Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(26)

Side by Side Diff: Source/core/fetch/CrossOriginAccessControl.cpp

Issue 189903002: Rename allowCookies to allowStoredCredentials (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Created 6 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « no previous file | Source/core/fetch/RawResource.cpp » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2008 Apple Inc. All Rights Reserved. 2 * Copyright (C) 2008 Apple Inc. All Rights Reserved.
3 * 3 *
4 * Redistribution and use in source and binary forms, with or without 4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions 5 * modification, are permitted provided that the following conditions
6 * are met: 6 * are met:
7 * 1. Redistributions of source code must retain the above copyright 7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer. 8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright 9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the 10 * notice, this list of conditions and the following disclaimer in the
(...skipping 85 matching lines...) Expand 10 before | Expand all | Expand 10 after
96 bool isOnAccessControlResponseHeaderWhitelist(const String& name) 96 bool isOnAccessControlResponseHeaderWhitelist(const String& name)
97 { 97 {
98 AtomicallyInitializedStatic(HTTPHeaderSet*, allowedCrossOriginResponseHeader s = createAllowedCrossOriginResponseHeadersSet().leakPtr()); 98 AtomicallyInitializedStatic(HTTPHeaderSet*, allowedCrossOriginResponseHeader s = createAllowedCrossOriginResponseHeadersSet().leakPtr());
99 99
100 return allowedCrossOriginResponseHeaders->contains(name); 100 return allowedCrossOriginResponseHeaders->contains(name);
101 } 101 }
102 102
103 void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* sec urityOrigin, StoredCredentials allowCredentials) 103 void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* sec urityOrigin, StoredCredentials allowCredentials)
104 { 104 {
105 request.removeCredentials(); 105 request.removeCredentials();
106 request.setAllowCookies(allowCredentials == AllowStoredCredentials); 106 request.setAllowStoredCredentials(allowCredentials == AllowStoredCredentials );
107 107
108 if (securityOrigin) 108 if (securityOrigin)
109 request.setHTTPOrigin(securityOrigin->toAtomicString()); 109 request.setHTTPOrigin(securityOrigin->toAtomicString());
110 } 110 }
111 111
112 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque st, SecurityOrigin* securityOrigin) 112 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque st, SecurityOrigin* securityOrigin)
113 { 113 {
114 ResourceRequest preflightRequest(request.url()); 114 ResourceRequest preflightRequest(request.url());
115 updateRequestForAccessControl(preflightRequest, securityOrigin, DoNotAllowSt oredCredentials); 115 updateRequestForAccessControl(preflightRequest, securityOrigin, DoNotAllowSt oredCredentials);
116 preflightRequest.setHTTPMethod("OPTIONS"); 116 preflightRequest.setHTTPMethod("OPTIONS");
(...skipping 116 matching lines...) Expand 10 before | Expand all | Expand 10 after
233 233
234 // Same-origin request URLs that redirect are allowed without checking acces s. 234 // Same-origin request URLs that redirect are allowed without checking acces s.
235 if (!securityOrigin->canRequest(originalURL)) { 235 if (!securityOrigin->canRequest(originalURL)) {
236 // Follow http://www.w3.org/TR/cors/#redirect-steps 236 // Follow http://www.w3.org/TR/cors/#redirect-steps
237 String errorDescription; 237 String errorDescription;
238 238
239 // Steps 3 & 4 - check if scheme and other URL restrictions hold. 239 // Steps 3 & 4 - check if scheme and other URL restrictions hold.
240 bool allowRedirect = isLegalRedirectLocation(requestURL, errorDescriptio n); 240 bool allowRedirect = isLegalRedirectLocation(requestURL, errorDescriptio n);
241 if (allowRedirect) { 241 if (allowRedirect) {
242 // Step 5: perform resource sharing access check. 242 // Step 5: perform resource sharing access check.
243 StoredCredentials withCredentials = resource->resourceRequest().allo wCookies() ? AllowStoredCredentials : DoNotAllowStoredCredentials; 243 StoredCredentials withCredentials = resource->resourceRequest().allo wStoredCredentials() ? AllowStoredCredentials : DoNotAllowStoredCredentials;
244 allowRedirect = passesAccessControlCheck(redirectResponse, withCrede ntials, securityOrigin, errorDescription); 244 allowRedirect = passesAccessControlCheck(redirectResponse, withCrede ntials, securityOrigin, errorDescription);
245 if (allowRedirect) { 245 if (allowRedirect) {
246 RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::create(o riginalURL); 246 RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::create(o riginalURL);
247 // Step 6: if the request URL origin is not same origin as the o riginal URL's, 247 // Step 6: if the request URL origin is not same origin as the o riginal URL's,
248 // set the source origin to a globally unique identifier. 248 // set the source origin to a globally unique identifier.
249 if (!originalOrigin->canRequest(requestURL)) { 249 if (!originalOrigin->canRequest(requestURL)) {
250 options.securityOrigin = SecurityOrigin::createUnique(); 250 options.securityOrigin = SecurityOrigin::createUnique();
251 securityOrigin = options.securityOrigin.get(); 251 securityOrigin = options.securityOrigin.get();
252 } 252 }
253 } 253 }
(...skipping 10 matching lines...) Expand all
264 request.setHTTPOrigin(securityOrigin->toAtomicString()); 264 request.setHTTPOrigin(securityOrigin->toAtomicString());
265 // If the user didn't request credentials in the first place, update our 265 // If the user didn't request credentials in the first place, update our
266 // state so we neither request them nor expect they must be allowed. 266 // state so we neither request them nor expect they must be allowed.
267 if (options.credentialsRequested == ClientDidNotRequestCredentials) 267 if (options.credentialsRequested == ClientDidNotRequestCredentials)
268 options.allowCredentials = DoNotAllowStoredCredentials; 268 options.allowCredentials = DoNotAllowStoredCredentials;
269 } 269 }
270 return true; 270 return true;
271 } 271 }
272 272
273 } // namespace WebCore 273 } // namespace WebCore
OLDNEW
« no previous file with comments | « no previous file | Source/core/fetch/RawResource.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698