Changeset 230208 in webkit


Ignore:
Timestamp:
Apr 3, 2018 10:15:17 AM (6 years ago)
Author:
commit-queue@webkit.org
Message:

The referer header is not set after redirect
​https://bugs.webkit.org/show_bug.cgi?id=182644
<rdar://problem/37479048>

Patch by Sihui Liu <​sihui_liu@apple.com> on 2018-04-03
Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Rebaseline some tests for fetch api as they are passing now.

  • web-platform-tests/fetch/api/basic/referrer.any-expected.txt:
  • web-platform-tests/fetch/api/basic/referrer.any.worker-expected.txt:
  • web-platform-tests/fetch/api/redirect/redirect-referrer-expected.txt:
  • web-platform-tests/fetch/api/redirect/redirect-referrer-worker-expected.txt:

Source/WebCore:

Update referrer policy and recompute referrer in redirection check, so Referer header would be set after it's removed from cross-origin request.

Add support for Referrer-Policy header, so referrer policy would be changed based on redirect response.

  • Sources.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • dom/Document.cpp:

(WebCore::Document::processReferrerPolicy):

  • loader/CrossOriginAccessControl.cpp:

(WebCore::updateRequestReferrer):

  • loader/CrossOriginAccessControl.h:
  • loader/ResourceLoader.h:

(WebCore::ResourceLoader::setReferrerPolicy):
(WebCore::ResourceLoader::referrerPolicy const):

  • loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::checkRedirectionCrossOriginAccessControl):
(WebCore::SubresourceLoader::updateReferrerPolicy):

  • loader/SubresourceLoader.h:
  • loader/cache/CachedResourceRequest.cpp:

(WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin):
(WebCore::CachedResourceRequest::updateForAccessControl):
(WebCore::CachedResourceRequest::updateReferrerOriginAndUserAgentHeaders):

  • platform/ReferrerPolicy.cpp: Added.

(WebCore::parseReferrerPolicy):

  • platform/ReferrerPolicy.h:
  • platform/network/HTTPHeaderNames.in:
Location:
trunk
Files:
1 added
17 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r230118 r230208  
     12018-04-03  Sihui Liu  <sihui_liu@apple.com>
     2
     3        The referer header is not set after redirect
     4        https://bugs.webkit.org/show_bug.cgi?id=182644
     5        <rdar://problem/37479048>
     6
     7        Reviewed by Youenn Fablet.
     8
     9        Rebaseline some tests for fetch api as they are passing now.
     10
     11        * web-platform-tests/fetch/api/basic/referrer.any-expected.txt:
     12        * web-platform-tests/fetch/api/basic/referrer.any.worker-expected.txt:
     13        * web-platform-tests/fetch/api/redirect/redirect-referrer-expected.txt:
     14        * web-platform-tests/fetch/api/redirect/redirect-referrer-worker-expected.txt:
     15
    1162018-03-30  Youenn Fablet  <youenn@apple.com>
    217

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/referrer.any-expected.txt

    r215515 r230208  
    22PASS origin-when-cross-origin policy on a same-origin URL
    33PASS origin-when-cross-origin policy on a cross-origin URL
    4 FAIL origin-when-cross-origin policy on a cross-origin URL after same-origin redirection assert_equals: Request's referrer is correct expected (string) "http://localhost:8800/" but got (object) null
     4PASS origin-when-cross-origin policy on a cross-origin URL after same-origin redirection
    55PASS origin-when-cross-origin policy on a same-origin URL after cross-origin redirection
    66PASS Referrer with credentials should be stripped

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/referrer.any.worker-expected.txt

    r215515 r230208  
    22PASS origin-when-cross-origin policy on a same-origin URL
    33PASS origin-when-cross-origin policy on a cross-origin URL
    4 FAIL origin-when-cross-origin policy on a cross-origin URL after same-origin redirection assert_equals: Request's referrer is correct expected (string) "http://localhost:8800/" but got (object) null
     4PASS origin-when-cross-origin policy on a cross-origin URL after same-origin redirection
    55PASS origin-when-cross-origin policy on a same-origin URL after cross-origin redirection
    66PASS Referrer with credentials should be stripped

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-referrer-expected.txt

    r220208 r230208  
    33PASS Same origin redirection, empty init, no-referrer-when-downgrade redirect header 
    44PASS Same origin redirection, empty init, same-origin redirect header 
    5 FAIL Same origin redirection, empty init, origin redirect header  assert_equals: Check referrer header expected "http://localhost:8800/" but got "http://localhost:8800/fetch/api/redirect/redirect-referrer.html"
     5PASS Same origin redirection, empty init, origin redirect header 
    66PASS Same origin redirection, empty init, origin-when-cross-origin redirect header 
    7 FAIL Same origin redirection, empty init, no-referrer redirect header  assert_equals: Check referrer header expected (object) null but got (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html"
    8 FAIL Same origin redirection, empty init, strict-origin redirect header  assert_equals: Check referrer header expected "http://localhost:8800/" but got "http://localhost:8800/fetch/api/redirect/redirect-referrer.html"
     7PASS Same origin redirection, empty init, no-referrer redirect header 
     8PASS Same origin redirection, empty init, strict-origin redirect header 
    99PASS Same origin redirection, empty init, strict-origin-when-cross-origin redirect header 
    1010PASS Same origin redirection, empty redirect header, unsafe-url init 
    … …  
    1616PASS Same origin redirection, empty redirect header, strict-origin init 
    1717PASS Same origin redirection, empty redirect header, strict-origin-when-cross-origin init 
    18 FAIL Cross origin redirection, empty init, unsafe-url redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html" but got (object) null
    19 FAIL Cross origin redirection, empty init, no-referrer-when-downgrade redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html" but got (object) null
     18PASS Cross origin redirection, empty init, unsafe-url redirect header 
     19PASS Cross origin redirection, empty init, no-referrer-when-downgrade redirect header 
    2020PASS Cross origin redirection, empty init, same-origin redirect header 
    21 FAIL Cross origin redirection, empty init, origin redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    22 FAIL Cross origin redirection, empty init, origin-when-cross-origin redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
     21PASS Cross origin redirection, empty init, origin redirect header 
     22PASS Cross origin redirection, empty init, origin-when-cross-origin redirect header 
    2323PASS Cross origin redirection, empty init, no-referrer redirect header 
    24 FAIL Cross origin redirection, empty init, strict-origin redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    25 FAIL Cross origin redirection, empty init, strict-origin-when-cross-origin redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    26 FAIL Cross origin redirection, empty redirect header, unsafe-url init  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html" but got (object) null
    27 FAIL Cross origin redirection, empty redirect header, no-referrer-when-downgrade init  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html" but got (object) null
     24PASS Cross origin redirection, empty init, strict-origin redirect header 
     25PASS Cross origin redirection, empty init, strict-origin-when-cross-origin redirect header 
     26PASS Cross origin redirection, empty redirect header, unsafe-url init 
     27PASS Cross origin redirection, empty redirect header, no-referrer-when-downgrade init 
    2828PASS Cross origin redirection, empty redirect header, same-origin init 
    29 FAIL Cross origin redirection, empty redirect header, origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    30 FAIL Cross origin redirection, empty redirect header, origin-when-cross-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
     29PASS Cross origin redirection, empty redirect header, origin init 
     30PASS Cross origin redirection, empty redirect header, origin-when-cross-origin init 
    3131PASS Cross origin redirection, empty redirect header, no-referrer init 
    32 FAIL Cross origin redirection, empty redirect header, strict-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    33 FAIL Cross origin redirection, empty redirect header, strict-origin-when-cross-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
     32PASS Cross origin redirection, empty redirect header, strict-origin init 
     33PASS Cross origin redirection, empty redirect header, strict-origin-when-cross-origin init 
    3434

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-referrer-worker-expected.txt

    r220208 r230208  
    33PASS Same origin redirection, empty init, no-referrer-when-downgrade redirect header 
    44PASS Same origin redirection, empty init, same-origin redirect header 
    5 FAIL Same origin redirection, empty init, origin redirect header  assert_equals: Check referrer header expected "http://localhost:8800/" but got "http://localhost:8800/fetch/api/redirect/redirect-referrer.js"
     5PASS Same origin redirection, empty init, origin redirect header 
    66PASS Same origin redirection, empty init, origin-when-cross-origin redirect header 
    7 FAIL Same origin redirection, empty init, no-referrer redirect header  assert_equals: Check referrer header expected (object) null but got (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js"
    8 FAIL Same origin redirection, empty init, strict-origin redirect header  assert_equals: Check referrer header expected "http://localhost:8800/" but got "http://localhost:8800/fetch/api/redirect/redirect-referrer.js"
     7PASS Same origin redirection, empty init, no-referrer redirect header 
     8PASS Same origin redirection, empty init, strict-origin redirect header 
    99PASS Same origin redirection, empty init, strict-origin-when-cross-origin redirect header 
    1010PASS Same origin redirection, empty redirect header, unsafe-url init 
    … …  
    1616PASS Same origin redirection, empty redirect header, strict-origin init 
    1717PASS Same origin redirection, empty redirect header, strict-origin-when-cross-origin init 
    18 FAIL Cross origin redirection, empty init, unsafe-url redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js" but got (object) null
    19 FAIL Cross origin redirection, empty init, no-referrer-when-downgrade redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js" but got (object) null
     18PASS Cross origin redirection, empty init, unsafe-url redirect header 
     19PASS Cross origin redirection, empty init, no-referrer-when-downgrade redirect header 
    2020PASS Cross origin redirection, empty init, same-origin redirect header 
    21 FAIL Cross origin redirection, empty init, origin redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    22 FAIL Cross origin redirection, empty init, origin-when-cross-origin redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
     21PASS Cross origin redirection, empty init, origin redirect header 
     22PASS Cross origin redirection, empty init, origin-when-cross-origin redirect header 
    2323PASS Cross origin redirection, empty init, no-referrer redirect header 
    24 FAIL Cross origin redirection, empty init, strict-origin redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    25 FAIL Cross origin redirection, empty init, strict-origin-when-cross-origin redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    26 FAIL Cross origin redirection, empty redirect header, unsafe-url init  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js" but got (object) null
    27 FAIL Cross origin redirection, empty redirect header, no-referrer-when-downgrade init  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js" but got (object) null
     24PASS Cross origin redirection, empty init, strict-origin redirect header 
     25PASS Cross origin redirection, empty init, strict-origin-when-cross-origin redirect header 
     26PASS Cross origin redirection, empty redirect header, unsafe-url init 
     27PASS Cross origin redirection, empty redirect header, no-referrer-when-downgrade init 
    2828PASS Cross origin redirection, empty redirect header, same-origin init 
    29 FAIL Cross origin redirection, empty redirect header, origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    30 FAIL Cross origin redirection, empty redirect header, origin-when-cross-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
     29PASS Cross origin redirection, empty redirect header, origin init 
     30PASS Cross origin redirection, empty redirect header, origin-when-cross-origin init 
    3131PASS Cross origin redirection, empty redirect header, no-referrer init 
    32 FAIL Cross origin redirection, empty redirect header, strict-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    33 FAIL Cross origin redirection, empty redirect header, strict-origin-when-cross-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
     32PASS Cross origin redirection, empty redirect header, strict-origin init 
     33PASS Cross origin redirection, empty redirect header, strict-origin-when-cross-origin init 
    3434

  • trunk/Source/WebCore/ChangeLog

    r230205 r230208  
     12018-04-03  Sihui Liu  <sihui_liu@apple.com>
     2
     3        The referer header is not set after redirect
     4        https://bugs.webkit.org/show_bug.cgi?id=182644
     5        <rdar://problem/37479048>
     6
     7        Reviewed by Youenn Fablet.
     8
     9        Update referrer policy and recompute referrer in redirection check, so Referer header would be set after it's removed from cross-origin request.
     10
     11        Add support for Referrer-Policy header, so referrer policy would be changed based on redirect response.
     12
     13        * Sources.txt:
     14        * WebCore.xcodeproj/project.pbxproj:
     15        * dom/Document.cpp:
     16        (WebCore::Document::processReferrerPolicy):
     17        * loader/CrossOriginAccessControl.cpp:
     18        (WebCore::updateRequestReferrer):
     19        * loader/CrossOriginAccessControl.h:
     20        * loader/ResourceLoader.h:
     21        (WebCore::ResourceLoader::setReferrerPolicy):
     22        (WebCore::ResourceLoader::referrerPolicy const):
     23        * loader/SubresourceLoader.cpp:
     24        (WebCore::SubresourceLoader::checkRedirectionCrossOriginAccessControl):
     25        (WebCore::SubresourceLoader::updateReferrerPolicy):
     26        * loader/SubresourceLoader.h:
     27        * loader/cache/CachedResourceRequest.cpp:
     28        (WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin):
     29        (WebCore::CachedResourceRequest::updateForAccessControl):
     30        (WebCore::CachedResourceRequest::updateReferrerOriginAndUserAgentHeaders):
     31        * platform/ReferrerPolicy.cpp: Added.
     32        (WebCore::parseReferrerPolicy):
     33        * platform/ReferrerPolicy.h:
     34        * platform/network/HTTPHeaderNames.in:
     35
    1362018-04-03  Chris Dumez  <cdumez@apple.com>
    237

  • trunk/Source/WebCore/Sources.txt

    r229694 r230208  
    14661466platform/PlatformStrategies.cpp
    14671467platform/Process.cpp
     1468platform/ReferrerPolicy.cpp
    14681469platform/RemoteCommandListener.cpp
    14691470platform/RuntimeApplicationChecks.cpp

  • trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj

    r230015 r230208  
    1300513005                C9DADBCA1B1D3B25001F17D8 /* JSMediaSession.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMediaSession.h; sourceTree = "<group>"; };
    1300613006                C9F87CFD1B28E5F600979B83 /* MediaSessionEvents.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; path = MediaSessionEvents.h; sourceTree = "<group>"; };
     13007                CA1635DC2072E76900E7D2CE /* ReferrerPolicy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReferrerPolicy.cpp; sourceTree = "<group>"; };
    1300713008                CA3BF67B10D99BAE00E6CE53 /* ScrollAnimator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollAnimator.cpp; sourceTree = "<group>"; };
    1300813009                CA3BF67D10D99BAE00E6CE53 /* ScrollAnimator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollAnimator.h; sourceTree = "<group>"; };
    … …  
    2419024191                                0081FEFD16B0A244008AAA7A /* PublicSuffix.h */,
    2419124192                                5C97A3361F5F7A6500105207 /* RectEdges.h */,
     24193                                CA1635DC2072E76900E7D2CE /* ReferrerPolicy.cpp */,
    2419224194                                9831AE49154225A200FE2644 /* ReferrerPolicy.h */,
    2419324195                                CDFC360318CA61C20026E56F /* RemoteCommandListener.cpp */,

  • trunk/Source/WebCore/dom/Document.cpp

    r229694 r230208  
    34613461        return;
    34623462#endif
    3463 
    3464     // "never" / "default" / "always" are legacy keywords that we will support. They were defined in:
    3465     // https://www.w3.org/TR/2014/WD-referrer-policy-20140807/#referrer-policy-delivery-meta
    3466     if (equalLettersIgnoringASCIICase(policy, "no-referrer") || equalLettersIgnoringASCIICase(policy, "never"))
    3467         setReferrerPolicy(ReferrerPolicy::NoReferrer);
    3468     else if (equalLettersIgnoringASCIICase(policy, "unsafe-url") || equalLettersIgnoringASCIICase(policy, "always"))
    3469         setReferrerPolicy(ReferrerPolicy::UnsafeUrl);
    3470     else if (equalLettersIgnoringASCIICase(policy, "origin"))
    3471         setReferrerPolicy(ReferrerPolicy::Origin);
    3472     else if (equalLettersIgnoringASCIICase(policy, "origin-when-cross-origin"))
    3473         setReferrerPolicy(ReferrerPolicy::OriginWhenCrossOrigin);
    3474     else if (equalLettersIgnoringASCIICase(policy, "same-origin"))
    3475         setReferrerPolicy(ReferrerPolicy::SameOrigin);
    3476     else if (equalLettersIgnoringASCIICase(policy, "strict-origin"))
    3477         setReferrerPolicy(ReferrerPolicy::StrictOrigin);
    3478     else if (equalLettersIgnoringASCIICase(policy, "strict-origin-when-cross-origin"))
    3479         setReferrerPolicy(ReferrerPolicy::StrictOriginWhenCrossOrigin);
    3480     else if (equalLettersIgnoringASCIICase(policy, "no-referrer-when-downgrade") || equalLettersIgnoringASCIICase(policy, "default"))
    3481         setReferrerPolicy(ReferrerPolicy::NoReferrerWhenDowngrade);
    3482     else {
     3463   
     3464    auto referrerPolicy = parseReferrerPolicy(policy, ShouldParseLegacyKeywords::Yes);
     3465    if (!referrerPolicy) {
    34833466        addConsoleMessage(MessageSource::Rendering, MessageLevel::Error, "Failed to set referrer policy: The value '" + policy + "' is not one of 'no-referrer', 'no-referrer-when-downgrade', 'same-origin', 'origin', 'strict-origin', 'origin-when-cross-origin', 'strict-origin-when-cross-origin' or 'unsafe-url'. Defaulting to 'no-referrer'.");
    34843467        setReferrerPolicy(ReferrerPolicy::NoReferrer);
    3485     }
     3468        return;
     3469    }
     3470    setReferrerPolicy(referrerPolicy.value());
    34863471}
    34873472

  • trunk/Source/WebCore/loader/CrossOriginAccessControl.cpp

    r226400 r230208  
    3535#include "SchemeRegistry.h"
    3636#include "SecurityOrigin.h"
     37#include "SecurityPolicy.h"
    3738#include <mutex>
    3839#include <wtf/NeverDestroyed.h>
    … …  
    5859
    5960    return true;
     61}
     62
     63void updateRequestReferrer(ResourceRequest& request, ReferrerPolicy referrerPolicy, const String& outgoingReferrer)
     64{
     65    String newOutgoingReferrer = SecurityPolicy::generateReferrerHeader(referrerPolicy, request.url(), outgoingReferrer);
     66    if (newOutgoingReferrer.isEmpty())
     67        request.clearHTTPReferrer();
     68    else
     69        request.setHTTPReferrer(newOutgoingReferrer);
    6070}
    6171

  • trunk/Source/WebCore/loader/CrossOriginAccessControl.h

    r226126 r230208  
    4343bool isOnAccessControlSimpleRequestMethodWhitelist(const String&);
    4444
     45void updateRequestReferrer(ResourceRequest&, ReferrerPolicy, const String&);
     46   
    4547WEBCORE_EXPORT void updateRequestForAccessControl(ResourceRequest&, SecurityOrigin&, StoredCredentialsPolicy);
    4648WEBCORE_EXPORT ResourceRequest createAccessControlPreflightRequest(const ResourceRequest&, SecurityOrigin&, const String&);

  • trunk/Source/WebCore/loader/ResourceLoader.h

    r230203 r230208  
    160160
    161161    void didReceiveDataOrBuffer(const char*, unsigned, RefPtr<SharedBuffer>&&, long long encodedDataLength, DataPayloadType);
     162   
     163    void setReferrerPolicy(ReferrerPolicy referrerPolicy) { m_options.referrerPolicy = referrerPolicy; }
     164    ReferrerPolicy referrerPolicy() const { return m_options.referrerPolicy; }
    162165
    163166#if PLATFORM(COCOA)

  • trunk/Source/WebCore/loader/SubresourceLoader.cpp

    r229563 r230208  
    3939#include "Frame.h"
    4040#include "FrameLoader.h"
     41#include "HTTPParsers.h"
    4142#include "LinkLoader.h"
    4243#include "Logging.h"
    … …  
    569570        m_origin = SecurityOrigin::createUnique();
    570571
     572    updateReferrerPolicy(redirectResponse.httpHeaderField(HTTPHeaderName::ReferrerPolicy));
     573   
    571574    if (redirectingToNewOrigin) {
    572575        cleanHTTPRequestHeadersForAccessControl(newRequest);
    573576        updateRequestForAccessControl(newRequest, *m_origin, options().storedCredentialsPolicy);
    574577    }
     578   
     579    updateRequestReferrer(newRequest, referrerPolicy(), previousRequest.httpReferrer());
    575580
    576581    return true;
     582}
     583
     584void SubresourceLoader::updateReferrerPolicy(const String& referrerPolicyValue)
     585{
     586    if (referrerPolicyValue.isEmpty())
     587        return;
     588   
     589    // Implementing https://www.w3.org/TR/2017/CR-referrer-policy-20170126/#parse-referrer-policy-from-header.
     590    ReferrerPolicy referrerPolicy = ReferrerPolicy::EmptyString;
     591    for (auto tokenView : StringView { referrerPolicyValue }.split(',')) {
     592        auto token = parseReferrerPolicy(stripLeadingAndTrailingHTTPSpaces(tokenView), ShouldParseLegacyKeywords::No);
     593        if (token && token.value() != ReferrerPolicy::EmptyString)
     594            referrerPolicy = token.value();
     595    }
     596    if (referrerPolicy != ReferrerPolicy::EmptyString)
     597        setReferrerPolicy(referrerPolicy);
    577598}
    578599

  • trunk/Source/WebCore/loader/SubresourceLoader.h

    r229977 r230208  
    8080    void didCancel(const ResourceError&) override;
    8181    void didRetrieveDerivedDataFromCache(const String& type, SharedBuffer&) override;
     82   
     83    void updateReferrerPolicy(const String&);
    8284
    8385#if PLATFORM(COCOA)

  • trunk/Source/WebCore/loader/cache/CachedResourceRequest.cpp

    r226904 r230208  
    3636#include "ImageDecoder.h"
    3737#include "MemoryCache.h"
    38 #include "SecurityPolicy.h"
    3938#include "ServiceWorkerRegistrationData.h"
    4039#include <wtf/NeverDestroyed.h>
    … …  
    103102    m_options.credentials = credentials;
    104103    m_options.storedCredentialsPolicy = credentials == FetchOptions::Credentials::Include ? StoredCredentialsPolicy::Use : StoredCredentialsPolicy::DoNotUse;
    105     WebCore::updateRequestForAccessControl(m_resourceRequest, document.securityOrigin(), m_options.storedCredentialsPolicy);
     104    updateRequestForAccessControl(m_resourceRequest, document.securityOrigin(), m_options.storedCredentialsPolicy);
    106105}
    107106
    … …  
    111110
    112111    m_origin = &document.securityOrigin();
    113     WebCore::updateRequestForAccessControl(m_resourceRequest, *m_origin, m_options.storedCredentialsPolicy);
     112    updateRequestForAccessControl(m_resourceRequest, *m_origin, m_options.storedCredentialsPolicy);
    114113}
    115114
    … …  
    232231void CachedResourceRequest::updateReferrerOriginAndUserAgentHeaders(FrameLoader& frameLoader)
    233232{
    234     // Implementing step 7 to 9 of https://fetch.spec.whatwg.org/#http-network-or-cache-fetch
    235 
    236     String outgoingOrigin;
    237     String outgoingReferrer = m_resourceRequest.httpReferrer();
    238     if (!outgoingReferrer.isNull())
     233    // Implementing step 9 to 11 of https://fetch.spec.whatwg.org/#http-network-or-cache-fetch as of 16 March 2018
     234    String outgoingReferrer = frameLoader.outgoingReferrer();
     235    String outgoingOrigin = frameLoader.outgoingOrigin();
     236    if (m_resourceRequest.hasHTTPReferrer()) {
     237        outgoingReferrer = m_resourceRequest.httpReferrer();
    239238        outgoingOrigin = SecurityOrigin::createFromString(outgoingReferrer)->toString();
    240     else {
    241         outgoingReferrer = frameLoader.outgoingReferrer();
    242         outgoingOrigin = frameLoader.outgoingOrigin();
    243239    }
    244 
    245     outgoingReferrer = SecurityPolicy::generateReferrerHeader(m_options.referrerPolicy, m_resourceRequest.url(), outgoingReferrer);
    246     if (outgoingReferrer.isEmpty())
    247         m_resourceRequest.clearHTTPReferrer();
    248     else
    249         m_resourceRequest.setHTTPReferrer(outgoingReferrer);
     240    updateRequestReferrer(m_resourceRequest, m_options.referrerPolicy, outgoingReferrer);
     241
    250242    FrameLoader::addHTTPOriginIfNeeded(m_resourceRequest, outgoingOrigin);
    251243

  • trunk/Source/WebCore/platform/ReferrerPolicy.h

    r221086 r230208  
    3434
    3535#include <wtf/EnumTraits.h>
     36#include <wtf/Forward.h>
    3637
    3738namespace WebCore {
    … …  
    4849    UnsafeUrl
    4950};
     51
     52enum class ShouldParseLegacyKeywords { No, Yes };
     53   
     54std::optional<ReferrerPolicy> parseReferrerPolicy(StringView, ShouldParseLegacyKeywords);
    5055
    5156}

  • trunk/Source/WebCore/platform/network/HTTPHeaderNames.in

    r226141 r230208  
    7878Range
    7979Referer
     80Referrer-Policy
    8081Refresh
    8182Sec-WebSocket-Accept
Note: See TracChangeset for help on using the changeset viewer.