Bug 239119 – <link rel=preconnect> always sends credentials to different-origin, ignoring crossorigin=anonymous

• Component: Page Loading
• Status: RESOLVED FIXED

[Noam Rosenthal]

Given <link rel=preconnect href="https://some-other-origin" crossorigin=anonymous>
I believe from reading the code that the "anonymous" bit would be ignored:

Looking at Source/WebCore/loader/LinkLoader.cpp, line 217:

    if (equalIgnoringASCIICase(params.crossOrigin, "anonymous") && document.securityOrigin().isSameOriginDomain(SecurityOrigin::create(href)))
        storageCredentialsPolicy = StoredCredentialsPolicy::DoNotUse;

If I understand this line correctly, it would mean something like:

useCredentials = link.crossorigin != 'anonymous' || !same_origin(link.href, document.origin)

So any preconnect to a different-origin href would send credentials :(

https://github.com/WebKit/WebKit/blob/8a5b17627ecd1a551b59978434f64378b4943bc7/Source/WebCore/loader/LinkLoader.cpp#L217

(It's a bit difficult to WPT this or show how this is ...)

[Radar WebKit Bug Importer]

<rdar://problem/91643534>

[youenn fablet]

Created attachment 458352 [details]
Patch

[John Wilander]

Comment on attachment 458352 [details]
Patch

r=me

[EWS]

Tools/Scripts/svn-apply failed to apply attachment 458352 [details] to trunk.
Please resolve the conflicts and upload a new patch.

[youenn fablet]

Created attachment 458427 [details]
Patch for landing

[EWS]

Committed r293503 (250034@main): <https://commits.webkit.org/250034@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 458427 [details].