| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2008 Apple Inc. All Rights Reserved. | 2 * Copyright (C) 2008 Apple Inc. All Rights Reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
| 8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
| 9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
| 10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
| (...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 69 ResourceRequest preflightRequest(request.url()); | 69 ResourceRequest preflightRequest(request.url()); |
| 70 updateRequestForAccessControl(preflightRequest, securityOrigin, | 70 updateRequestForAccessControl(preflightRequest, securityOrigin, |
| 71 DoNotAllowStoredCredentials); | 71 DoNotAllowStoredCredentials); |
| 72 preflightRequest.setHTTPMethod(HTTPNames::OPTIONS); | 72 preflightRequest.setHTTPMethod(HTTPNames::OPTIONS); |
| 73 preflightRequest.setHTTPHeaderField(HTTPNames::Access_Control_Request_Method, | 73 preflightRequest.setHTTPHeaderField(HTTPNames::Access_Control_Request_Method, |
| 74 AtomicString(request.httpMethod())); | 74 AtomicString(request.httpMethod())); |
| 75 preflightRequest.setPriority(request.priority()); | 75 preflightRequest.setPriority(request.priority()); |
| 76 preflightRequest.setRequestContext(request.requestContext()); | 76 preflightRequest.setRequestContext(request.requestContext()); |
| 77 preflightRequest.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::All); | 77 preflightRequest.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::All); |
| 78 | 78 |
| 79 if (request.isExternalRequest()) | 79 if (request.isExternalRequest()) { |
| 80 preflightRequest.setHTTPHeaderField( | 80 preflightRequest.setHTTPHeaderField( |
| 81 HTTPNames::Access_Control_Request_External, "true"); | 81 HTTPNames::Access_Control_Request_External, "true"); |
| 82 } |
| 82 | 83 |
| 83 const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields(); | 84 const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields(); |
| 84 | 85 |
| 85 if (requestHeaderFields.size() > 0) { | 86 if (requestHeaderFields.size() > 0) { |
| 86 // Fetch API Spec: https://fetch.spec.whatwg.org/#cors-preflight-fetch-0 | 87 // Fetch API Spec: https://fetch.spec.whatwg.org/#cors-preflight-fetch-0 |
| 87 Vector<String> headers; | 88 Vector<String> headers; |
| 88 for (const auto& header : requestHeaderFields) { | 89 for (const auto& header : requestHeaderFields) { |
| 89 if (FetchUtils::isSimpleHeader(header.key, header.value)) { | 90 if (FetchUtils::isSimpleHeader(header.key, header.value)) { |
| 90 // Exclude simple headers. | 91 // Exclude simple headers. |
| 91 continue; | 92 continue; |
| (...skipping 89 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 181 // A wildcard Access-Control-Allow-Origin can not be used if credentials are | 182 // A wildcard Access-Control-Allow-Origin can not be used if credentials are |
| 182 // to be sent, even with Access-Control-Allow-Credentials set to true. | 183 // to be sent, even with Access-Control-Allow-Credentials set to true. |
| 183 if (includeCredentials == DoNotAllowStoredCredentials) | 184 if (includeCredentials == DoNotAllowStoredCredentials) |
| 184 return true; | 185 return true; |
| 185 if (response.isHTTP()) { | 186 if (response.isHTTP()) { |
| 186 errorDescription = buildAccessControlFailureMessage( | 187 errorDescription = buildAccessControlFailureMessage( |
| 187 "A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' " | 188 "A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' " |
| 188 "header when the credentials flag is true.", | 189 "header when the credentials flag is true.", |
| 189 securityOrigin); | 190 securityOrigin); |
| 190 | 191 |
| 191 if (context == WebURLRequest::RequestContextXMLHttpRequest) | 192 if (context == WebURLRequest::RequestContextXMLHttpRequest) { |
| 192 errorDescription.append( | 193 errorDescription.append( |
| 193 " The credentials mode of an XMLHttpRequest is controlled by the " | 194 " The credentials mode of an XMLHttpRequest is controlled by the " |
| 194 "withCredentials attribute."); | 195 "withCredentials attribute."); |
| 196 } |
| 195 | 197 |
| 196 return false; | 198 return false; |
| 197 } | 199 } |
| 198 } else if (allowOriginHeaderValue != securityOrigin->toAtomicString()) { | 200 } else if (allowOriginHeaderValue != securityOrigin->toAtomicString()) { |
| 199 if (allowOriginHeaderValue.isNull()) { | 201 if (allowOriginHeaderValue.isNull()) { |
| 200 errorDescription = buildAccessControlFailureMessage( | 202 errorDescription = buildAccessControlFailureMessage( |
| 201 "No 'Access-Control-Allow-Origin' header is present on the requested " | 203 "No 'Access-Control-Allow-Origin' header is present on the requested " |
| 202 "resource.", | 204 "resource.", |
| 203 securityOrigin); | 205 securityOrigin); |
| 204 | 206 |
| 205 if (isInterestingStatusCode(statusCode)) { | 207 if (isInterestingStatusCode(statusCode)) { |
| 206 errorDescription.append(" The response had HTTP status code "); | 208 errorDescription.append(" The response had HTTP status code "); |
| 207 errorDescription.append(String::number(statusCode)); | 209 errorDescription.append(String::number(statusCode)); |
| 208 errorDescription.append('.'); | 210 errorDescription.append('.'); |
| 209 } | 211 } |
| 210 | 212 |
| 211 if (context == WebURLRequest::RequestContextFetch) | 213 if (context == WebURLRequest::RequestContextFetch) { |
| 212 errorDescription.append( | 214 errorDescription.append( |
| 213 " If an opaque response serves your needs, set the request's mode " | 215 " If an opaque response serves your needs, set the request's mode " |
| 214 "to 'no-cors' to fetch the resource with CORS disabled."); | 216 "to 'no-cors' to fetch the resource with CORS disabled."); |
| 217 } |
| 215 | 218 |
| 216 return false; | 219 return false; |
| 217 } | 220 } |
| 218 | 221 |
| 219 String detail; | 222 String detail; |
| 220 if (allowOriginHeaderValue.getString().find(isOriginSeparator, 0) != | 223 if (allowOriginHeaderValue.getString().find(isOriginSeparator, 0) != |
| 221 kNotFound) { | 224 kNotFound) { |
| 222 detail = | 225 detail = |
| 223 "The 'Access-Control-Allow-Origin' header contains multiple values " | 226 "The 'Access-Control-Allow-Origin' header contains multiple values " |
| 224 "'" + | 227 "'" + |
| 225 allowOriginHeaderValue + "', but only one is allowed."; | 228 allowOriginHeaderValue + "', but only one is allowed."; |
| 226 } else { | 229 } else { |
| 227 KURL headerOrigin(KURL(), allowOriginHeaderValue); | 230 KURL headerOrigin(KURL(), allowOriginHeaderValue); |
| 228 if (!headerOrigin.isValid()) | 231 if (!headerOrigin.isValid()) { |
| 229 detail = | 232 detail = |
| 230 "The 'Access-Control-Allow-Origin' header contains the invalid " | 233 "The 'Access-Control-Allow-Origin' header contains the invalid " |
| 231 "value '" + | 234 "value '" + |
| 232 allowOriginHeaderValue + "'."; | 235 allowOriginHeaderValue + "'."; |
| 233 else | 236 } else { |
| 234 detail = "The 'Access-Control-Allow-Origin' header has a value '" + | 237 detail = "The 'Access-Control-Allow-Origin' header has a value '" + |
| 235 allowOriginHeaderValue + | 238 allowOriginHeaderValue + |
| 236 "' that is not equal to the supplied origin."; | 239 "' that is not equal to the supplied origin."; |
| 240 } |
| 237 } | 241 } |
| 238 errorDescription = buildAccessControlFailureMessage(detail, securityOrigin); | 242 errorDescription = buildAccessControlFailureMessage(detail, securityOrigin); |
| 239 if (context == WebURLRequest::RequestContextFetch) | 243 if (context == WebURLRequest::RequestContextFetch) { |
| 240 errorDescription.append( | 244 errorDescription.append( |
| 241 " Have the server send the header with a valid value, or, if an " | 245 " Have the server send the header with a valid value, or, if an " |
| 242 "opaque response serves your needs, set the request's mode to " | 246 "opaque response serves your needs, set the request's mode to " |
| 243 "'no-cors' to fetch the resource with CORS disabled."); | 247 "'no-cors' to fetch the resource with CORS disabled."); |
| 248 } |
| 244 return false; | 249 return false; |
| 245 } | 250 } |
| 246 | 251 |
| 247 if (includeCredentials == AllowStoredCredentials) { | 252 if (includeCredentials == AllowStoredCredentials) { |
| 248 const AtomicString& allowCredentialsHeaderValue = | 253 const AtomicString& allowCredentialsHeaderValue = |
| 249 response.httpHeaderField(allowCredentialsHeaderName); | 254 response.httpHeaderField(allowCredentialsHeaderName); |
| 250 if (allowCredentialsHeaderValue != "true") { | 255 if (allowCredentialsHeaderValue != "true") { |
| 251 errorDescription = buildAccessControlFailureMessage( | 256 errorDescription = buildAccessControlFailureMessage( |
| 252 "Credentials flag is 'true', but the " | 257 "Credentials flag is 'true', but the " |
| 253 "'Access-Control-Allow-Credentials' header is '" + | 258 "'Access-Control-Allow-Credentials' header is '" + |
| (...skipping 159 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 413 // | 418 // |
| 414 // This is equivalent to the step 2 in | 419 // This is equivalent to the step 2 in |
| 415 // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch | 420 // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch |
| 416 if (options.credentialsRequested == ClientDidNotRequestCredentials) | 421 if (options.credentialsRequested == ClientDidNotRequestCredentials) |
| 417 options.allowCredentials = DoNotAllowStoredCredentials; | 422 options.allowCredentials = DoNotAllowStoredCredentials; |
| 418 } | 423 } |
| 419 return true; | 424 return true; |
| 420 } | 425 } |
| 421 | 426 |
| 422 } // namespace blink | 427 } // namespace blink |
| OLD | NEW |