Changeset 173516 in webkit

Timestamp:

Sep 11, 2014, 10:20:18 AM (12 years ago)

Author:

commit-queue@webkit.org

Message:

[WK2] Authentication dialog is displayed for cross-origin XHR
​https://bugs.webkit.org/show_bug.cgi?id=131349

Patch by Youenn Fablet <​youenn.fablet@crf.canon.fr> on 2014-09-11
Reviewed by Alexey Proskuryakov.

Source/WebCore:

• WebCore.exp.in: Export of isAllowedToAskUserForCredentials.
• loader/ResourceLoader.cpp:

(WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Replacing clientCredentialPolicy method. Returns true if credentials can be requested to the user.
(WebCore::ResourceLoader::didReceiveAuthenticationChallenge): Updated to use isAllowedToAskUserForCredentials.

• loader/ResourceLoader.h: Removing clientCredentialPolicy method and adding isAllowedToAskUserForCredentials method.

Source/WebKit2:

Precomputing client credential policy in the Web Process before sending the resource load task to the Network Process.

• NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::didReceiveAuthenticationChallenge): Added an ASSERT to ensure that credential policy is never set to DoNotAskClientForCrossOriginCredentials.

• WebProcess/Network/WebResourceLoadScheduler.cpp:

(WebKit::WebResourceLoadScheduler::scheduleLoad): Precomputing client credential policy to handle the case of cross-origin requests.

• WebProcess/Network/WebResourceLoader.cpp:

(WebKit::WebResourceLoader::willSendRequest): Added a TODO to check whether redirections need a specific handling.

LayoutTests:

• platform/mac-wk2/TestExpectations: Unskipped tests.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/mac-wk2/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/WebCore.exp.in (modified) (1 diff)
• Source/WebCore/loader/ResourceLoader.cpp (modified) (2 diffs)
• Source/WebCore/loader/ResourceLoader.h (modified) (1 diff)
• Source/WebKit2/ChangeLog (modified) (1 diff)
• Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp (modified) (1 diff)
• Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp (modified) (1 diff)
• Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-09-11  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [WK2] Authentication dialog is displayed for cross-origin XHR
+        https://bugs.webkit.org/show_bug.cgi?id=131349
+
+        Reviewed by Alexey Proskuryakov.
+
+        * platform/mac-wk2/TestExpectations: Unskipped tests.
+
 2014-09-11  Chris Fleizach  <cfleizach@apple.com>
 

trunk/LayoutTests/platform/mac-wk2/TestExpectations

@@ -342 +342 @@
 webkit.org/b/127960 [ MountainLion ] http/tests/security/cross-origin-plugin-private-browsing-toggled.html [ Pass Failure ]
 
-webkit.org/b/131349 http/tests/xmlhttprequest/access-control-preflight-credential-async.html [ Failure ]
-webkit.org/b/131349 http/tests/xmlhttprequest/cross-origin-no-authorization.html [ Failure ]
-webkit.org/b/131349 http/tests/xmlhttprequest/cross-origin-no-credential-prompt.html [ Failure ]
-
 webkit.org/b/134550 [ Mavericks ] http/tests/cache/iframe-304-crash.html [ Pass Failure ]
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-09-11  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [WK2] Authentication dialog is displayed for cross-origin XHR
+        https://bugs.webkit.org/show_bug.cgi?id=131349
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCore.exp.in: Export of isAllowedToAskUserForCredentials.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Replacing clientCredentialPolicy method. Returns true if credentials can be requested to the user.
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge): Updated to use isAllowedToAskUserForCredentials.
+        * loader/ResourceLoader.h: Removing clientCredentialPolicy method and adding isAllowedToAskUserForCredentials method.
+
 2014-09-11  Chris Fleizach  <cfleizach@apple.com>
 

trunk/Source/WebCore/WebCore.exp.in

@@ -1694 +1694 @@
 __ZNK7WebCore14ResourceHandle10connectionEv
 __ZNK7WebCore14ResourceLoader11frameLoaderEv
+__ZNK7WebCore14ResourceLoader32isAllowedToAskUserForCredentialsEv
 __ZNK7WebCore14ScrollableArea13scrolledToTopEv
 __ZNK7WebCore14ScrollableArea14scrollAnimatorEv

trunk/Source/WebCore/loader/ResourceLoader.cpp

@@ -539 +539 @@
 }
 
+bool ResourceLoader::isAllowedToAskUserForCredentials() const
+{
+    return m_options.clientCredentialPolicy() == AskClientForAllCredentials || (m_options.clientCredentialPolicy() == DoNotAskClientForCrossOriginCredentials && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()));
+}
+
 void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)
 {
@@ -548 +553 @@
 
     if (m_options.allowCredentials() == AllowStoredCredentials) {
-        if (m_options.clientCredentialPolicy() == AskClientForAllCredentials || (m_options.clientCredentialPolicy() == DoNotAskClientForCrossOriginCredentials && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()))) {
+        if (isAllowedToAskUserForCredentials()) {
             frameLoader()->notifier().didReceiveAuthenticationChallenge(this, challenge);
             return;

trunk/Source/WebCore/loader/ResourceLoader.h

@@ -123 +123 @@
     void setSendCallbackPolicy(SendCallbackPolicy sendLoadCallbacks) { m_options.setSendLoadCallbacks(sendLoadCallbacks); }
     bool shouldSniffContent() const { return m_options.sniffContent() == SniffContent; }
-    ClientCredentialPolicy clientCredentialPolicy() const { return m_options.clientCredentialPolicy(); }
+    WEBCORE_EXPORT bool isAllowedToAskUserForCredentials() const;
 
     bool reachedTerminalState() const { return m_reachedTerminalState; }
+
 
     const ResourceRequest& request() const { return m_request; }

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-09-11  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [WK2] Authentication dialog is displayed for cross-origin XHR
+        https://bugs.webkit.org/show_bug.cgi?id=131349
+
+        Reviewed by Alexey Proskuryakov.
+
+        Precomputing client credential policy in the Web Process before sending the resource load task to the Network Process.
+
+        * NetworkProcess/NetworkResourceLoader.cpp:
+        (WebKit::NetworkResourceLoader::didReceiveAuthenticationChallenge): Added an ASSERT to ensure that credential policy is never set to DoNotAskClientForCrossOriginCredentials.
+        * WebProcess/Network/WebResourceLoadScheduler.cpp:
+        (WebKit::WebResourceLoadScheduler::scheduleLoad): Precomputing client credential policy to handle the case of cross-origin requests.
+        * WebProcess/Network/WebResourceLoader.cpp:
+        (WebKit::WebResourceLoader::willSendRequest): Added a TODO to check whether redirections need a specific handling.
+
 2014-09-11  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp

@@ -358 +358 @@
 {
     ASSERT_UNUSED(handle, handle == m_handle);
-
-    // FIXME (http://webkit.org/b/115291): Since we go straight to the UI process for authentication we don't get WebCore's
-    // cross-origin check before asking the client for credentials.
-    // Therefore we are too permissive in the case where the ClientCredentialPolicy is DoNotAskClientForCrossOriginCredentials.
+    // NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
+    ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);
+
     if (m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials) {
         challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);

trunk/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp

@@ -170 +170 @@
     loadParameters.allowStoredCredentials = allowStoredCredentials;
     // If there is no WebFrame then this resource cannot be authenticated with the client.
-    loadParameters.clientCredentialPolicy = (webFrame && webPage) ? resourceLoader->clientCredentialPolicy() : DoNotAskClientForAnyCredentials;
+    loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader->isAllowedToAskUserForCredentials()) ? AskClientForAllCredentials : DoNotAskClientForAnyCredentials;
     loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;
     loadParameters.isMainResource = resource && resource->type() == CachedResource::MainResource;

trunk/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp

@@ -90 +90 @@
     if (m_coreLoader->documentLoader()->applicationCacheHost()->maybeLoadFallbackForRedirect(m_coreLoader.get(), newRequest, redirectResponse))
         return;
+    // FIXME: Do we need to update NetworkResourceLoader clientCredentialPolicy in case loader policy is DoNotAskClientForCrossOriginCredentials?
     m_coreLoader->willSendRequest(newRequest, redirectResponse);