⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 283565 in webkit


Ignore:
Timestamp:
Oct 5, 2021, 11:48:10 AM (5 years ago)
Author:
Chris Dumez
Message:

Authorization header lost on 30x redirects
​https://bugs.webkit.org/show_bug.cgi?id=230935
<rdar://problem/83689955>

Reviewed by Darin Adler.

Source/WebCore:

CFNetwork drops the Authorization request header in cases of same-origin redirects, which is not as per
the fetch specification [1] and doesn't match the behavior of other browsers.

To address the issue, WebKit adds the Authorization request back in case of a same-origin redirect.

Test: http/tests/fetch/fetch-redirect-same-origin-authorization.html

  • platform/network/cf/ResourceHandleCFNet.cpp:

(WebCore::ResourceHandle::willSendRequest):

  • platform/network/mac/ResourceHandleMac.mm:

(WebCore::ResourceHandle::willSendRequest):

Source/WebKit:

CFNetwork drops the Authorization request header in cases of same-origin redirects, which is not as per
the fetch specification [1] and doesn't match the behavior of other browsers.

To address the issue, WebKit adds the Authorization request back in case of a same-origin redirect.

[1] ​https://fetch.spec.whatwg.org/#concept-http-redirect-fetch

  • NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):

LayoutTests:

  • http/tests/fetch/fetch-redirect-same-origin-authorization-expected.txt: Added.
  • http/tests/fetch/fetch-redirect-same-origin-authorization.html: Added.
  • http/tests/fetch/resources/dump-authorization-header.py: Added.

Add layout test coverage.

  • http/tests/xmlhttprequest/redirections-and-user-headers.html:

Update existing test to reflect behavior change.

Location:
trunk
Files:
3 added
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r283562 r283565  
     12021-10-05  Chris Dumez  <cdumez@apple.com>
     2
     3        Authorization header lost on 30x redirects
     4        https://bugs.webkit.org/show_bug.cgi?id=230935
     5        <rdar://problem/83689955>
     6
     7        Reviewed by Darin Adler.
     8
     9        * http/tests/fetch/fetch-redirect-same-origin-authorization-expected.txt: Added.
     10        * http/tests/fetch/fetch-redirect-same-origin-authorization.html: Added.
     11        * http/tests/fetch/resources/dump-authorization-header.py: Added.
     12        Add layout test coverage.
     13
     14        * http/tests/xmlhttprequest/redirections-and-user-headers.html:
     15        Update existing test to reflect behavior change.
     16
    1172021-10-05  Gabriel Nava Marino  <gnavamarino@apple.com>
    218

  • trunk/LayoutTests/http/tests/xmlhttprequest/redirections-and-user-headers.html

    r272548 r283565  
    88  <body>
    99    <script type="text/javascript">
    10 function doTest(testName, testURL, simpleRequest, changeOrigin)
     10function doTest(testName, testURL, simpleRequest, crossOriginRedirect)
    1111{
    1212  promise_test(function(test) {
    … …  
    3232            assert_true(xhr.responseText.indexOf("x-webkit header found: funky") !== -1, "xhr final request should have a x-webkit=funky header");
    3333            assert_true(xhr.responseText.indexOf("content-type header found: rocky") !== -1, "xhr final request should have a content-type=groovy header");
    34             assert_true(xhr.responseText.indexOf("not found any authorization header") !== -1, "xhr final request should not have an authorization header");
     34            if (crossOriginRedirect)
     35                assert_true(xhr.responseText.indexOf("not found any authorization header") !== -1, "xhr final request should not have an authorization header");
     36            else
     37                assert_true(xhr.responseText.indexOf("authorization header found") !== -1, "xhr final request should have an authorization header");
    3538        }
    3639        testPassed = true;
    … …  
    5154
    5255var simpleRequest = true;
     56var crossOriginRedirect = true;
    5357
    5458doTest("Check headers after same-origin redirection to same-origin resource (simple request)",
    5559        "resources/access-control-preflight-redirect.py?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.py",
    56         simpleRequest);
     60        simpleRequest, !crossOriginRedirect);
    5761
    5862doTest("Check headers after same-origin redirection to same-origin resource (not simple request)",
    5963        "resources/access-control-preflight-redirect.py?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.py",
    60         !simpleRequest);
     64        !simpleRequest, !crossOriginRedirect);
    6165
    6266doTest("Check headers after same origin redirection to cross-origin resource (simple request)",
    6367        "resources/access-control-preflight-redirect.py?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py",
    64         simpleRequest);
     68        simpleRequest, crossOriginRedirect);
    6569
    6670doTest("Check headers after same origin redirection to cross-origin resource (not simple request)",
    6771        "resources/access-control-preflight-redirect.py?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py",
    68         !simpleRequest);
     72        !simpleRequest, crossOriginRedirect);
    6973
    7074doTest("Check headers after cross-origin redirection to same-origin resource (simple request)",
    7175        "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.py",
    72         simpleRequest);
     76        simpleRequest, crossOriginRedirect);
    7377
    7478doTest("Check headers after cross-origin redirection to same-origin resource (not simple request)",
    7579        "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.py",
    76         !simpleRequest);
     80        !simpleRequest, crossOriginRedirect);
    7781
    7882doTest("Check headers after cross-origin redirection to cross-origin resource (simple request)",
    7983        "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py",
    80         simpleRequest);
     84        simpleRequest, !crossOriginRedirect);
    8185
    8286doTest("Check headers after cross-origin redirection to cross-origin resource (not simple request)",
    8387        "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py",
    84         !simpleRequest);
     88        !simpleRequest, !crossOriginRedirect);
    8589
    8690    </script>

  • trunk/Source/WebCore/ChangeLog

    r283564 r283565  
     12021-10-05  Chris Dumez  <cdumez@apple.com>
     2
     3        Authorization header lost on 30x redirects
     4        https://bugs.webkit.org/show_bug.cgi?id=230935
     5        <rdar://problem/83689955>
     6
     7        Reviewed by Darin Adler.
     8
     9        CFNetwork drops the Authorization request header in cases of same-origin redirects, which is not as per
     10        the fetch specification [1] and doesn't match the behavior of other browsers.
     11
     12        To address the issue, WebKit adds the Authorization request back in case of a same-origin redirect.
     13
     14        Test: http/tests/fetch/fetch-redirect-same-origin-authorization.html
     15
     16        * platform/network/cf/ResourceHandleCFNet.cpp:
     17        (WebCore::ResourceHandle::willSendRequest):
     18        * platform/network/mac/ResourceHandleMac.mm:
     19        (WebCore::ResourceHandle::willSendRequest):
     20
    1212021-10-05  Andres Gonzalez  <andresg_22@apple.com>
    222

  • trunk/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp

    r282853 r283565  
    289289        request.clearHTTPOrigin();
    290290    } else {
     291        if (auto authorization = d->m_firstRequest.httpHeaderField(HTTPHeaderName::Authorization); !authorization.isNull())
     292            request.setHTTPHeaderField(HTTPHeaderName::Authorization, authorization);
     293
    291294        // Only consider applying authentication credentials if this is actually a redirect and the redirect
    292295        // URL didn't include credentials of its own.

  • trunk/Source/WebCore/platform/network/mac/ResourceHandleMac.mm

    r282853 r283565  
    445445        request.clearHTTPOrigin();
    446446    } else {
     447        if (auto authorization = d->m_firstRequest.httpHeaderField(HTTPHeaderName::Authorization); !authorization.isNull())
     448            request.setHTTPHeaderField(HTTPHeaderName::Authorization, authorization);
     449
    447450        // Only consider applying authentication credentials if this is actually a redirect and the redirect
    448451        // URL didn't include credentials of its own.

  • trunk/Source/WebKit/ChangeLog

    r283563 r283565  
     12021-10-05  Chris Dumez  <cdumez@apple.com>
     2
     3        Authorization header lost on 30x redirects
     4        https://bugs.webkit.org/show_bug.cgi?id=230935
     5        <rdar://problem/83689955>
     6
     7        Reviewed by Darin Adler.
     8
     9        CFNetwork drops the Authorization request header in cases of same-origin redirects, which is not as per
     10        the fetch specification [1] and doesn't match the behavior of other browsers.
     11
     12        To address the issue, WebKit adds the Authorization request back in case of a same-origin redirect.
     13
     14        [1] https://fetch.spec.whatwg.org/#concept-http-redirect-fetch
     15
     16        * NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
     17        (WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):
     18
    1192021-10-05  Tim Horton  <timothy_horton@apple.com>
    220

  • trunk/Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm

    r283509 r283565  
    507507        request.clearHTTPAuthorization();
    508508        request.clearHTTPOrigin();
     509
     510    } else {
     511        if (auto authorization = m_firstRequest.httpHeaderField(WebCore::HTTPHeaderName::Authorization); !authorization.isNull())
     512            request.setHTTPHeaderField(WebCore::HTTPHeaderName::Authorization, authorization);
     513
    509514#if USE(CREDENTIAL_STORAGE_WITH_NETWORK_SESSION)
    510     } else {
    511515        // Only consider applying authentication credentials if this is actually a redirect and the redirect
    512516        // URL didn't include credentials of its own.
    … …  
    519523                applyBasicAuthorizationHeader(request, m_initialCredential);
    520524            }
     525#endif
    521526        }
    522 #endif
    523527    }
    524528
Note: See TracChangeset for help on using the changeset viewer.