Fetch: 'password' credentials mode should include credentials.

third_party/WebKit/Source/modules/fetch/FetchManager.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/fetch/FetchManager.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8ThrowException.h"
@@ skipping 584 matching lines @@
     // header list."
     // We set Origin header in updateRequestForAccessControl() called from
     // DocumentThreadableLoader::makeCrossOriginAccessRequest
 
     // "5. Let |credentials flag| be set if either |HTTPRequest|'s credentials
     // mode is |include|, or |HTTPRequest|'s credentials mode is |same-origin|
     // and the |CORS flag| is unset, and unset otherwise.
     ResourceLoaderOptions resourceLoaderOptions;
     resourceLoaderOptions.dataBufferingPolicy = DoNotBufferData;
     if (m_request->credentials() == WebURLRequest::FetchCredentialsModeInclude
+        || m_request->credentials() == WebURLRequest::FetchCredentialsModePassword

[Mike West, 2016/04/08 18:49:25]

*sobs*

         || (m_request->credentials() == WebURLRequest::FetchCredentialsModeSameOrigin && !corsFlag)) {
         resourceLoaderOptions.allowCredentials = AllowStoredCredentials;
     }
-    if (m_request->credentials() == WebURLRequest::FetchCredentialsModeInclude)
+    if (m_request->credentials() == WebURLRequest::FetchCredentialsModeInclude
+        || m_request->credentials() == WebURLRequest::FetchCredentialsModePassword) {

[Mike West, 2016/04/08 18:49:25]

*more sobs*

         resourceLoaderOptions.credentialsRequested = ClientRequestedCredentials;
+    }
     resourceLoaderOptions.securityOrigin = m_request->origin().get();
 
     ThreadableLoaderOptions threadableLoaderOptions;
     threadableLoaderOptions.contentSecurityPolicyEnforcement = ContentSecurityPolicy::shouldBypassMainWorld(m_executionContext) ? DoNotEnforceContentSecurityPolicy : EnforceContentSecurityPolicy;
     if (corsPreflightFlag)
         threadableLoaderOptions.preflightPolicy = ForcePreflight;
     switch (m_request->mode()) {
     case WebURLRequest::FetchRequestModeSameOrigin:
         threadableLoaderOptions.crossOriginRequestPolicy = DenyCrossOriginRequests;
         break;
@@ skipping 116 matching lines @@
     loader->dispose();
 }
 
 DEFINE_TRACE(FetchManager)
 {
     visitor->trace(m_loaders);
     ContextLifecycleObserver::trace(visitor);
 }
 
 } // namespace blink