Leave out empty-valued Access-Control-Request-Headers: on preflights.

third_party/WebKit/Source/core/fetch/CrossOriginAccessControlTest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/fetch/CrossOriginAccessControl.h"
 
 #include "platform/network/ResourceRequest.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/RefPtr.h"
@@ skipping 30 matching lines @@
 TEST_F(CreateAccessControlPreflightRequestTest, ExcludeSimpleHeaders) {
   ResourceRequest request;
   request.addHTTPHeaderField("Accept", "everything");
   request.addHTTPHeaderField("Accept-Language", "everything");
   request.addHTTPHeaderField("Content-Language", "everything");
   request.addHTTPHeaderField("Save-Data", "on");
 
   ResourceRequest preflight =
       createAccessControlPreflightRequest(request, m_securityOrigin.get());
 
-  EXPECT_EQ("", preflight.httpHeaderField("Access-Control-Request-Headers"));
+  // Do not emit empty-valued headers; an empty list of non-"CORS safelisted"
+  // request headers should cause "Access-Control-Request-Headers:" to be
+  // left out in the preflight request.
+  EXPECT_EQ(nullAtom,
+            preflight.httpHeaderField("Access-Control-Request-Headers"));
 }
 
 TEST_F(CreateAccessControlPreflightRequestTest,
        ExcludeSimpleContentTypeHeader) {
   ResourceRequest request;
   request.addHTTPHeaderField("Content-Type", "text/plain");
 
   ResourceRequest preflight =
       createAccessControlPreflightRequest(request, m_securityOrigin.get());
 
-  EXPECT_EQ("", preflight.httpHeaderField("Access-Control-Request-Headers"));
+  // Empty list also; see comment in test above.
+  EXPECT_EQ(nullAtom,
+            preflight.httpHeaderField("Access-Control-Request-Headers"));
 }
 
 TEST_F(CreateAccessControlPreflightRequestTest, IncludeNonSimpleHeader) {
   ResourceRequest request;
   request.addHTTPHeaderField("X-Custom-Header", "foobar");
 
   ResourceRequest preflight =
       createAccessControlPreflightRequest(request, m_securityOrigin.get());
 
   EXPECT_EQ("x-custom-header",
             preflight.httpHeaderField("Access-Control-Request-Headers"));
 }
 
 TEST_F(CreateAccessControlPreflightRequestTest,
        IncludeNonSimpleContentTypeHeader) {
   ResourceRequest request;
   request.addHTTPHeaderField("Content-Type", "application/octet-stream");
 
   ResourceRequest preflight =
       createAccessControlPreflightRequest(request, m_securityOrigin.get());
 
   EXPECT_EQ("content-type",
             preflight.httpHeaderField("Access-Control-Request-Headers"));
 }
 
 }  // namespace
 
 }  // namespace blink