Skip to content

GitLab

T
tangled
Commit 9fdf93be authored by Mike West's avatar Mike West Committed by Commit Bot
Browse files
Options

Set CORS preflight's `Sec-Fetch-Mode` to `cors`. 

Spec change: https://github.com/whatwg/fetch/pull/916

Bug: 979946
Change-Id: Ic1cd8691c9b06371b94de29a5648fb6c8d7bebed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1702311
Commit-Queue: Mike West <mkwst@chromium.org>
Reviewed-by: default avatarKinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#678272}
parent 334d80f2
Hide whitespace changes
Inline Side-by-side
Showing with 73 additions and 6 deletions
services/network/cors/preflight_controller.cc
View file @ 9fdf93be
...@@ -92,6 +92,7 @@ std::unique_ptr<ResourceRequest> CreatePreflightRequest( ...@@ -92,6 +92,7 @@ std::unique_ptr<ResourceRequest> CreatePreflightRequest(
preflight_request->headers.SetHeader( preflight_request->headers.SetHeader(
header_names::kAccessControlRequestMethod, request.method); header_names::kAccessControlRequestMethod, request.method);
preflight_request->headers.SetHeader("Sec-Fetch-Mode", "cors");
std::string request_headers = CreateAccessControlRequestHeadersHeader( std::string request_headers = CreateAccessControlRequestHeadersHeader(
request.headers, request.is_revalidating); request.headers, request.is_revalidating);
......
services/network/cors/preflight_controller_unittest.cc
View file @ 9fdf93be
...@@ -110,6 +110,21 @@ TEST(PreflightControllerCreatePreflightRequestTest, ...@@ -110,6 +110,21 @@ TEST(PreflightControllerCreatePreflightRequestTest,
header_names::kAccessControlRequestHeaders, &header)); header_names::kAccessControlRequestHeaders, &header));
} }
TEST(PreflightControllerCreatePreflightRequestTest, IncludeSecFetchModeHeader) {
ResourceRequest request;
request.mode = mojom::RequestMode::kCors;
request.credentials_mode = mojom::CredentialsMode::kOmit;
request.request_initiator = url::Origin();
request.headers.SetHeader("X-Custom-Header", "foobar");
std::unique_ptr<ResourceRequest> preflight =
PreflightController::CreatePreflightRequestForTesting(request);
std::string header;
EXPECT_TRUE(preflight->headers.GetHeader("Sec-Fetch-Mode", &header));
EXPECT_EQ("cors", header);
}
TEST(PreflightControllerCreatePreflightRequestTest, IncludeNonSimpleHeader) { TEST(PreflightControllerCreatePreflightRequestTest, IncludeNonSimpleHeader) {
ResourceRequest request; ResourceRequest request;
request.mode = mojom::RequestMode::kCors; request.mode = mojom::RequestMode::kCors;
......
third_party/blink/renderer/core/loader/threadable_loader.cc
View file @ 9fdf93be
...@@ -165,6 +165,7 @@ ThreadableLoader::CreateAccessControlPreflightRequest( ...@@ -165,6 +165,7 @@ ThreadableLoader::CreateAccessControlPreflightRequest(
preflight_request->SetHttpMethod(http_names::kOPTIONS); preflight_request->SetHttpMethod(http_names::kOPTIONS);
preflight_request->SetHttpHeaderField(http_names::kAccessControlRequestMethod, preflight_request->SetHttpHeaderField(http_names::kAccessControlRequestMethod,
request.HttpMethod()); request.HttpMethod());
preflight_request->SetMode(network::mojom::RequestMode::kCors);
preflight_request->SetPriority(request.Priority()); preflight_request->SetPriority(request.Priority());
preflight_request->SetRequestContext(request.GetRequestContext()); preflight_request->SetRequestContext(request.GetRequestContext());
preflight_request->SetCredentialsMode(network::mojom::CredentialsMode::kOmit); preflight_request->SetCredentialsMode(network::mojom::CredentialsMode::kOmit);
......
third_party/blink/web_tests/external/wpt/fetch/sec-metadata/fetch-preflight.tentative.https.sub.html 0 → 100644
View file @ 9fdf93be
<!DOCTYPE html>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<script src=/fetch/sec-metadata/resources/helper.js></script>
<script>
// Site
promise_test(t => {
return fetch("https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-json.py",
{
mode: "cors",
headers: { 'x-test': 'testing' }
})
.then(r => r.json())
.then(j => {
assert_header_equals(j, {
"dest": "empty",
"site": "same-site",
"user": "",
"mode": "cors",
});
});
}, "Same-site fetch with preflight");
promise_test(t => {
return fetch("https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-json.py",
{
mode: "cors",
headers: { 'x-test': 'testing' }
})
.then(r => r.json())
.then(j => {
assert_header_equals(j, {
"dest": "empty",
"site": "cross-site",
"user": "",
"mode": "cors",
});
});
}, "Cross-site fetch with preflight");
</script>
third_party/blink/web_tests/external/wpt/fetch/sec-metadata/resources/echo-as-json.py
View file @ 9fdf93be
...@@ -7,11 +7,21 @@ def main(request, response): ...@@ -7,11 +7,21 @@ def main(request, response):
if "origin" in request.headers: if "origin" in request.headers:
headers.append(("Access-Control-Allow-Origin", request.headers["origin"])) headers.append(("Access-Control-Allow-Origin", request.headers["origin"]))
body = ""
# If we're in a preflight, verify that `Sec-Fetch-Mode` is `cors`.
if request.method == 'OPTIONS':
if request.headers.get("sec-fetch-mode") != "cors":
return (403, "Failed"), [], body
headers.append(("Access-Control-Allow-Methods", "*"))
headers.append(("Access-Control-Allow-Headers", "*"))
else:
body = json.dumps({
"dest": request.headers.get("sec-fetch-dest", ""),
"mode": request.headers.get("sec-fetch-mode", ""),
"site": request.headers.get("sec-fetch-site", ""),
"user": request.headers.get("sec-fetch-user", ""),
})
body = json.dumps({
"dest": request.headers.get("sec-fetch-dest", ""),
"mode": request.headers.get("sec-fetch-mode", ""),
"site": request.headers.get("sec-fetch-site", ""),
"user": request.headers.get("sec-fetch-user", ""),
})
return headers, body return headers, body
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment