[ServiceWorker] Set FetchRequestMode and handle wasFetchedViaServiceWorker.

Source/core/fetch/CrossOriginAccessControl.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 46 matching lines @@
 bool isOnAccessControlResponseHeaderWhitelist(const String& name)
 {
     AtomicallyInitializedStatic(HTTPHeaderSet*, allowedCrossOriginResponseHeaders = createAllowedCrossOriginResponseHeadersSet().leakPtr());
 
     return allowedCrossOriginResponseHeaders->contains(name);
 }
 
 void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* securityOrigin, StoredCredentials allowCredentials)
 {
     request.removeCredentials();
     request.setAllowStoredCredentials(allowCredentials == AllowStoredCredentials);

[yhirano, 2014/10/07 08:03:14]

Requiring to call two methods in all occurrences makes me sad, although I don't
have a great idea.

What do you think about removing these setters from ResourceRequest and adding
 - setFetchCredentialsToInclude()
 - setFetchCredentialsToOmit()
 - setFetchCredentialsToSameOrigin(bool)
instead, for example?

+    request.setFetchCredentialsMode(allowCredentials == AllowStoredCredentials ? WebURLRequest::FetchCredentialsModeInclude : WebURLRequest::FetchCredentialsModeSameOrigin);

[yhirano, 2014/10/07 08:03:14]

This behavior (setting same-origin if allowCredentials is false) is specified on
the XHR spec, right? If it is true, is it appropriate to implement a XHR
behavior here?

 
     if (securityOrigin)
         request.setHTTPOrigin(securityOrigin->toAtomicString());
 }
 
 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& request, SecurityOrigin* securityOrigin)
 {
     ResourceRequest preflightRequest(request.url());
     updateRequestForAccessControl(preflightRequest, securityOrigin, DoNotAllowStoredCredentials);
     preflightRequest.setHTTPMethod("OPTIONS");
@@ skipping 161 matching lines @@
         request.setHTTPOrigin(securityOrigin->toAtomicString());
         // If the user didn't request credentials in the first place, update our
         // state so we neither request them nor expect they must be allowed.
         if (options.credentialsRequested == ClientDidNotRequestCredentials)
             options.allowCredentials = DoNotAllowStoredCredentials;
     }
     return true;
 }
 
 } // namespace blink