Apply custom header fields from WebsitePolicies to same-domain requests

• Component: New Bugs
• Status: RESOLVED FIXED

[Alex Christensen]

Apply custom header fields from WebsitePolicies to same-domain requests

[Alex Christensen]

Created attachment 323925 [details]
Patch

[Daniel Bates]

Comment on attachment 323925 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=323925&action=review

> Source/WebCore/loader/cache/CachedResourceLoader.cpp:770
> +    if (frame() && m_documentLoader && !m_documentLoader->customHeaderFields().isEmpty()) {
> +        bool sameOriginRequest = false;
> +        auto requestedOrigin = SecurityOrigin::create(url);
> +        if (type == CachedResource::Type::MainResource) {
> +            if (frame()->isMainFrame())
> +                sameOriginRequest = true;
> +            else if (auto* topDocument = frame()->mainFrame().document())
> +                sameOriginRequest = topDocument->securityOrigin().isSameSchemeHostPort(requestedOrigin.get());
> +        } else if (document()) {
> +            sameOriginRequest = document()->topDocument().securityOrigin().isSameSchemeHostPort(requestedOrigin.get())
> +                && document()->securityOrigin().isSameSchemeHostPort(requestedOrigin.get());
> +        }
> +        if (sameOriginRequest) {
> +            for (auto& field : m_documentLoader->customHeaderFields())
> +                request.resourceRequest().addHTTPHeaderField(field.name(), field.value());
> +        }
> +    }

This does not seem like it will apply the custom headers to a subframe or child window navigated to about:blank or a blob URL (*) page or sub-resources loaded from them. Notice that about:blank inherits the security origin of its parent/opener frame.

(*) with the same origin as the document that has custom headers

[Alex Christensen]

Created attachment 324566 [details]
Patch

[Alex Christensen]

(In reply to Daniel Bates from comment #2)
> This does not seem like it will apply the custom headers to a subframe or
> child window navigated to about:blank or a blob URL (*) page or
> sub-resources loaded from them. Notice that about:blank inherits the
> security origin of its parent/opener frame.
I added a test verifying that this case behaves correctly.

[Alex Christensen]

http://trac.webkit.org/r223909

[Alex Christensen]

A few problems being fixed in https://bugs.webkit.org/show_bug.cgi?id=179064

[Radar WebKit Bug Importer]

<rdar://problem/35568718>