From af45ce34d6943c2a31cfa1d306d6db3b24682634 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Mon, 28 May 2018 11:17:18 +0200 Subject: [PATCH] Fix Origin header and "no-cors" redirects behavior Before this change "no-cors" POST redirects would not have their Origin header value reset as appropriate for certain cross-origin redirects. This is now accomplished by rather than resetting request's origin (which we only did for "cors" fetches and would have bad side effects if we started doing that for "no-cors"), we set request's tainted origin flag. A new flag that indicates when request's origin is tainted and needs to be serialized as null. Tests: https://github.com/w3c/web-platform-tests/pull/11164. Fixes #593. --- fetch.bs | 104 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 55 insertions(+), 49 deletions(-) diff --git a/fetch.bs b/fetch.bs index ce06e151a..61b6ddc14 100644 --- a/fetch.bs +++ b/fetch.bs @@ -950,12 +950,9 @@ user-agent-defined object). Unless otherwise stated it is null. "client" or an origin. Unless stated otherwise it is "client". -

"client" is changed to an -origin during fetching. It -provides a convenient way for standards to not have to set +

"client" is changed to an origin during +fetching. It provides a convenient way for standards to not have to set request's origin. -Request's origin can be -changed during redirects too.

A request has an associated referrer, which is @@ -1149,6 +1146,10 @@ determine whether requests or responses are to be blocked in a given context. [[

+

A request has an associated +tainted origin flag. Unless stated +otherwise, it is unset. +

A request has an associated url list (a list of one or more URLs). Unless stated otherwise, it is a list containing a copy of @@ -1176,13 +1177,10 @@ Unless stated otherwise, it is unset.

This flag is for exclusive use by HTML's navigate algorithm. [[!HTML]] -

A request's -url list, -current url, -redirect count, -response tainting, and -done flag are used as bookkeeping details by the -fetch algorithm. +

A request's tainted origin flag, +url list, current url, redirect count, +response tainting, and done flag are used as bookkeeping +details by the fetch algorithm.

@@ -1211,6 +1209,19 @@ or "worker".
+

Serializing a request origin, given a request request, is to +run these steps: + +

    +

  1. If request's tainted origin flag is set, then return + `null`. + +

  2. Return request's origin, + serialized and isomorphic encoded. +

+ +
+

To clone a request request, run these steps: @@ -1291,6 +1302,7 @@ or "worker". +

Responses

The result of fetch is a @@ -3316,13 +3328,11 @@ optional CORS flag and CORS-preflight flag, run these steps: redirect count by one.

  • If request's mode is "cors", - request's origin is not - same origin with actualResponse's - location URL's - origin, and actualResponse's - location URL - includes credentials, then return a - network error. + actualResponse's location URL + includes credentials, and either request's + tainted origin flag is set or request's origin is + not same origin with actualResponse's location URL's + origin, then return a network error.

  • If CORS flag is set and actualResponse's @@ -3336,10 +3346,11 @@ optional CORS flag and CORS-preflight flag, run these steps: request's body is non-null, and request's body's source is null, then return a network error. -

  • If CORS flag is set and actualResponse's - location URL's origin is not same origin with - request's current url's origin, then set - request's origin to a unique opaque origin. +

  • If actualResponse's location URL's origin is + not same origin with request's current url's + origin and request's origin is not same origin + with request's current url's origin, then set + request's tainted origin flag.

  • If either actualResponse's status is 301 or 302 and request's @@ -3504,10 +3515,8 @@ Range Requests. [[HTTP-RANGE]] However, this is not widely supported by b

  • If the CORS flag is set, httpRequest's method is neither `GET` nor `HEAD`, or httpRequest's mode is "websocket", then append - `Origin`/httpRequest's origin, - serialized and UTF-8 encoded, to - httpRequest's header list. - + `Origin`/the result of serializing a request origin with + httpRequest, to httpRequest's header list.

  • If httpRequest's header list does not contain `User-Agent`, then user agents should @@ -4140,8 +4149,10 @@ steps: initiator is request's initiator, destination is request's destination, origin is request's origin, - referrer is request's referrer, and - referrer policy is request's referrer policy. + referrer is request's referrer, + referrer policy is request's referrer policy, and + tainted origin flag is request's + tainted origin flag.

    The service-workers mode of preflight does not matter as this algorithm uses HTTP-network-or-cache fetch rather than @@ -4269,7 +4280,7 @@ steps: entries where each entry has these fields: