| Index: third_party/WebKit/Source/platform/loader/fetch/CrossOriginAccessControl.cpp
|
| diff --git a/third_party/WebKit/Source/platform/loader/fetch/CrossOriginAccessControl.cpp b/third_party/WebKit/Source/platform/loader/fetch/CrossOriginAccessControl.cpp
|
| index 6fc47feb4560af373b1ee0a72713c7607de3c400..ce1ae247f8d430d8d5955fb404dbd4566f1ae9a2 100644
|
| --- a/third_party/WebKit/Source/platform/loader/fetch/CrossOriginAccessControl.cpp
|
| +++ b/third_party/WebKit/Source/platform/loader/fetch/CrossOriginAccessControl.cpp
|
| @@ -149,15 +149,11 @@ CrossOriginAccessControl::AccessStatus CrossOriginAccessControl::checkAccess(
|
| const ResourceResponse& response,
|
| StoredCredentials includeCredentials,
|
| const SecurityOrigin* securityOrigin) {
|
| - DEFINE_THREAD_SAFE_STATIC_LOCAL(
|
| - AtomicString, allowOriginHeaderName,
|
| - (new AtomicString("access-control-allow-origin")));
|
| - DEFINE_THREAD_SAFE_STATIC_LOCAL(
|
| - AtomicString, allowCredentialsHeaderName,
|
| - (new AtomicString("access-control-allow-credentials")));
|
| - DEFINE_THREAD_SAFE_STATIC_LOCAL(
|
| - AtomicString, allowSuboriginHeaderName,
|
| - (new AtomicString("access-control-allow-suborigin")));
|
| + static const char allowOriginHeaderName[] = "access-control-allow-origin";
|
| + static const char allowCredentialsHeaderName[] =
|
| + "access-control-allow-credentials";
|
| + static const char allowSuboriginHeaderName[] =
|
| + "access-control-allow-suborigin";
|
|
|
| int statusCode = response.httpStatusCode();
|
| if (!statusCode)
|
| @@ -177,8 +173,7 @@ CrossOriginAccessControl::AccessStatus CrossOriginAccessControl::checkAccess(
|
| return kSubOriginMismatch;
|
| }
|
| }
|
| -
|
| - if (allowOriginHeaderValue == starAtom) {
|
| + if (allowOriginHeaderValue == "*") {
|
| // A wildcard Access-Control-Allow-Origin can not be used if credentials are
|
| // to be sent, even with Access-Control-Allow-Credentials set to true.
|
| if (includeCredentials == DoNotAllowStoredCredentials)
|
|
|