CREDENTIAL: Credentials should be submitted within a registrable domain.

third_party/WebKit/Source/modules/fetch/Request.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/fetch/Request.h"
 
 #include "bindings/core/v8/Dictionary.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/fetch/FetchUtils.h"
 #include "core/fetch/ResourceLoaderOptions.h"
 #include "core/loader/ThreadableLoader.h"
 #include "modules/fetch/BodyStreamBuffer.h"
 #include "modules/fetch/DataConsumerHandleUtil.h"
 #include "modules/fetch/FetchBlobDataConsumerHandle.h"
 #include "modules/fetch/FetchManager.h"
 #include "modules/fetch/RequestInit.h"
 #include "platform/HTTPNames.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/network/ResourceRequest.h"
+#include "platform/weborigin/OriginAccessEntry.h"
 #include "platform/weborigin/Referrer.h"
 #include "public/platform/WebURLRequest.h"
 #include "public/platform/modules/serviceworker/WebServiceWorkerRequest.h"
 
 namespace blink {
 
 FetchRequestData* createCopyOfFetchRequestDataForFetch(ScriptState* scriptState, const FetchRequestData* original)
 {
     FetchRequestData* request = FetchRequestData::create();
     request->setURL(original->url());
@@ skipping 288 matching lines @@
             exceptionState.throwTypeError("Request with GET/HEAD method cannot have body.");
             return nullptr;
         }
     }
 
     // TODO(mkwst): See the comment in RequestInit about serializing the attached credential
     // prior to hitting the Service Worker machinery.
     if (request->credentials() == WebURLRequest::FetchCredentialsModePassword) {
         r->getHeaders()->append(HTTPNames::Content_Type, init.contentType, exceptionState);
 
-        // TODO(mkwst): This should be a registrable-domain match.
-        if (!origin->canRequest(r->url())) {
-            exceptionState.throwTypeError("Credentials may only be submitted to same-origin endpoints.");
+        const OriginAccessEntry accessEntry = OriginAccessEntry(r->url().protocol(), r->url().host(), OriginAccessEntry::AllowRegisterableDomains);
+        if (accessEntry.matchesDomain(*origin) == OriginAccessEntry::DoesNotMatchOrigin) {
+            exceptionState.throwTypeError("Credentials may only be submitted to endpoints on the same registrable domain.");
             return nullptr;
         }
     }
 
     // "If |init|'s body member is present, run these substeps:"
     if (init.body) {
         // Perform the following steps:
         // - "Let |stream| and |Content-Type| be the result of extracting
         //   |init|'s body member."
         // - "Set |temporaryBody| to |stream|.
@@ skipping 304 matching lines @@
 }
 
 DEFINE_TRACE(Request)
 {
     Body::trace(visitor);
     visitor->trace(m_request);
     visitor->trace(m_headers);
 }
 
 } // namespace blink