Bug 210326 – module's default cross-origin value should be "anonymous"

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Yusuke Suzuki]

module's default cross-origin value should be "same-origin"

[Yusuke Suzuki]

Created attachment 396064 [details]
Patch

[Yusuke Suzuki]

<rdar://problem/51729982>

[Yusuke Suzuki]

Created attachment 396228 [details]
Patch

[Yusuke Suzuki]

Created attachment 396233 [details]
Patch

[Sam Weinig]

Comment on attachment 396233 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=396233&action=review

> Source/WebCore/ChangeLog:10
> +        The original spec was using "omit" crossorigin for modules when crossorigin is not set / empty.
> +        However, the spec is changed to sending requests with "same-origin" credentials mode by default.
> +        We should follow it.

Given the way "same-origin" is specified is as "anonymous", I think clarifying that in the change log would help make things clearer.

> Source/WebCore/ChangeLog:17
> +        * dom/ScriptElement.cpp:
> +        (WebCore::ScriptElement::requestModuleScript):
> +        * dom/ScriptElementCachedScriptFetcher.cpp:
> +        (WebCore::ScriptElementCachedScriptFetcher::requestModuleScript const):
> +        * html/parser/HTMLResourcePreloader.cpp:
> +        (WebCore::PreloadRequest::resourceRequest):

Its unfortunate this is in three places. Any ideas about how we could refactor to have a single place implementing this part of the spec?

[Yusuke Suzuki]

Comment on attachment 396233 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=396233&action=review

Thanks!

>> Source/WebCore/ChangeLog:10
>> +        We should follow it.
> 
> Given the way "same-origin" is specified is as "anonymous", I think clarifying that in the change log would help make things clearer.

Fixed.

>> Source/WebCore/ChangeLog:17
>> +        (WebCore::PreloadRequest::resourceRequest):
> 
> Its unfortunate this is in three places. Any ideas about how we could refactor to have a single place implementing this part of the spec?

Sounds nice, I'll put this string as  ScriptElementCachedScriptFetcher::defaultCrossOriginModeForModule to share.

[Yusuke Suzuki]

Created attachment 396245 [details]
Patch

[Yusuke Suzuki]

Created attachment 396246 [details]
Patch

[Yusuke Suzuki]

Committed r260003: <https://trac.webkit.org/changeset/260003>

[Yusuke Suzuki]

*** Bug 171550 has been marked as a duplicate of this bug. ***

[WebKit Commit Bot]

Re-opened since this is blocked by bug 210441

[Yusuke Suzuki]

Created attachment 396316 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 396316 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=396316&action=review

> Source/WebCore/ChangeLog:12
> +

C++ part is not changed. Just rewrite tests with cookie instead of basic-authentication since basic-authentication-based tests hit some existing crashes in WK2-Debug bots.

[Yusuke Suzuki]

Thanks Sam! I'll land it once I checked that EWS is green.

[Yusuke Suzuki]

Bots are green. Landing.

[Yusuke Suzuki]

Committed r260038: <https://trac.webkit.org/changeset/260038>

[Yusuke Suzuki]

*** Bug 206811 has been marked as a duplicate of this bug. ***

[Yusuke Suzuki]

*** Bug 171566 has been marked as a duplicate of this bug. ***

[Anne van Kesteren]

*** Bug 189888 has been marked as a duplicate of this bug. ***