Include the Origin header for XHR and Fetch API even if the request is same-origin

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 231 matching lines @@
             m_fallbackRequestForServiceWorker = ResourceRequest(request);
             // m_fallbackRequestForServiceWorker is used when a regular controlling
             // service worker doesn't handle a cross origin request. When this happens
             // we still want to give foreign fetch a chance to handle the request, so
             // only skip the controlling service worker for the fallback request.
             // This is currently safe because of http://crbug.com/604084 the
             // wasFallbackRequiredByServiceWorker flag is never set when foreign fetch
             // handled a request.
             m_fallbackRequestForServiceWorker.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::Controlling);
         }
+
+        if (m_options.sameOriginHeaderPolicy == IncludeSameOriginHeader)
+            newRequest.setHTTPOrigin(getSecurityOrigin());
+
         loadRequest(newRequest, m_resourceLoaderOptions);
         return;
     }
 
     dispatchInitialRequest(newRequest);
 }
 
-void DocumentThreadableLoader::dispatchInitialRequest(const ResourceRequest& request)
+void DocumentThreadableLoader::dispatchInitialRequest(ResourceRequest& request)
 {
     if (!request.isExternalRequest() && (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests)) {
+        if (m_options.sameOriginHeaderPolicy == IncludeSameOriginHeader)
+            request.setHTTPOrigin(getSecurityOrigin());
+
         loadRequest(request, m_resourceLoaderOptions);
         return;
     }
 
     ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl || request.isExternalRequest());
 
     makeCrossOriginAccessRequest(request);
 }
 
 void DocumentThreadableLoader::makeCrossOriginAccessRequest(const ResourceRequest& request)
@@ skipping 34 matching lines @@
         // We update the credentials mode according to effectiveAllowCredentials() here for backward compatibility. But this is not correct.
         // FIXME: We should set it in the caller of DocumentThreadableLoader.
         crossOriginRequest.setFetchCredentialsMode(effectiveAllowCredentials() == AllowStoredCredentials ? WebURLRequest::FetchCredentialsModeInclude : WebURLRequest::FetchCredentialsModeOmit);
         if (m_didRedirect) {
             crossOriginRequest.setHTTPReferrer(SecurityPolicy::generateReferrer(m_referrerAfterRedirect.referrerPolicy, crossOriginRequest.url(), m_referrerAfterRedirect.referrer));
         }
         loadRequest(crossOriginRequest, crossOriginOptions);
     } else {
         m_crossOriginNonSimpleRequest = true;
         // Do not set the Origin header for preflight requests.
-        updateRequestForAccessControl(crossOriginRequest, 0, effectiveAllowCredentials());
+        updateRequestForAccessControl(crossOriginRequest, nullptr, effectiveAllowCredentials());
         // We update the credentials mode according to effectiveAllowCredentials() here for backward compatibility. But this is not correct.
         // FIXME: We should set it in the caller of DocumentThreadableLoader.
         crossOriginRequest.setFetchCredentialsMode(effectiveAllowCredentials() == AllowStoredCredentials ? WebURLRequest::FetchCredentialsModeInclude : WebURLRequest::FetchCredentialsModeOmit);
         m_actualRequest = crossOriginRequest;
         m_actualOptions = crossOriginOptions;
 
         if (m_didRedirect) {
             m_actualRequest.setHTTPReferrer(SecurityPolicy::generateReferrer(m_referrerAfterRedirect.referrerPolicy, m_actualRequest.url(), m_referrerAfterRedirect.referrer));
         }
 
@@ skipping 660 matching lines @@
 
 DEFINE_TRACE(DocumentThreadableLoader)
 {
     visitor->trace(m_resource);
     visitor->trace(m_document);
     ThreadableLoader::trace(visitor);
     RawResourceClient::trace(visitor);
 }
 
 } // namespace blink