Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(566)

Unified Diff: third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp

Issue 1890053002: Exclude simple headers when building Access-Control-Request-Headers (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Rebase Created 4 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
diff --git a/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp b/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
index 7d3f7a5fbd2fc6416da0afdd35ab4324368f4975..8b794e834a16bb03b8310aec1f672aa14fd56640 100644
--- a/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
+++ b/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
@@ -26,6 +26,7 @@
#include "core/fetch/CrossOriginAccessControl.h"
+#include "core/fetch/FetchUtils.h"
#include "core/fetch/Resource.h"
#include "core/fetch/ResourceLoaderOptions.h"
#include "platform/network/HTTPParsers.h"
@@ -83,26 +84,23 @@ ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque
const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
if (requestHeaderFields.size() > 0) {
- // Sort header names lexicographically: https://crbug.com/452391
// Fetch API Spec:
// https://fetch.spec.whatwg.org/#cors-preflight-fetch-0
Vector<String> headers;
for (const auto& header : requestHeaderFields) {
+ if (FetchUtils::isSimpleHeader(header.key, header.value)) {
+ // Exclude simple headers.
+ continue;
+ }
if (equalIgnoringCase(header.key, "referer")) {
// When the request is from a Worker, referrer header was added
// by WorkerThreadableLoader. But it should not be added to
// Access-Control-Request-Headers header.
continue;
}
- if (equalIgnoringCase(header.key, "save-data")) {
- // As a short-term fix, exclude Save-Data from
- // Access-Control-Request-Headers header.
- // TODO(rajendrant): crbug.com/601092 Longer-term all simple
- // headers should be excluded as well.
- continue;
- }
headers.append(header.key.lower());
}
+ // Sort header names lexicographically.
std::sort(headers.begin(), headers.end(), WTF::codePointCompareLessThan);
StringBuilder headerBuffer;
for (const String& header : headers) {

Powered by Google App Engine
This is Rietveld 408576698