Add CORS headers to URLRequestRedirectJob.

net/url_request/url_request_redirect_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_redirect_job.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
@@ skipping 60 matching lines @@
 
 int URLRequestRedirectJob::GetResponseCode() const {
   // Should only be called after the URLRequest has been notified there's header
   // information.
   DCHECK(fake_headers_);
   return response_code_;
 }
 
 URLRequestRedirectJob::~URLRequestRedirectJob() {}
 
 void URLRequestRedirectJob::StartAsync() {

[Mike West, 2014/09/03 10:35:28]

Please note somewhere in this class's header that, if CORS-enabled, the redirect
will be visible to script.

[robwu, 2014/09/03 17:45:31]

Done.

   receive_headers_end_ = base::TimeTicks::Now();
   response_time_ = base::Time::Now();
 
   std::string header_string =
       base::StringPrintf("HTTP/1.1 %i Internal Redirect\n"
                              "Location: %s\n"
                              "Non-Authoritative-Reason: %s",
                          response_code_,
                          redirect_destination_.spec().c_str(),
                          redirect_reason_.c_str());
+
+  std::string http_origin;
+  const net::HttpRequestHeaders& request_headers =
+      request_->extra_request_headers();
+  if (request_headers.GetHeader("Origin", &http_origin)) {
+    // If this redirect is used in a cross-origin request, add CORS headers to
+    // make sure that the redirect gets through. Note that the destination URL
+    // is still subject to the usual CORS policy, i.e. the resource will only
+    // be available to web pages if the server serves the response with the
+    // required CORS response headers.
+    // The Origin header is generated by Blink, so its value can safely be used
+    // in the header string.
+    header_string += base::StringPrintf(
+        "\n"
+        "Access-Control-Allow-Origin: %s\n"
+        "Access-Control-Allow-Credentials: true",
+        http_origin.c_str());

[Mike West, 2014/09/03 10:35:27]

It's probably worth DCHECKing that http_origin doesn't contain newlines.

[robwu, 2014/09/03 17:45:31]

https://codereview.chromium.org/491123004 added DCHECKs to make sure that the
HttpRequestHeaders object doesn't contain any invalid characters (NUL, CR, LF).
Because of that check, adding another DCHECK here seems unnecessary.

+  }
+
   fake_headers_ = new HttpResponseHeaders(
       HttpUtil::AssembleRawHeaders(header_string.c_str(),
                                    header_string.length()));
   DCHECK(fake_headers_->IsRedirect(NULL));
 
   request()->net_log().AddEvent(
       NetLog::TYPE_URL_REQUEST_FAKE_RESPONSE_HEADERS_CREATED,
       base::Bind(
           &HttpResponseHeaders::NetLogCallback,
           base::Unretained(fake_headers_.get())));
 
   // TODO(mmenke):  Consider calling the NetworkDelegate with the headers here.
   // There's some weirdness about how to handle the case in which the delegate
   // tries to modify the redirect location, in terms of how IsSafeRedirect
   // should behave, and whether the fragment should be copied.
   URLRequestJob::NotifyHeadersComplete();
 }
 
 }  // namespace net