[Webkit-unassigned] [Bug 61862] EventSource does not allow cross-domain access

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=61862





--- Comment #13 from Adam Barth <abarth at webkit.org>  2011-06-20 01:52:30 PST ---
(From update of attachment 97728)
View in context: https://bugs.webkit.org/attachment.cgi?id=97728&action=review

> Source/WebCore/loader/CrossOriginAccessControl.cpp:52
>      if (equalIgnoringCase(name, "accept")
>          || equalIgnoringCase(name, "accept-language")
> +        || equalIgnoringCase(name, "cache-control")
>          || equalIgnoringCase(name, "content-language")
> +        || equalIgnoringCase(name, "last-event-id")
>          || equalIgnoringCase(name, "origin"))
>          return true;

This list comes from the CORS spec.  It's not clear we should change it unilaterally.

> Source/WebCore/page/EventSource.cpp:71
> -    , m_origin(context->securityOrigin()->toString())
> +    , m_origin(SecurityOrigin::createFromString(url)->toString())

I don't understand this part of the change.  Why don't the origin come from the context?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.