core/loader/DocumentThreadableLoader.cpp
diff --git a/Source/core/loader/DocumentThreadableLoader.cpp b/Source/core/loader/DocumentThreadableLoader.cpp
index 8c9c383ac54ff1ae158e2b367a37f20d409f28e4..212b64dd27cda5aec153bc908f7ec07efdda2f1b 100644
--- a/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/Source/core/loader/DocumentThreadableLoader.cpp
@@ -99,12 +99,14 @@ void DocumentThreadableLoader::makeCrossOriginAccessRequest(const ResourceReques
     ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
 
     OwnPtr<ResourceRequest> crossOriginRequest = adoptPtr(new ResourceRequest(request));
-    updateRequestForAccessControl(*crossOriginRequest, securityOrigin(), m_options.allowCredentials);
 
-    if ((m_options.preflightPolicy == ConsiderPreflight && isSimpleCrossOriginAccessRequest(crossOriginRequest->httpMethod(), crossOriginRequest->httpHeaderFields())) || m_options.preflightPolicy == PreventPreflight)
+    if ((m_options.preflightPolicy == ConsiderPreflight && isSimpleCrossOriginAccessRequest(crossOriginRequest->httpMethod(), crossOriginRequest->httpHeaderFields())) || m_options.preflightPolicy == PreventPreflight) {
+        updateRequestForAccessControl(*crossOriginRequest, securityOrigin(), m_options.allowCredentials);
         makeSimpleCrossOriginAccessRequest(*crossOriginRequest);
-    else {
+    } else {
         m_simpleRequest = false;
+        // Do not set the Origin header for preflight requests.
+        updateRequestForAccessControl(*crossOriginRequest, static_cast<SecurityOrigin*>(0), m_options.allowCredentials);

[abarth-chromium, 2013/07/16 06:28:20]

You shouldn't need the static_cast here.

[ancilgeorge, 2013/07/16 07:05:01]

Done.

         m_actualRequest = crossOriginRequest.release();
 
         if (CrossOriginPreflightResultCache::shared().canSkipPreflight(securityOrigin()->toString(), m_actualRequest->url(), m_options.allowCredentials, m_actualRequest->httpMethod(), m_actualRequest->httpHeaderFields()))