Consider merging: https://chromiumcodereview.appspot.com/20735002 CORS: Fix the handling of redirected request containing Origin null. Removed the check for securityOrigin->isUnique() in passesAccessControlCheck(). This check was preventing redirected request with "Origin: null" from being successful even when the response contained "Access-Control-Allow-Origin: null" The case where the server responds with "Access-Control-Allow-Origin: null" for a request with "Origin: null" is not a failure case as per the W3C CORS Resource Sharing alogrithm (http://www.w3.org/TR/cors/#resource-sharing-check-0). The specification also mentions the following line below Resource Sharing alogrithm: "The above algorithm also functions when the ASCII serialization of an origin is the string 'null'." This additional check was added in passesAccessControlCheck() during the implementation of HTML5 sandbox attribute for iframes. As per the WHATWG (http://www.whatwg.org/specs/web-apps/current-work/multipage/origin-0.html#sandboxed-origin-browsing-context-flag) specification when "sandboxed origin browsing context flag" is set it forces content into a unique origin. For XHR reqests made from the sandboxed iframe CORS specfication is applicable. Updated the error description in expected.txt of these related layout test to match the change. Added another allow test for "Access-Control-Allow-Origin: null" in addition to the wildcard test ("Access-Control-Allow-Origin: *"). This makes the behavior same as Mozilla Firefox Browser. Also clears the failed tests in http://w3c-test.org/webappsec/tests/cors/submitted/opera/staging/redirect-origin.htm
Created attachment 224215 [details] Patch
Comment on attachment 224215 [details] Patch Attachment 224215 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.appspot.com/results/5238515575029760 New failing tests: http/tests/xmlhttprequest/redirect-cors-origin-null.html
Created attachment 224222 [details] Archive of layout-test-results from webkit-ews-14 for mac-mountainlion-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: webkit-ews-14 Port: mac-mountainlion-wk2 Platform: Mac OS X 10.8.5
Comment on attachment 224215 [details] Patch Attachment 224215 [details] did not pass mac-ews (mac): Output: http://webkit-queues.appspot.com/results/5712387772514304 New failing tests: http/tests/xmlhttprequest/redirect-cors-origin-null.html
Created attachment 224224 [details] Archive of layout-test-results from webkit-ews-07 for mac-mountainlion The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: webkit-ews-07 Port: mac-mountainlion Platform: Mac OS X 10.8.5
Comment on attachment 224215 [details] Patch Attachment 224215 [details] did not pass mac-ews (mac): Output: http://webkit-queues.appspot.com/results/5573610399858688 New failing tests: http/tests/xmlhttprequest/redirect-cors-origin-null.html
Created attachment 224228 [details] Archive of layout-test-results from webkit-ews-06 for mac-mountainlion The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: webkit-ews-06 Port: mac-mountainlion Platform: Mac OS X 10.8.5
Patch is failing
(In reply to comment #6) > (From update of attachment 224215 [details]) > Attachment 224215 [details] did not pass mac-ews (mac): > Output: http://webkit-queues.appspot.com/results/5573610399858688 > > New failing tests: > http/tests/xmlhttprequest/redirect-cors-origin-null.html Test is failing due to mac port network layer inserting "Accept-Encoding" header which then makes cross origin not simple. The preflight check fails as "Accept-Encoding" is not authorized. Patch in https://bugs.webkit.org/show_bug.cgi?id=116075 clears the "Accept-Encoding" header in case of a cross-origin request triggered from a redirect response. This should take care of the failing test.
Created attachment 268962 [details] Rebasing
Comment on attachment 268962 [details] Rebasing r=me.Please confirm the win and gtk-wk2 EWS bots are green, then you can land.
Comment on attachment 268962 [details] Rebasing Clearing flags on attachment: 268962 Committed r195100: <http://trac.webkit.org/changeset/195100>
All reviewed patches have been landed. Closing bug.