Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2)

Side by Side Diff: third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp

Issue 2417173002: Loading: bulk style errors fix in core/fetch (Closed)
Patch Set: Created 4 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2008 Apple Inc. All Rights Reserved. 2 * Copyright (C) 2008 Apple Inc. All Rights Reserved.
3 * 3 *
4 * Redistribution and use in source and binary forms, with or without 4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions 5 * modification, are permitted provided that the following conditions
6 * are met: 6 * are met:
7 * 1. Redistributions of source code must retain the above copyright 7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer. 8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright 9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the 10 * notice, this list of conditions and the following disclaimer in the
(...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after
69 ResourceRequest preflightRequest(request.url()); 69 ResourceRequest preflightRequest(request.url());
70 updateRequestForAccessControl(preflightRequest, securityOrigin, 70 updateRequestForAccessControl(preflightRequest, securityOrigin,
71 DoNotAllowStoredCredentials); 71 DoNotAllowStoredCredentials);
72 preflightRequest.setHTTPMethod(HTTPNames::OPTIONS); 72 preflightRequest.setHTTPMethod(HTTPNames::OPTIONS);
73 preflightRequest.setHTTPHeaderField(HTTPNames::Access_Control_Request_Method, 73 preflightRequest.setHTTPHeaderField(HTTPNames::Access_Control_Request_Method,
74 AtomicString(request.httpMethod())); 74 AtomicString(request.httpMethod()));
75 preflightRequest.setPriority(request.priority()); 75 preflightRequest.setPriority(request.priority());
76 preflightRequest.setRequestContext(request.requestContext()); 76 preflightRequest.setRequestContext(request.requestContext());
77 preflightRequest.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::All); 77 preflightRequest.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::All);
78 78
79 if (request.isExternalRequest()) 79 if (request.isExternalRequest()) {
80 preflightRequest.setHTTPHeaderField( 80 preflightRequest.setHTTPHeaderField(
81 HTTPNames::Access_Control_Request_External, "true"); 81 HTTPNames::Access_Control_Request_External, "true");
82 }
82 83
83 const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields(); 84 const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
84 85
85 if (requestHeaderFields.size() > 0) { 86 if (requestHeaderFields.size() > 0) {
86 // Fetch API Spec: https://fetch.spec.whatwg.org/#cors-preflight-fetch-0 87 // Fetch API Spec: https://fetch.spec.whatwg.org/#cors-preflight-fetch-0
87 Vector<String> headers; 88 Vector<String> headers;
88 for (const auto& header : requestHeaderFields) { 89 for (const auto& header : requestHeaderFields) {
89 if (FetchUtils::isSimpleHeader(header.key, header.value)) { 90 if (FetchUtils::isSimpleHeader(header.key, header.value)) {
90 // Exclude simple headers. 91 // Exclude simple headers.
91 continue; 92 continue;
(...skipping 89 matching lines...) Expand 10 before | Expand all | Expand 10 after
181 // A wildcard Access-Control-Allow-Origin can not be used if credentials are 182 // A wildcard Access-Control-Allow-Origin can not be used if credentials are
182 // to be sent, even with Access-Control-Allow-Credentials set to true. 183 // to be sent, even with Access-Control-Allow-Credentials set to true.
183 if (includeCredentials == DoNotAllowStoredCredentials) 184 if (includeCredentials == DoNotAllowStoredCredentials)
184 return true; 185 return true;
185 if (response.isHTTP()) { 186 if (response.isHTTP()) {
186 errorDescription = buildAccessControlFailureMessage( 187 errorDescription = buildAccessControlFailureMessage(
187 "A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' " 188 "A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' "
188 "header when the credentials flag is true.", 189 "header when the credentials flag is true.",
189 securityOrigin); 190 securityOrigin);
190 191
191 if (context == WebURLRequest::RequestContextXMLHttpRequest) 192 if (context == WebURLRequest::RequestContextXMLHttpRequest) {
192 errorDescription.append( 193 errorDescription.append(
193 " The credentials mode of an XMLHttpRequest is controlled by the " 194 " The credentials mode of an XMLHttpRequest is controlled by the "
194 "withCredentials attribute."); 195 "withCredentials attribute.");
196 }
195 197
196 return false; 198 return false;
197 } 199 }
198 } else if (allowOriginHeaderValue != securityOrigin->toAtomicString()) { 200 } else if (allowOriginHeaderValue != securityOrigin->toAtomicString()) {
199 if (allowOriginHeaderValue.isNull()) { 201 if (allowOriginHeaderValue.isNull()) {
200 errorDescription = buildAccessControlFailureMessage( 202 errorDescription = buildAccessControlFailureMessage(
201 "No 'Access-Control-Allow-Origin' header is present on the requested " 203 "No 'Access-Control-Allow-Origin' header is present on the requested "
202 "resource.", 204 "resource.",
203 securityOrigin); 205 securityOrigin);
204 206
205 if (isInterestingStatusCode(statusCode)) { 207 if (isInterestingStatusCode(statusCode)) {
206 errorDescription.append(" The response had HTTP status code "); 208 errorDescription.append(" The response had HTTP status code ");
207 errorDescription.append(String::number(statusCode)); 209 errorDescription.append(String::number(statusCode));
208 errorDescription.append('.'); 210 errorDescription.append('.');
209 } 211 }
210 212
211 if (context == WebURLRequest::RequestContextFetch) 213 if (context == WebURLRequest::RequestContextFetch) {
212 errorDescription.append( 214 errorDescription.append(
213 " If an opaque response serves your needs, set the request's mode " 215 " If an opaque response serves your needs, set the request's mode "
214 "to 'no-cors' to fetch the resource with CORS disabled."); 216 "to 'no-cors' to fetch the resource with CORS disabled.");
217 }
215 218
216 return false; 219 return false;
217 } 220 }
218 221
219 String detail; 222 String detail;
220 if (allowOriginHeaderValue.getString().find(isOriginSeparator, 0) != 223 if (allowOriginHeaderValue.getString().find(isOriginSeparator, 0) !=
221 kNotFound) { 224 kNotFound) {
222 detail = 225 detail =
223 "The 'Access-Control-Allow-Origin' header contains multiple values " 226 "The 'Access-Control-Allow-Origin' header contains multiple values "
224 "'" + 227 "'" +
225 allowOriginHeaderValue + "', but only one is allowed."; 228 allowOriginHeaderValue + "', but only one is allowed.";
226 } else { 229 } else {
227 KURL headerOrigin(KURL(), allowOriginHeaderValue); 230 KURL headerOrigin(KURL(), allowOriginHeaderValue);
228 if (!headerOrigin.isValid()) 231 if (!headerOrigin.isValid()) {
229 detail = 232 detail =
230 "The 'Access-Control-Allow-Origin' header contains the invalid " 233 "The 'Access-Control-Allow-Origin' header contains the invalid "
231 "value '" + 234 "value '" +
232 allowOriginHeaderValue + "'."; 235 allowOriginHeaderValue + "'.";
233 else 236 } else {
234 detail = "The 'Access-Control-Allow-Origin' header has a value '" + 237 detail = "The 'Access-Control-Allow-Origin' header has a value '" +
235 allowOriginHeaderValue + 238 allowOriginHeaderValue +
236 "' that is not equal to the supplied origin."; 239 "' that is not equal to the supplied origin.";
240 }
237 } 241 }
238 errorDescription = buildAccessControlFailureMessage(detail, securityOrigin); 242 errorDescription = buildAccessControlFailureMessage(detail, securityOrigin);
239 if (context == WebURLRequest::RequestContextFetch) 243 if (context == WebURLRequest::RequestContextFetch) {
240 errorDescription.append( 244 errorDescription.append(
241 " Have the server send the header with a valid value, or, if an " 245 " Have the server send the header with a valid value, or, if an "
242 "opaque response serves your needs, set the request's mode to " 246 "opaque response serves your needs, set the request's mode to "
243 "'no-cors' to fetch the resource with CORS disabled."); 247 "'no-cors' to fetch the resource with CORS disabled.");
248 }
244 return false; 249 return false;
245 } 250 }
246 251
247 if (includeCredentials == AllowStoredCredentials) { 252 if (includeCredentials == AllowStoredCredentials) {
248 const AtomicString& allowCredentialsHeaderValue = 253 const AtomicString& allowCredentialsHeaderValue =
249 response.httpHeaderField(allowCredentialsHeaderName); 254 response.httpHeaderField(allowCredentialsHeaderName);
250 if (allowCredentialsHeaderValue != "true") { 255 if (allowCredentialsHeaderValue != "true") {
251 errorDescription = buildAccessControlFailureMessage( 256 errorDescription = buildAccessControlFailureMessage(
252 "Credentials flag is 'true', but the " 257 "Credentials flag is 'true', but the "
253 "'Access-Control-Allow-Credentials' header is '" + 258 "'Access-Control-Allow-Credentials' header is '" +
(...skipping 159 matching lines...) Expand 10 before | Expand all | Expand 10 after
413 // 418 //
414 // This is equivalent to the step 2 in 419 // This is equivalent to the step 2 in
415 // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch 420 // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch
416 if (options.credentialsRequested == ClientDidNotRequestCredentials) 421 if (options.credentialsRequested == ClientDidNotRequestCredentials)
417 options.allowCredentials = DoNotAllowStoredCredentials; 422 options.allowCredentials = DoNotAllowStoredCredentials;
418 } 423 }
419 return true; 424 return true;
420 } 425 }
421 426
422 } // namespace blink 427 } // namespace blink
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698