Allow redirects for requests that require preflight.

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 143 matching lines @@
     BlockingBehavior blockingBehavior,
     const ThreadableLoaderOptions& options,
     const ResourceLoaderOptions& resourceLoaderOptions)
     : m_client(client),
       m_document(&document),
       m_options(options),
       m_resourceLoaderOptions(resourceLoaderOptions),
       m_forceDoNotAllowStoredCredentials(false),
       m_securityOrigin(m_resourceLoaderOptions.securityOrigin),
       m_sameOriginRequest(false),
-      m_crossOriginNonSimpleRequest(false),
       m_isUsingDataConsumerHandle(false),
       m_async(blockingBehavior == LoadAsynchronously),
       m_requestContext(WebURLRequest::RequestContextUnspecified),
       m_timeoutTimer(this, &DocumentThreadableLoader::didTimeout),
       m_requestStartedSeconds(0.0),
       m_corsRedirectLimit(m_options.crossOriginRequestPolicy == UseAccessControl
                               ? kMaxCORSRedirects
                               : 0),
       m_redirectMode(WebURLRequest::FetchRedirectModeFollow),
       m_overrideReferrer(false) {
@@ skipping 204 matching lines @@
   // example, referrer. We need to accept them. For security, we must reject
   // forbidden headers/methods at the point we accept user's input. Not here.
   if (!request.isExternalRequest() &&
       ((m_options.preflightPolicy == ConsiderPreflight &&
         FetchUtils::isSimpleOrForbiddenRequest(request.httpMethod(),
                                                request.httpHeaderFields())) ||
        m_options.preflightPolicy == PreventPreflight)) {
     prepareCrossOriginRequest(crossOriginRequest);
     loadRequest(crossOriginRequest, crossOriginOptions);
   } else {
-    m_crossOriginNonSimpleRequest = true;
-
     bool shouldForcePreflight =
         request.isExternalRequest() ||
         InspectorInstrumentation::shouldForceCORSPreflight(m_document);
     bool canSkipPreflight =
         CrossOriginPreflightResultCache::shared().canSkipPreflight(
             getSecurityOrigin()->toString(), crossOriginRequest.url(),
             effectiveAllowCredentials(), crossOriginRequest.httpMethod(),
             crossOriginRequest.httpHeaderFields());
     if (canSkipPreflight && !shouldForcePreflight) {
       if (getSecurityOrigin())
@@ skipping 164 matching lines @@
   --m_corsRedirectLimit;
 
   InspectorInstrumentation::didReceiveCORSRedirectResponse(
       document().frame(), resource->identifier(),
       document().frame()->loader().documentLoader(), redirectResponse,
       resource);
 
   bool allowRedirect = false;
   String accessControlErrorDescription;
 
-  if (m_crossOriginNonSimpleRequest) {
-    // Non-simple cross origin requests (both preflight and actual one) are not
-    // allowed to follow redirect.
-    accessControlErrorDescription =
-        "Redirect from '" + redirectResponse.url().getString() + "' to '" +
-        request.url().getString() +
-        "' has been blocked by CORS policy: Request requires preflight, which "
-        "is disallowed to follow cross-origin redirect.";
-  } else if (!CrossOriginAccessControl::isLegalRedirectLocation(
-                 request.url(), accessControlErrorDescription)) {
+  if (!CrossOriginAccessControl::isLegalRedirectLocation(
+          request.url(), accessControlErrorDescription)) {
     accessControlErrorDescription =
         "Redirect from '" + redirectResponse.url().getString() +
         "' has been blocked by CORS policy: " + accessControlErrorDescription;
   } else if (!m_sameOriginRequest &&
              !passesAccessControlCheck(
                  redirectResponse, effectiveAllowCredentials(),
                  getSecurityOrigin(), accessControlErrorDescription,
                  m_requestContext)) {
     // The redirect response must pass the access control check if the original
     // request was not same-origin.
@@ skipping 540 matching lines @@
 }
 
 DEFINE_TRACE(DocumentThreadableLoader) {
   visitor->trace(m_resource);
   visitor->trace(m_document);
   ThreadableLoader::trace(visitor);
   RawResourceClient::trace(visitor);
 }
 
 }  // namespace blink