Changeset 204795 in webkit


Ignore:
Timestamp:
Aug 23, 2016 3:18:38 AM (8 years ago)
Author:
commit-queue@webkit.org
Message:

Implement redirect support post CORS-preflight
​https://bugs.webkit.org/show_bug.cgi?id=159056

Patch by Youenn Fablet <​youenn@apple.com> on 2016-08-23
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

  • web-platform-tests/fetch/api/cors/cors-redirect-preflight-expected.txt: Added.
  • web-platform-tests/fetch/api/cors/cors-redirect-preflight-worker-expected.txt: Added.
  • web-platform-tests/fetch/api/cors/cors-redirect-preflight-worker.html: Added.
  • web-platform-tests/fetch/api/cors/cors-redirect-preflight.html: Added.
  • web-platform-tests/fetch/api/cors/cors-redirect-preflight.js: Added.

(corsRedirect):

Source/WebCore:

Tests: imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-preflight-worker.html

imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-preflight.html

Covered also by rebased tests.

Enabling to follow cross-origin redirections for not-simple requests, through preflight checks.
Making sure that same-origin redirections to cross-origin resources use preflight if they are not simple.

  • loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::redirectReceived):

LayoutTests:

  • TestExpectations: Skipping new fetch worker test in Debug mode as it may crash and disrupt other tests.
  • http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt:
  • http/tests/xmlhttprequest/redirections-and-user-headers-expected.txt:
  • http/tests/xmlhttprequest/redirections-and-user-headers.html:
Location:
trunk
Files:
5 added
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r204765 r204795  
     12016-08-23  Youenn Fablet  <youenn@apple.com>
     2
     3        Implement redirect support post CORS-preflight
     4        https://bugs.webkit.org/show_bug.cgi?id=159056
     5
     6        Reviewed by Alex Christensen.
     7
     8        * TestExpectations: Skipping new fetch worker test in Debug mode as it may crash and disrupt other tests.
     9        * http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt:
     10        * http/tests/xmlhttprequest/redirections-and-user-headers-expected.txt:
     11        * http/tests/xmlhttprequest/redirections-and-user-headers.html:
     12
    1132016-08-22  Chris Dumez  <cdumez@apple.com>
    214

  • trunk/LayoutTests/TestExpectations

    r204694 r204795  
    355355[ Debug ] imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker.html [ Skip ]
    356356[ Debug ] imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker.html [ Skip ]
     357[ Debug ] imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-preflight-worker.html [ Skip ]
    357358[ Debug ] imported/w3c/web-platform-tests/fetch/api/credentials/authentication-basic-worker.html [ Skip ]
    358359[ Debug ] imported/w3c/web-platform-tests/fetch/api/credentials/cookies-worker.html [ Skip ]

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt

    r204117 r204795  
    44CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&%20%20access-control-allow-origin=http://127.0.0.1:8000 due to access control checks.
    55CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&%20%20url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&%20%20access-control-allow-origin=*. Preflight response is not successful
    6 CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=false&%20%20url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&%20%20access-control-allow-origin=*&%20%20access-control-allow-headers=x-webkit. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
     6CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi. Request header field x-webkit is not allowed by Access-Control-Allow-Headers.
    77Tests that asynchronous XMLHttpRequests handle redirects according to the CORS standard.
    88

  • trunk/LayoutTests/http/tests/xmlhttprequest/redirections-and-user-headers-expected.txt

    r204693 r204795  
    1 CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.php?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.php. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
    2 CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.php?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.php. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
    31
    42PASS Check headers after same-origin redirection to same-origin resource (simple request)
    … …  
    75PASS Check headers after same origin redirection to cross-origin resource (not simple request)
    86PASS Check headers after cross-origin redirection to same-origin resource (simple request)
    9 FAIL Check headers after cross-origin redirection to same-origin resource (not simple request) promise_test: Unhandled rejection with value: "Loading failure"
     7PASS Check headers after cross-origin redirection to same-origin resource (not simple request)
    108PASS Check headers after cross-origin redirection to cross-origin resource (simple request)
    11 FAIL Check headers after cross-origin redirection to cross-origin resource (not simple request) promise_test: Unhandled rejection with value: "Loading failure"
     9PASS Check headers after cross-origin redirection to cross-origin resource (not simple request)
    1210

  • trunk/LayoutTests/http/tests/xmlhttprequest/redirections-and-user-headers.html

    r204693 r204795  
    7272        simpleRequest);
    7373
    74 // FIXME: Thistest will not pass as long as not-simple cross origin requests are not allowed to redirect. See https://bugs.webkit.org/show_bug.cgi?id=159056.
    7574doTest("Check headers after cross-origin redirection to same-origin resource (not simple request)",
    7675        "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.php?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.php",
    … …  
    8180        simpleRequest);
    8281
    83 // FIXME: Thistest will not pass as long as not-simple cross origin requests are not allowed to redirect. See https://bugs.webkit.org/show_bug.cgi?id=159056.
    8482doTest("Check headers after cross-origin redirection to cross-origin resource (not simple request)",
    8583        "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.php?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.php",

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r204765 r204795  
     12016-08-23  Youenn Fablet  <youenn@apple.com>
     2
     3        Implement redirect support post CORS-preflight
     4        https://bugs.webkit.org/show_bug.cgi?id=159056
     5
     6        Reviewed by Alex Christensen.
     7
     8        * web-platform-tests/fetch/api/cors/cors-redirect-preflight-expected.txt: Added.
     9        * web-platform-tests/fetch/api/cors/cors-redirect-preflight-worker-expected.txt: Added.
     10        * web-platform-tests/fetch/api/cors/cors-redirect-preflight-worker.html: Added.
     11        * web-platform-tests/fetch/api/cors/cors-redirect-preflight.html: Added.
     12        * web-platform-tests/fetch/api/cors/cors-redirect-preflight.js: Added.
     13        (corsRedirect):
     14
    1152016-08-22  Chris Dumez  <cdumez@apple.com>
    216

  • trunk/Source/WebCore/ChangeLog

    r204779 r204795  
     12016-08-23  Youenn Fablet  <youenn@apple.com>
     2
     3        Implement redirect support post CORS-preflight
     4        https://bugs.webkit.org/show_bug.cgi?id=159056
     5
     6        Reviewed by Alex Christensen.
     7
     8        Tests: imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-preflight-worker.html
     9               imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-preflight.html
     10        Covered also by rebased tests.
     11
     12        Enabling to follow cross-origin redirections for not-simple requests, through preflight checks.
     13        Making sure that same-origin redirections to cross-origin resources use preflight if they are not simple.
     14
     15        * loader/DocumentThreadableLoader.cpp:
     16        (WebCore::DocumentThreadableLoader::redirectReceived):
     17
    1182016-08-23  Frederic Wang  <fred.wang@free.fr>
    219

  • trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r204693 r204795  
    233233    ASSERT(m_resource->loader());
    234234    ASSERT(m_options.mode == FetchOptions::Mode::Cors);
    235 
    236     // FIXME: We could remove that restriction, since we can use preflighting.
    237     if (!m_simpleRequest) {
    238         reportCrossOriginResourceSharingError(*m_client, redirectResponse.url());
    239         request = ResourceRequest();
    240         return;
    241     }
     235    ASSERT(m_originalHeaders);
    242236
    243237    // Loader might have modified the origin to a unique one, let's reuse it for subsequent loads.
    … …  
    246240    // Except in case where preflight is needed, loading should be able to continue on its own.
    247241    // But we also handle credentials here if it is restricted to SameOrigin.
    248     if (m_options.credentials != FetchOptions::Credentials::SameOrigin)
     242    if (m_options.credentials != FetchOptions::Credentials::SameOrigin && m_simpleRequest && isSimpleCrossOriginAccessRequest(request.httpMethod(), *m_originalHeaders))
    249243        return;
    250244
    … …  
    253247    clearResource();
    254248
    255     ASSERT(m_originalHeaders);
    256249    // Let's fetch the request with the original headers (equivalent to request cloning specified by fetch algorithm).
    257250    // Do not copy the Authorization header if removed by the network layer.
Note: See TracChangeset for help on using the changeset viewer.