Allow redirects for requests that require preflight.

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 143 matching lines @@
     BlockingBehavior blockingBehavior,
     const ThreadableLoaderOptions& options,
     const ResourceLoaderOptions& resourceLoaderOptions)
     : m_client(client),
       m_document(&document),
       m_options(options),
       m_resourceLoaderOptions(resourceLoaderOptions),
       m_forceDoNotAllowStoredCredentials(false),
       m_securityOrigin(m_resourceLoaderOptions.securityOrigin),
       m_sameOriginRequest(false),
-      m_crossOriginNonSimpleRequest(false),
       m_isUsingDataConsumerHandle(false),
       m_async(blockingBehavior == LoadAsynchronously),
       m_requestContext(WebURLRequest::RequestContextUnspecified),
       m_timeoutTimer(this, &DocumentThreadableLoader::didTimeout),
       m_requestStartedSeconds(0.0),
       m_corsRedirectLimit(m_options.crossOriginRequestPolicy == UseAccessControl
                               ? kMaxCORSRedirects
                               : 0),
       m_redirectMode(WebURLRequest::FetchRedirectModeFollow),
       m_didRedirect(false) {
@@ skipping 192 matching lines @@
     // FIXME: We should set it in the caller of DocumentThreadableLoader.
     crossOriginRequest.setFetchCredentialsMode(
         effectiveAllowCredentials() == AllowStoredCredentials
             ? WebURLRequest::FetchCredentialsModeInclude
             : WebURLRequest::FetchCredentialsModeOmit);
     if (m_didRedirect) {
       crossOriginRequest.setHTTPReferrer(m_referrerAfterRedirect);
     }
     loadRequest(crossOriginRequest, crossOriginOptions);
   } else {
-    m_crossOriginNonSimpleRequest = true;
     // Do not set the Origin header for preflight requests.
     updateRequestForAccessControl(crossOriginRequest, 0,
                                   effectiveAllowCredentials());
     // We update the credentials mode according to effectiveAllowCredentials()
     // here for backward compatibility. But this is not correct.
     // FIXME: We should set it in the caller of DocumentThreadableLoader.
     crossOriginRequest.setFetchCredentialsMode(
         effectiveAllowCredentials() == AllowStoredCredentials
             ? WebURLRequest::FetchCredentialsModeInclude
             : WebURLRequest::FetchCredentialsModeOmit);
@@ skipping 168 matching lines @@
 
   --m_corsRedirectLimit;
 
   InspectorInstrumentation::didReceiveCORSRedirectResponse(
       document().frame(), resource->identifier(),
       document().frame()->loader().documentLoader(), redirectResponse,
       resource);
 
   bool allowRedirect = false;
   String accessControlErrorDescription;
 

[yhirano, 2016/10/27 06:19:44]

The preflight request (not a request w/preflight) shouldn't follow redirect,
right?

[Jack Bates, 2016/11/03 17:22:03]

Right. I confirm that if you try to redirect the preflight itself, Chromium
correctly raises a network error, both before and after this CL.

-  if (m_crossOriginNonSimpleRequest) {
-    // Non-simple cross origin requests (both preflight and actual one) are not
-    // allowed to follow redirect.
-    accessControlErrorDescription =
-        "Redirect from '" + redirectResponse.url().getString() + "' to '" +
-        request.url().getString() +
-        "' has been blocked by CORS policy: Request requires preflight, which "
-        "is disallowed to follow cross-origin redirect.";
-  } else if (!CrossOriginAccessControl::isLegalRedirectLocation(
-                 request.url(), accessControlErrorDescription)) {
+  if (!CrossOriginAccessControl::isLegalRedirectLocation(
+          request.url(), accessControlErrorDescription)) {
     accessControlErrorDescription =
         "Redirect from '" + redirectResponse.url().getString() +
         "' has been blocked by CORS policy: " + accessControlErrorDescription;
   } else if (!m_sameOriginRequest &&
              !passesAccessControlCheck(
                  redirectResponse, effectiveAllowCredentials(),
                  getSecurityOrigin(), accessControlErrorDescription,
                  m_requestContext)) {
     // The redirect response must pass the access control check if the original
     // request was not same-origin.
@@ skipping 535 matching lines @@
 }
 
 DEFINE_TRACE(DocumentThreadableLoader) {
   visitor->trace(m_resource);
   visitor->trace(m_document);
   ThreadableLoader::trace(visitor);
   RawResourceClient::trace(visitor);
 }
 
 }  // namespace blink