Bug 165508 – Add wildcard to Access-Control-Allow-Methods and Access-Control-Allow-Headers

• Component: Page Loading
• Status: RESOLVED FIXED

[sideshowbarker]

May 2016 change in the Fetch spec:
https://github.com/whatwg/fetch/commit/cdbb13c08650b10c9ebfc54d046bec0639e7ba7c

> Enable Access-Control-Expose-Headers, Access-Control-Allow-Methods, 
> and Access-Control-Allow-Headers to use a wildcard, with the same 
> restriction as placed upon wildcards in Access-Control-Allow-Origin. 
> Namely, it can only be used for requests where the credentials mode is "omit".

> The Authorization header still needs to be explicitly listed by 
> Access-Control-Allow-Headers even with the wildcard.

> This also makes the CORS cache wildcard-aware and updates some of the
> terminology around CORS caches to share more concepts.

The new syntax:

Access-Control-Expose-Headers = #field-name / wildcard
Access-Control-Allow-Methods  = #method / wildcard
Access-Control-Allow-Headers  = #field-name-or-wildcard

The difference between the Access-Control-Expose-Headers and Access-Control-Allow-Headers production is that the latter needs to be able to handle `*, Authorization` as header value whereas the former does not.

Blink bug: https://bugs.chromium.org/p/chromium/issues/detail?id=615313
Gecko bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1309358

[Rob Buis]

Created attachment 355603 [details]
Patch

[EWS Watchlist]

Comment on attachment 355603 [details]
Patch

Attachment 355603 [details] did not pass mac-ews (mac):
Output: https://webkit-queues.webkit.org/results/10147623

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.html

[EWS Watchlist]

Created attachment 355604 [details]
Archive of layout-test-results from ews101 for mac-sierra

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews101  Port: mac-sierra  Platform: Mac OS X 10.12.6

[EWS Watchlist]

Comment on attachment 355603 [details]
Patch

Attachment 355603 [details] did not pass mac-wk2-ews (mac-wk2):
Output: https://webkit-queues.webkit.org/results/10147634

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.html

[EWS Watchlist]

Created attachment 355605 [details]
Archive of layout-test-results from ews107 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6

[EWS Watchlist]

Comment on attachment 355603 [details]
Patch

Attachment 355603 [details] did not pass mac-debug-ews (mac):
Output: https://webkit-queues.webkit.org/results/10147672

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.html

[EWS Watchlist]

Created attachment 355610 [details]
Archive of layout-test-results from ews112 for mac-sierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews112  Port: mac-sierra  Platform: Mac OS X 10.12.6

[EWS Watchlist]

Comment on attachment 355603 [details]
Patch

Attachment 355603 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: https://webkit-queues.webkit.org/results/10147700

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.html

[EWS Watchlist]

Created attachment 355611 [details]
Archive of layout-test-results from ews121 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews121  Port: ios-simulator-wk2  Platform: Mac OS X 10.13.6

[Rob Buis]

Created attachment 355638 [details]
Patch

[Frédéric Wang (:fredw)]

Comment on attachment 355638 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=355638&action=review

> Source/WebCore/ChangeLog:10
> +        add this to the check. Same for ccess-Control-Allow-Headers (step 6.7).

Access-Control-Allow-Headers

> Source/WebCore/loader/CrossOriginPreflightResultCache.cpp:86
> +    if (m_methods.contains(method) || (m_methods.contains("*") && storedCredentialsPolicy == StoredCredentialsPolicy::DoNotUse) || isOnAccessControlSimpleRequestMethodWhitelist(method))

I wonder if this and the statement below can be factor out in a separate helper function.

> Source/WebCore/loader/CrossOriginPreflightResultCache.cpp:98
> +        if (!m_headers.contains(header.key) && !(m_headers.contains("*") && storedCredentialsPolicy == StoredCredentialsPolicy::DoNotUse)) {

it seems this check is independent of header, so we can probably hence calculate it only once and take this out of the loop.

[Rob Buis]

Created attachment 356153 [details]
Patch

[EWS Watchlist]

Comment on attachment 356153 [details]
Patch

Attachment 356153 [details] did not pass mac-ews (mac):
Output: https://webkit-queues.webkit.org/results/10211865

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-expose-star.sub.any.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-expose-star.sub.any.worker.html

[EWS Watchlist]

Created attachment 356162 [details]
Archive of layout-test-results from ews102 for mac-sierra

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews102  Port: mac-sierra  Platform: Mac OS X 10.12.6

[EWS Watchlist]

Comment on attachment 356153 [details]
Patch

Attachment 356153 [details] did not pass mac-wk2-ews (mac-wk2):
Output: https://webkit-queues.webkit.org/results/10211880

New failing tests:
imported/w3c/web-platform-tests/service-workers/cache-storage/window/cache-match.https.html
imported/w3c/web-platform-tests/service-workers/cache-storage/worker/cache-match.https.html
imported/w3c/web-platform-tests/service-workers/service-worker/fetch-cors-exposed-header-names.https.html
imported/w3c/web-platform-tests/service-workers/cache-storage/serviceworker/cache-match.https.html

[EWS Watchlist]

Created attachment 356163 [details]
Archive of layout-test-results from ews104 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews104  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6

[EWS Watchlist]

Comment on attachment 356153 [details]
Patch

Attachment 356153 [details] did not pass mac-debug-ews (mac):
Output: https://webkit-queues.webkit.org/results/10212034

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-expose-star.sub.any.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-expose-star.sub.any.worker.html

[EWS Watchlist]

Created attachment 356165 [details]
Archive of layout-test-results from ews115 for mac-sierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews115  Port: mac-sierra  Platform: Mac OS X 10.12.6

[Rob Buis]

Created attachment 356179 [details]
Patch

[EWS Watchlist]

Comment on attachment 356179 [details]
Patch

Attachment 356179 [details] did not pass mac-ews (mac):
Output: https://webkit-queues.webkit.org/results/10215395

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-expose-star.sub.any.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-expose-star.sub.any.worker.html

[EWS Watchlist]

Created attachment 356187 [details]
Archive of layout-test-results from ews103 for mac-sierra

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews103  Port: mac-sierra  Platform: Mac OS X 10.12.6

[EWS Watchlist]

Comment on attachment 356179 [details]
Patch

Attachment 356179 [details] did not pass mac-debug-ews (mac):
Output: https://webkit-queues.webkit.org/results/10215582

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-expose-star.sub.any.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-expose-star.sub.any.worker.html

[EWS Watchlist]

Created attachment 356193 [details]
Archive of layout-test-results from ews116 for mac-sierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews116  Port: mac-sierra  Platform: Mac OS X 10.12.6

[Rob Buis]

Created attachment 356209 [details]
Patch

[Rob Buis]

Created attachment 356815 [details]
Patch

[Rob Buis]

I noticed https://bugs.webkit.org/show_bug.cgi?id=169194 already tracks Access-Control-Expose-Headers wildcard support, so this bug can be restricted to Access-Control-Allow-Methods and Access-Control-Allow-Headers.

[Frédéric Wang (:fredw)]

Comment on attachment 356815 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=356815&action=review

> Source/WebCore/ChangeLog:3
> +        Add wildcard to Access-Control-Expose-Headers, Access-Control-Allow-Methods, and Access-Control-Allow-Headers

I guess you can update the bug title then

> Source/WebCore/ChangeLog:10
> +        add this to the check. Same for ccess-Control-Allow-Headers (step 6.7).

Again, A is missing at ccess-Control-Allow-Headers

> Source/WebCore/loader/CrossOriginPreflightResultCache.cpp:86
> +    if (m_methods.contains(method) || (m_methods.contains("*") && storedCredentialsPolicy == StoredCredentialsPolicy::DoNotUse) || isOnAccessControlSimpleRequestMethodWhitelist(method))

So StoredCredentialsPolicy is the same as the spec's credentials mode (https://fetch.spec.whatwg.org/#concept-request-credentials-mode)? If so then probably we should use the same name conventions in the future. Also, here and below steps 6.5 and 6.7 say we should really check that the credentials mode is not "include" i.e. storedCredentialsPolicy != StoredCredentialsPolicy::Use so that it still works when we have more than two values.

[Rob Buis]

Created attachment 357565 [details]
Patch

[Rob Buis]

Created attachment 371657 [details]
Patch

[EWS Watchlist]

Comment on attachment 371657 [details]
Patch

Attachment 371657 [details] did not pass win-ews (win):
Output: https://webkit-queues.webkit.org/results/12419994

New failing tests:
css3/filters/blur-various-radii.html
imported/blink/fast/canvas/bug382588.html

[EWS Watchlist]

Created attachment 371667 [details]
Archive of layout-test-results from ews211 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews211  Port: win-future  Platform: CYGWIN_NT-10.0-17763-3.0.5-338.x86_64-x86_64-64bit

[Rob Buis]

Created attachment 371706 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 371706 [details]
Patch

Clearing flags on attachment: 371706

Committed r246238: <https://trac.webkit.org/changeset/246238>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/51560580>

[youenn fablet]

*** Bug 169194 has been marked as a duplicate of this bug. ***