Chromium Code Reviews Chromium Code Reviews
Issue
20735002:
CORS: Fix the handling of redirected request containing Origin null. (Closed)
DescriptionCORS: Fix the handling of redirected request containing Origin null.
Removed the check for securityOrigin->isUnique() in passesAccessControlCheck().
This check was preventing redirected request with "Origin: null" from being
successful even when the response contained "Access-Control-Allow-Origin: null"
The case where the server responds with "Access-Control-Allow-Origin: null"
for a request with "Origin: null" is not a failure case as per the
W3C CORS Resource Sharing alogrithm (http://www.w3.org/TR/cors/#resource-sharing-check-0).
The specification also mentions the following line below Resource Sharing alogrithm:
"The above algorithm also functions when the ASCII serialization of an origin is the string 'null'."
This additional check was added in passesAccessControlCheck() during the
implementation of HTML5 sandbox attribute for iframes. As per the WHATWG
(http://www.whatwg.org/specs/web-apps/current-work/multipage/origin-0.html#sandboxed-origin-browsing-context-flag)
specification when "sandboxed origin browsing context flag" is set it forces
content into a unique origin. For XHR reqests made from the sandboxed iframe CORS
specfication is applicable.
Updated the error description in expected.txt of these related layout test
to match the change. Added another allow test for "Access-Control-Allow-Origin: null"
in addition to the wildcard test ("Access-Control-Allow-Origin: *").
This makes the behavior same as Mozilla Firefox Browser. Also clears the failed tests in
http://w3c-test.org/webappsec/tests/cors/submitted/opera/staging/redirect-origin.htm
R=abarth@chromium.org, mkwst@chromium.org
BUG=263835
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=155002
Patch Set 1 #Messages
Total messages: 4 (0 generated)
|
