Skip to content

Commit c06f70a

Browse files
beidsonbeidson
committed
Origin header is preserved on cross-origin redirects.
https://bugs.webkit.org/show_bug.cgi?id=144157. Reviewed by Sam Weinig. Source/WebCore: Tests: http/tests/security/cors-post-redirect-301.html http/tests/security/cors-post-redirect-302.html http/tests/security/cors-post-redirect-307.html http/tests/security/cors-post-redirect-308.html * platform/network/cf/ResourceHandleCFNet.cpp: (WebCore::ResourceHandle::willSendRequest): Always clear any origin header for cross-origin redirects. * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::willSendRequest): Ditto. LayoutTests: * http/tests/security/cors-post-redirect-301-expected.txt: Added. * http/tests/security/cors-post-redirect-301.html: Added. * http/tests/security/cors-post-redirect-302-expected.txt: Added. * http/tests/security/cors-post-redirect-302.html: Added. * http/tests/security/cors-post-redirect-307-expected.txt: Added. * http/tests/security/cors-post-redirect-307.html: Added. * http/tests/security/cors-post-redirect-308-expected.txt: Added. * http/tests/security/cors-post-redirect-308.html: Added. * http/tests/security/resources/cors-post-redirect-target.php: Added. Canonical link: https://commits.webkit.org/162147@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183280 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 3cfce0f commit c06f70a

13 files changed

+157
-5
lines changed

‎LayoutTests/ChangeLog

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,20 @@
1+
2015-04-24 Brady Eidson <beidson@apple.com>
2+
3+
Origin header is preserved on cross-origin redirects.
4+
https://bugs.webkit.org/show_bug.cgi?id=144157.
5+
6+
Reviewed by Sam Weinig.
7+
8+
* http/tests/security/cors-post-redirect-301-expected.txt: Added.
9+
* http/tests/security/cors-post-redirect-301.html: Added.
10+
* http/tests/security/cors-post-redirect-302-expected.txt: Added.
11+
* http/tests/security/cors-post-redirect-302.html: Added.
12+
* http/tests/security/cors-post-redirect-307-expected.txt: Added.
13+
* http/tests/security/cors-post-redirect-307.html: Added.
14+
* http/tests/security/cors-post-redirect-308-expected.txt: Added.
15+
* http/tests/security/cors-post-redirect-308.html: Added.
16+
* http/tests/security/resources/cors-post-redirect-target.php: Added.
17+
118
2015-04-24 Matthew Mirman <mmirman@apple.com>
219

320
Added tests to ensure that Object.prototype.__proto__ native getter and setter do not coerce undefined to this

‎LayoutTests/http/tests/security/cors-post-redirect-301-expected.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
There was no origin header

‎LayoutTests/http/tests/security/cors-post-redirect-301.html

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<head>
2+
<script>
3+
if (window.testRunner) {
4+
testRunner.waitUntilDone();
5+
testRunner.dumpAsText();
6+
}
7+
</script>
8+
</head>
9+
<body>
10+
11+
This test is designed to work only when loaded from http://127.0.0.1:8000
12+
13+
<form id='testForm' method='POST'>
14+
<input id='redircode' type='hidden' name='redircode' value='301'>
15+
</form>
16+
17+
<script>
18+
19+
var form = document.getElementById('testForm');
20+
form.action = "/resources/redirect.php?code=301&url=http://localhost:8000/security/resources/cors-post-redirect-target.php";
21+
form.submit();
22+
23+
</script>
24+
</body>

‎LayoutTests/http/tests/security/cors-post-redirect-302-expected.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
There was no origin header

‎LayoutTests/http/tests/security/cors-post-redirect-302.html

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<head>
2+
<script>
3+
if (window.testRunner) {
4+
testRunner.waitUntilDone();
5+
testRunner.dumpAsText();
6+
}
7+
</script>
8+
</head>
9+
<body>
10+
11+
This test is designed to work only when loaded from http://127.0.0.1:8000
12+
13+
<form id='testForm' method='POST'>
14+
<input id='redircode' type='hidden' name='redircode' value='302'>
15+
</form>
16+
17+
<script>
18+
19+
var form = document.getElementById('testForm');
20+
form.action = "/resources/redirect.php?code=302&url=http://localhost:8000/security/resources/cors-post-redirect-target.php";
21+
form.submit();
22+
23+
</script>
24+
</body>

‎LayoutTests/http/tests/security/cors-post-redirect-307-expected.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
There was no origin header

‎LayoutTests/http/tests/security/cors-post-redirect-307.html

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<head>
2+
<script>
3+
if (window.testRunner) {
4+
testRunner.waitUntilDone();
5+
testRunner.dumpAsText();
6+
}
7+
</script>
8+
</head>
9+
<body>
10+
11+
This test is designed to work only when loaded from http://127.0.0.1:8000
12+
13+
<form id='testForm' method='POST'>
14+
<input id='redircode' type='hidden' name='redircode' value='307'>
15+
</form>
16+
17+
<script>
18+
19+
var form = document.getElementById('testForm');
20+
form.action = "/resources/redirect.php?code=307&url=http://localhost:8000/security/resources/cors-post-redirect-target.php";
21+
form.submit();
22+
23+
</script>
24+
</body>

‎LayoutTests/http/tests/security/cors-post-redirect-308-expected.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
There was no origin header

‎LayoutTests/http/tests/security/cors-post-redirect-308.html

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<head>
2+
<script>
3+
if (window.testRunner) {
4+
testRunner.waitUntilDone();
5+
testRunner.dumpAsText();
6+
}
7+
</script>
8+
</head>
9+
<body>
10+
11+
This test is designed to work only when loaded from http://127.0.0.1:8000
12+
13+
<form id='testForm' method='POST'>
14+
<input id='redircode' type='hidden' name='redircode' value='308'>
15+
</form>
16+
17+
<script>
18+
19+
var form = document.getElementById('testForm');
20+
form.action = "/resources/redirect.php?code=308&url=http://localhost:8000/security/resources/cors-post-redirect-target.php";
21+
form.submit();
22+
23+
</script>
24+
</body>

‎LayoutTests/http/tests/security/resources/cors-post-redirect-target.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?php
2+
$sawOrigin = false;
3+
foreach (getallheaders() as $name => $value) {
4+
if (strtolower($name) == "origin") {
5+
echo "Origin header value: $value";
6+
$sawOrigin = true;
7+
}
8+
}
9+
10+
if (!$sawOrigin)
11+
echo "There was no origin header";
12+
13+
?>
14+
<script>
15+
if (window.testRunner)
16+
testRunner.notifyDone();
17+
</script>

‎Source/WebCore/ChangeLog

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,20 @@
1+
2015-04-24 Brady Eidson <beidson@apple.com>
2+
3+
Origin header is preserved on cross-origin redirects.
4+
https://bugs.webkit.org/show_bug.cgi?id=144157.
5+
6+
Reviewed by Sam Weinig.
7+
8+
Tests: http/tests/security/cors-post-redirect-301.html
9+
http/tests/security/cors-post-redirect-302.html
10+
http/tests/security/cors-post-redirect-307.html
11+
http/tests/security/cors-post-redirect-308.html
12+
13+
* platform/network/cf/ResourceHandleCFNet.cpp:
14+
(WebCore::ResourceHandle::willSendRequest): Always clear any origin header for cross-origin redirects.
15+
* platform/network/mac/ResourceHandleMac.mm:
16+
(WebCore::ResourceHandle::willSendRequest): Ditto.
17+
118
2015-04-24 Brent Fulgham <bfulgham@apple.com>
219

320
Immediate action not functional for embedded PDFs

‎Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -276,9 +276,10 @@ void ResourceHandle::willSendRequest(ResourceRequest& request, const ResourceRes
276276
request.removeCredentials();
277277

278278
if (!protocolHostAndPortAreEqual(request.url(), redirectResponse.url())) {
279-
// If the network layer carries over authentication headers from the original request
280-
// in a cross-origin redirect, we want to clear those headers here.
279+
// The network layer might carry over some headers from the original request that
280+
// we want to strip here because the redirect is cross-origin.
281281
request.clearHTTPAuthorization();
282+
request.clearHTTPOrigin();
282283
} else {
283284
// Only consider applying authentication credentials if this is actually a redirect and the redirect
284285
// URL didn't include credentials of its own.

‎Source/WebCore/platform/network/mac/ResourceHandleMac.mm

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -462,10 +462,10 @@ static bool synchronousWillSendRequestEnabled()
462462
request.removeCredentials();
463463

464464
if (!protocolHostAndPortAreEqual(request.url(), redirectResponse.url())) {
465-
// If the network layer carries over authentication headers from the original request
466-
// in a cross-origin redirect, we want to clear those headers here.
467-
// As of Lion, CFNetwork no longer does this.
465+
// The network layer might carry over some headers from the original request that
466+
// we want to strip here because the redirect is cross-origin.
468467
request.clearHTTPAuthorization();
468+
request.clearHTTPOrigin();
469469
} else {
470470
// Only consider applying authentication credentials if this is actually a redirect and the redirect
471471
// URL didn't include credentials of its own.

0 commit comments

Comments
 (0)