Bug 185023 – Make cross origin redirection error messages consistent between SubresourceLoader and NetworkLoadChecker

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Misc.

[youenn fablet]

Mak cross origin redirection error messages consistent between SubresourceLoader and NetworkLoadChecker

[youenn fablet]

Created attachment 338854 [details]
Patch

[EWS Watchlist]

Comment on attachment 338854 [details]
Patch

Attachment 338854 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/7464630

New failing tests:
http/tests/xmlhttprequest/redirect-cross-origin-post-sync.html
http/tests/xmlhttprequest/redirect-cross-origin-sync.html
http/tests/xmlhttprequest/access-control-and-redirects.html
http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect.html

[EWS Watchlist]

Created attachment 338859 [details]
Archive of layout-test-results from ews105 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews105  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6

[youenn fablet]

Created attachment 338872 [details]
Patch

[Chris Dumez]

Comment on attachment 338872 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=338872&action=review

> LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-redirect-expected.txt:-1
> -CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8000/security/contentSecurityPolicy/resources/alert-pass.js denied by Cross-Origin Resource Sharing policy: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.

Seems like we're losing useful information here? We no longer know that the issue is related to a redirect?

[youenn fablet]

Comment on attachment 338872 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=338872&action=review

>> LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-redirect-expected.txt:-1
>> -CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8000/security/contentSecurityPolicy/resources/alert-pass.js denied by Cross-Origin Resource Sharing policy: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
> 
> Seems like we're losing useful information here? We no longer know that the issue is related to a redirect?

This is consistent with WebKit1.
"Cross-origin redirection to XXX" is happening when we we get a redirect response that fails COR checks. The message tells that we decide to not follow the redirection.
"Origin XX is not allowed" is happening in the case where we do get a non-redirection response and CORS checks fail.

We could try to come up with a third kind of message for the case of "we followed redirections and the final non-redirect response failed CORS checks".
But we would need to change both SubresourceLoader and NetworkLoadChecker.

[WebKit Commit Bot]

Comment on attachment 338872 [details]
Patch

Clearing flags on attachment: 338872

Committed r231055: <https://trac.webkit.org/changeset/231055>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/39764047>