[Webkit-unassigned] [Bug 128816] New: CORS: Fix the handling of redirected request containing Origin null.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=128816

           Summary: CORS: Fix the handling of redirected request
                    containing Origin null.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Keywords: BlinkMergeCandidate
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: youennf at gmail.com


Consider merging: https://chromiumcodereview.appspot.com/20735002

CORS: Fix the handling of redirected request containing Origin null.

Removed the check for securityOrigin->isUnique() in passesAccessControlCheck().
This check was preventing redirected request with "Origin: null" from being
successful even when the response contained "Access-Control-Allow-Origin: null"

The case where the server responds with "Access-Control-Allow-Origin: null"
for a request with "Origin: null" is not a failure case as per the
W3C CORS Resource Sharing alogrithm (http://www.w3.org/TR/cors/#resource-sharing-check-0).
The specification also mentions the following line below Resource Sharing alogrithm:
"The above algorithm also functions when the ASCII serialization of an origin is the string 'null'."

This additional check was added in passesAccessControlCheck() during the
implementation of HTML5 sandbox attribute for iframes. As per the WHATWG
(http://www.whatwg.org/specs/web-apps/current-work/multipage/origin-0.html#sandboxed-origin-browsing-context-flag)
specification when "sandboxed origin browsing context flag" is set it forces
content into a unique origin. For XHR reqests made from the sandboxed iframe CORS
specfication is applicable.
Updated the error description in expected.txt of these related layout test
to match the change. Added another allow test for "Access-Control-Allow-Origin: null"
in addition to the wildcard test ("Access-Control-Allow-Origin: *").

This makes the behavior same as Mozilla Firefox Browser. Also clears the failed tests in
http://w3c-test.org/webappsec/tests/cors/submitted/opera/staging/redirect-origin.htm

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.