OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2008 Apple Inc. All Rights Reserved. | 2 * Copyright (C) 2008 Apple Inc. All Rights Reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
6 * are met: | 6 * are met: |
7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
(...skipping 85 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
96 bool isOnAccessControlResponseHeaderWhitelist(const String& name) | 96 bool isOnAccessControlResponseHeaderWhitelist(const String& name) |
97 { | 97 { |
98 AtomicallyInitializedStatic(HTTPHeaderSet*, allowedCrossOriginResponseHeader
s = createAllowedCrossOriginResponseHeadersSet().leakPtr()); | 98 AtomicallyInitializedStatic(HTTPHeaderSet*, allowedCrossOriginResponseHeader
s = createAllowedCrossOriginResponseHeadersSet().leakPtr()); |
99 | 99 |
100 return allowedCrossOriginResponseHeaders->contains(name); | 100 return allowedCrossOriginResponseHeaders->contains(name); |
101 } | 101 } |
102 | 102 |
103 void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* sec
urityOrigin, StoredCredentials allowCredentials) | 103 void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* sec
urityOrigin, StoredCredentials allowCredentials) |
104 { | 104 { |
105 request.removeCredentials(); | 105 request.removeCredentials(); |
106 request.setAllowCookies(allowCredentials == AllowStoredCredentials); | 106 request.setAllowStoredCredentials(allowCredentials == AllowStoredCredentials
); |
107 | 107 |
108 if (securityOrigin) | 108 if (securityOrigin) |
109 request.setHTTPOrigin(securityOrigin->toAtomicString()); | 109 request.setHTTPOrigin(securityOrigin->toAtomicString()); |
110 } | 110 } |
111 | 111 |
112 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque
st, SecurityOrigin* securityOrigin) | 112 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque
st, SecurityOrigin* securityOrigin) |
113 { | 113 { |
114 ResourceRequest preflightRequest(request.url()); | 114 ResourceRequest preflightRequest(request.url()); |
115 updateRequestForAccessControl(preflightRequest, securityOrigin, DoNotAllowSt
oredCredentials); | 115 updateRequestForAccessControl(preflightRequest, securityOrigin, DoNotAllowSt
oredCredentials); |
116 preflightRequest.setHTTPMethod("OPTIONS"); | 116 preflightRequest.setHTTPMethod("OPTIONS"); |
(...skipping 116 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
233 | 233 |
234 // Same-origin request URLs that redirect are allowed without checking acces
s. | 234 // Same-origin request URLs that redirect are allowed without checking acces
s. |
235 if (!securityOrigin->canRequest(originalURL)) { | 235 if (!securityOrigin->canRequest(originalURL)) { |
236 // Follow http://www.w3.org/TR/cors/#redirect-steps | 236 // Follow http://www.w3.org/TR/cors/#redirect-steps |
237 String errorDescription; | 237 String errorDescription; |
238 | 238 |
239 // Steps 3 & 4 - check if scheme and other URL restrictions hold. | 239 // Steps 3 & 4 - check if scheme and other URL restrictions hold. |
240 bool allowRedirect = isLegalRedirectLocation(requestURL, errorDescriptio
n); | 240 bool allowRedirect = isLegalRedirectLocation(requestURL, errorDescriptio
n); |
241 if (allowRedirect) { | 241 if (allowRedirect) { |
242 // Step 5: perform resource sharing access check. | 242 // Step 5: perform resource sharing access check. |
243 StoredCredentials withCredentials = resource->resourceRequest().allo
wCookies() ? AllowStoredCredentials : DoNotAllowStoredCredentials; | 243 StoredCredentials withCredentials = resource->resourceRequest().allo
wStoredCredentials() ? AllowStoredCredentials : DoNotAllowStoredCredentials; |
244 allowRedirect = passesAccessControlCheck(redirectResponse, withCrede
ntials, securityOrigin, errorDescription); | 244 allowRedirect = passesAccessControlCheck(redirectResponse, withCrede
ntials, securityOrigin, errorDescription); |
245 if (allowRedirect) { | 245 if (allowRedirect) { |
246 RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::create(o
riginalURL); | 246 RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::create(o
riginalURL); |
247 // Step 6: if the request URL origin is not same origin as the o
riginal URL's, | 247 // Step 6: if the request URL origin is not same origin as the o
riginal URL's, |
248 // set the source origin to a globally unique identifier. | 248 // set the source origin to a globally unique identifier. |
249 if (!originalOrigin->canRequest(requestURL)) { | 249 if (!originalOrigin->canRequest(requestURL)) { |
250 options.securityOrigin = SecurityOrigin::createUnique(); | 250 options.securityOrigin = SecurityOrigin::createUnique(); |
251 securityOrigin = options.securityOrigin.get(); | 251 securityOrigin = options.securityOrigin.get(); |
252 } | 252 } |
253 } | 253 } |
(...skipping 10 matching lines...) Expand all Loading... |
264 request.setHTTPOrigin(securityOrigin->toAtomicString()); | 264 request.setHTTPOrigin(securityOrigin->toAtomicString()); |
265 // If the user didn't request credentials in the first place, update our | 265 // If the user didn't request credentials in the first place, update our |
266 // state so we neither request them nor expect they must be allowed. | 266 // state so we neither request them nor expect they must be allowed. |
267 if (options.credentialsRequested == ClientDidNotRequestCredentials) | 267 if (options.credentialsRequested == ClientDidNotRequestCredentials) |
268 options.allowCredentials = DoNotAllowStoredCredentials; | 268 options.allowCredentials = DoNotAllowStoredCredentials; |
269 } | 269 } |
270 return true; | 270 return true; |
271 } | 271 } |
272 | 272 |
273 } // namespace WebCore | 273 } // namespace WebCore |
OLD | NEW |