Attachment #282769 for bug #159413

View Details Raw Unified Return to Bug 159413

| Differences between



2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159413

        Reviewed by NOBODY (OOPS!).

        ClientCredentialPolicy had three values (not ask, ask, ask only for same origin).
        The distinction between allowing cross-origin or same-origin credentials is misleading as it is not supported
        for synchronous loads and not supported by Network process.
        It is best replaced by a boolean option (ask or not ask).

        Same-origin ClientCredentialPolicy option was only used by DocumentThreadableLoader for asynchronous loads.
        Since DocumentThreadableLoader is already computing whether the request is cross-origin, it can also computes
        whther credentials may be requested or not. In case of cross-origin redirections, credentials are omitted, thus
        disabling any possibility for requesting credentials for cross-origin resources after redirections.

        Moving ClientCredentialPolicy to ResourceLoaderOptions since it is not used by platform code except for some
        mac-specific code that is already using ResourceLoaderOptions.

        Covered by existing tests.

        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::startPreflight): Setting clearly credential mode to Omit credentials.
        (WebCore::CrossOriginPreflightChecker::doPreflight): Ditto.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): AskClientForAllCredentials ->
        ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::loadRequest): Disabling requesting credentials for any cross-origin request.
        * loader/FrameLoader.h:
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Ditto.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Disabling client credential request if ClientCredentialPolicy is CannotAskClientForCredentials.
        Otherwise, returns true if fetch credentials mode allows it.
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
        (WebCore::ResourceLoaderOptions::clientCredentialPolicy): Deleted.
        (WebCore::ResourceLoaderOptions::setClientCredentialPolicy): Deleted.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading): DoNotAskClientForAnyCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
        This is ok as credentials mode is omit and stored credentials are not allowed.
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
        * platform/network/ResourceHandleTypes.h:
        * xml/XSLTProcessorLibxslt.cpp: DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        This is ok as this is a synchronous load.
        (WebCore::docLoaderFunc):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::openFunc): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        This is ok as this is a synchronous load.

2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove CredentialRequest ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159404




2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159413

        Reviewed by NOBODY (OOPS!).

        Renaming of ClientCredentialPolicy values.

        * NetworkProcess/Downloads/DownloadManager.cpp:
        (WebKit::DownloadManager::startDownload):
        * NetworkProcess/NetworkLoad.cpp:
        (WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace):
        (WebKit::NetworkLoad::didReceiveAuthenticationChallenge):
        * NetworkProcess/NetworkLoadParameters.h:
        * NetworkProcess/NetworkResourceLoadParameters.cpp:
        (WebKit::NetworkResourceLoadParameters::NetworkResourceLoadParameters):
        * NetworkProcess/NetworkResourceLoader.cpp:
        (WebKit::NetworkResourceLoader::NetworkResourceLoader):
        * WebProcess/Network/WebLoaderStrategy.cpp:
        (WebKit::WebLoaderStrategy::scheduleLoad):
        * WebProcess/Network/WebResourceLoader.cpp:
        (WebKit::WebResourceLoader::willSendRequest):

2016-07-04  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Coordinated Graphics] Modernize and cleanup CompositingCoordinator



void CrossOriginPreflightChecker::startPreflight()
{
    auto options = m_loader.options();
    options.credentials = FetchOptions::Credentials::Omit;
    options.setSecurityCheck(DoSecurityCheck);
    // Don't sniff content or send load callbacks for the preflight request.
    options.setSendLoadCallbacks(DoNotSendCallbacks);

    ResourceError error;
    ResourceResponse response;
    RefPtr<SharedBuffer> data;
    unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, error, response, data);

    if (!error.isNull() && response.httpStatusCode() <= 0) {
        error.setType(ResourceError::Type::AccessControl);

Lines 1510-1516 void DocumentLoader::startLoadingMainResource() a/Source/WebCore/loader/DocumentLoader.cpp_sec1
- a/Source/WebCore/loader/DocumentLoader.cpp -1 / +1 lines
1510	// If this is a reload the cache layer might have made the previous request conditional. DocumentLoader can't handle 304 responses itself.	1510	// If this is a reload the cache layer might have made the previous request conditional. DocumentLoader can't handle 304 responses itself.
1511	request.makeUnconditional();	1511	request.makeUnconditional();
1512		1512
1513	static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);	1513	static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
1514	CachedResourceRequest cachedResourceRequest(request, mainResourceLoadOptions);	1514	CachedResourceRequest cachedResourceRequest(request, mainResourceLoadOptions);
1515	cachedResourceRequest.setInitiator(*this);	1515	cachedResourceRequest.setInitiator(*this);
1516	m_mainResource = m_cachedResourceLoader->requestMainResource(cachedResourceRequest);	1516	m_mainResource = m_cachedResourceLoader->requestMainResource(cachedResourceRequest);




    if (m_async) {
        ThreadableLoaderOptions options = m_options;
        options.clientCredentialPolicy = m_sameOriginRequest ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;

        CachedResourceRequest newRequest(request, options);
        if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())

    ResourceResponse response;
    unsigned long identifier = std::numeric_limits<unsigned long>::max();
    if (m_document.frame())
        identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy, error, response, data);

    if (!error.isNull() && response.httpStatusCode() <= 0) {
        if (requestURL.isLocalFile()) {

Lines 39-44 a/Source/WebCore/loader/FrameLoader.h_sec1
- a/Source/WebCore/loader/FrameLoader.h +1 lines
39	#include "PageThrottler.h"	39	#include "PageThrottler.h"
40	#include "ResourceHandleTypes.h"	40	#include "ResourceHandleTypes.h"
41	#include "ResourceLoadNotifier.h"	41	#include "ResourceLoadNotifier.h"
		42	#include "ResourceLoaderOptions.h"
42	#include "ResourceRequestBase.h"	43	#include "ResourceRequestBase.h"
43	#include "SecurityContext.h"	44	#include "SecurityContext.h"
44	#include "Timer.h"	45	#include "Timer.h"

Lines 66-72 RefPtr<PlatformMediaResource> MediaResourceLoader::requestResource(const Resourc a/Source/WebCore/loader/MediaResourceLoader.cpp_sec1
- a/Source/WebCore/loader/MediaResourceLoader.cpp -1 / +1 lines
66	auto cachingPolicy = options & LoadOption::DisallowCaching ? CachingPolicy::DisallowCaching : CachingPolicy::AllowCaching;	66	auto cachingPolicy = options & LoadOption::DisallowCaching ? CachingPolicy::DisallowCaching : CachingPolicy::AllowCaching;
67		67
68	// FIXME: Skip Content Security Policy check if the element that inititated this request is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.	68	// FIXME: Skip Content Security Policy check if the element that inititated this request is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.
69	CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, cachingPolicy));	69	CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, cachingPolicy));
70		70
71	cacheRequest.setAsPotentiallyCrossOrigin(m_crossOriginMode, *m_document);	71	cacheRequest.setAsPotentiallyCrossOrigin(m_crossOriginMode, *m_document);
72		72

Lines 43-49 namespace WebCore { a/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp_sec1
- a/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp -1 / +1 lines
43	// FIXME: Skip Content Security Policy check when associated plugin element is in a user agent shadow tree.	43	// FIXME: Skip Content Security Policy check when associated plugin element is in a user agent shadow tree.
44	// See <https://bugs.webkit.org/show_bug.cgi?id=146663>.	44	// See <https://bugs.webkit.org/show_bug.cgi?id=146663>.
45	NetscapePlugInStreamLoader::NetscapePlugInStreamLoader(Frame& frame, NetscapePlugInStreamLoaderClient& client)	45	NetscapePlugInStreamLoader::NetscapePlugInStreamLoader(Frame& frame, NetscapePlugInStreamLoaderClient& client)
46	: ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching))	46	: ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching))
47	, m_client(&client)	47	, m_client(&client)
48	{	48	{
49	#if ENABLE(CONTENT_EXTENSIONS)	49	#if ENABLE(CONTENT_EXTENSIONS)

Lines 687-693 bool ResourceLoader::shouldUseCredentialStorage() a/Source/WebCore/loader/ResourceLoader.cpp_sec1
- a/Source/WebCore/loader/ResourceLoader.cpp -1 / +3 lines
687		687
688	bool ResourceLoader::isAllowedToAskUserForCredentials() const	688	bool ResourceLoader::isAllowedToAskUserForCredentials() const
689	{	689	{
690	return m_options.clientCredentialPolicy() == AskClientForAllCredentials \|\| (m_options.clientCredentialPolicy() == DoNotAskClientForCrossOriginCredentials && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()));	690	if (m_options.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials)
		691	return false;
		692	return m_options.credentials == FetchOptions::Credentials::Include \|\| (m_options.credentials == FetchOptions::Credentials::SameOrigin && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()));
691	}	693	}
692		694
693	void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)	695	void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)



    DisallowCaching
};

enum class ClientCredentialPolicy : uint8_t {
    CannotAskClientForCredentials,
    MayAskClientForCredentials
};

struct ResourceLoaderOptions : public FetchOptions {
    ResourceLoaderOptions()
        : m_sendLoadCallbacks(DoNotSendCallbacks)
        , m_sniffContent(DoNotSniffContent)
        , m_dataBufferingPolicy(BufferData)
        , m_allowCredentials(DoNotAllowStoredCredentials)
        , m_clientCredentialPolicy(DoNotAskClientForAnyCredentials)
        , m_securityCheck(DoSecurityCheck)
        , m_certificateInfoPolicy(DoNotIncludeCertificateInfo)
    {

        , m_sniffContent(sniffContent)
        , m_dataBufferingPolicy(dataBufferingPolicy)
        , m_allowCredentials(allowCredentials)
        , m_clientCredentialPolicy(credentialPolicy)
        , m_securityCheck(securityCheck)
        , m_certificateInfoPolicy(certificateInfoPolicy)
        , m_contentSecurityPolicyImposition(contentSecurityPolicyImposition)
        , m_defersLoadingPolicy(defersLoadingPolicy)
        , m_cachingPolicy(cachingPolicy)
        , clientCredentialPolicy(credentialPolicy)
    {
        this->credentials = credentials;
        this->mode = mode;

    void setDataBufferingPolicy(DataBufferingPolicy policy) { m_dataBufferingPolicy = policy; }
    StoredCredentials allowCredentials() const { return static_cast<StoredCredentials>(m_allowCredentials); }
    void setAllowCredentials(StoredCredentials allow) { m_allowCredentials = allow; }
    ClientCredentialPolicy clientCredentialPolicy() const { return static_cast<ClientCredentialPolicy>(m_clientCredentialPolicy); }
    void setClientCredentialPolicy(ClientCredentialPolicy policy) { m_clientCredentialPolicy = policy; }
    SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }
    void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }
    CertificateInfoPolicy certificateInfoPolicy() const { return static_cast<CertificateInfoPolicy>(m_certificateInfoPolicy); }

    unsigned m_sniffContent : 1;
    unsigned m_dataBufferingPolicy : 1;
    unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.
    unsigned m_clientCredentialPolicy : 2; // When we should ask the client for credentials (if we allow credentials at all).
    unsigned m_securityCheck : 1;
    unsigned m_certificateInfoPolicy : 1; // Whether the response should include certificate info.
    ContentSecurityPolicyImposition m_contentSecurityPolicyImposition { ContentSecurityPolicyImposition::DoPolicyCheck };
    DefersLoadingPolicy m_defersLoadingPolicy { DefersLoadingPolicy::AllowDefersLoading };
    CachingPolicy m_cachingPolicy { CachingPolicy::AllowCaching };

    ClientCredentialPolicy clientCredentialPolicy { ClientCredentialPolicy::CannotAskClientForCredentials };
};

} // namespace WebCore



        memoryCache.add(*userSheet);
    // FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?

    userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
    
    return userSheet;
}


const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()
{
    static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
    return options;
}


Lines 59-65 void IconLoader::startLoading() a/Source/WebCore/loader/icon/IconLoader.cpp_sec1
- a/Source/WebCore/loader/icon/IconLoader.cpp -1 / +1 lines
59	return;	59	return;
60		60
61	// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.	61	// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
62	CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForAnyCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));	62	CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
63		63
64	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);	64	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
65	request.setInitiator(cachedResourceRequestInitiators().icon);	65	request.setInitiator(cachedResourceRequestInitiators().icon);

Lines 71-77 void WebCoreAVCFResourceLoader::startLoading() a/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp_sec1
- a/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp -1 / +1 lines
71	RetainPtr<CFURLRequestRef> urlRequest = AVCFAssetResourceLoadingRequestGetURLRequest(m_avRequest.get());	71	RetainPtr<CFURLRequestRef> urlRequest = AVCFAssetResourceLoadingRequestGetURLRequest(m_avRequest.get());
72		72
73	// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.	73	// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
74	CachedResourceRequest request(ResourceRequest(urlRequest.get()), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));	74	CachedResourceRequest request(ResourceRequest(urlRequest.get()), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));
75		75
76	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);	76	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
77	CachedResourceLoader* loader = m_parent->player()->cachedResourceLoader();	77	CachedResourceLoader* loader = m_parent->player()->cachedResourceLoader();

Lines 69-75 void WebCoreAVFResourceLoader::startLoading() a/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm_sec1
- a/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm -1 / +1 lines
69		69
70	// FIXME: Skip Content Security Policy check if the element that inititated this request	70	// FIXME: Skip Content Security Policy check if the element that inititated this request
71	// is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.	71	// is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.
72	CachedResourceRequest request(nsRequest, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));	72	CachedResourceRequest request(nsRequest, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));
73	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);	73	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
74	if (auto* loader = m_parent->player()->cachedResourceLoader())	74	if (auto* loader = m_parent->player()->cachedResourceLoader())
75	m_resource = loader->requestMedia(request);	75	m_resource = loader->requestMedia(request);



    DoNotAllowStoredCredentials
};

enum ClientCredentialPolicy {
    AskClientForAllCredentials,
    DoNotAskClientForCrossOriginCredentials,
    DoNotAskClientForAnyCredentials
};

} // namespace WebCore

#endif // ResourceHandleTypes_h

Lines 127-133 static xmlDocPtr docLoaderFunc(const xmlChar* uri, a/Source/WebCore/xml/XSLTProcessorLibxslt.cpp_sec1
- a/Source/WebCore/xml/XSLTProcessorLibxslt.cpp -1 / +1 lines
127		127
128	bool requestAllowed = globalCachedResourceLoader->frame() && globalCachedResourceLoader->document()->securityOrigin()->canRequest(url);	128	bool requestAllowed = globalCachedResourceLoader->frame() && globalCachedResourceLoader->document()->securityOrigin()->canRequest(url);
129	if (requestAllowed) {	129	if (requestAllowed) {
130	globalCachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);	130	globalCachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, error, response, data);
131	if (error.isNull())	131	if (error.isNull())
132	requestAllowed = globalCachedResourceLoader->document()->securityOrigin()->canRequest(response.url());	132	requestAllowed = globalCachedResourceLoader->document()->securityOrigin()->canRequest(response.url());
133	else if (data)	133	else if (data)

Lines 463-469 static void* openFunc(const char* uri) a/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp_sec1
- a/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp -1 / +1 lines
463	// FIXME: We should restore the original global error handler as well.	463	// FIXME: We should restore the original global error handler as well.
464		464
465	if (cachedResourceLoader->frame())	465	if (cachedResourceLoader->frame())
466	cachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);	466	cachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, error, response, data);
467	}	467	}
468		468
469	// We have to check the URL again after the load to catch redirects.	469	// We have to check the URL again after the load to catch redirects.

Lines 53-59 void DownloadManager::startDownload(SessionID sessionID, DownloadID downloadID, a/Source/WebKit2/NetworkProcess/Downloads/DownloadManager.cpp_sec1
- a/Source/WebKit2/NetworkProcess/Downloads/DownloadManager.cpp -1 / +1 lines
53	NetworkLoadParameters parameters;	53	NetworkLoadParameters parameters;
54	parameters.sessionID = sessionID;	54	parameters.sessionID = sessionID;
55	parameters.request = request;	55	parameters.request = request;
56	parameters.clientCredentialPolicy = AskClientForAllCredentials;	56	parameters.clientCredentialPolicy = ClientCredentialPolicy::MayAskClientForCredentials;
57	m_pendingDownloads.add(downloadID, std::make_unique<PendingDownload>(WTFMove(parameters), downloadID));	57	m_pendingDownloads.add(downloadID, std::make_unique<PendingDownload>(WTFMove(parameters), downloadID));
58	#else	58	#else
59	auto download = std::make_unique<Download>(*this, downloadID, request, suggestedName);	59	auto download = std::make_unique<Download>(*this, downloadID, request, suggestedName);




void NetworkLoad::didReceiveChallenge(const AuthenticationChallenge& challenge, ChallengeCompletionHandler&& completionHandler)
{
    // NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
    ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);

    // Handle server trust evaluation at platform-level if requested, for performance reasons.
    if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested
        && !NetworkProcess::singleton().canHandleHTTPSServerTrustEvaluation()) {

        return;
    }

    if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
        completionHandler(AuthenticationChallengeDisposition::UseCredential, { });
        return;
    }

void NetworkLoad::didReceiveAuthenticationChallenge(ResourceHandle* handle, const AuthenticationChallenge& challenge)
{
    ASSERT_UNUSED(handle, handle == m_handle);
    // NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
    ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);

    if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
        challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
        return;
    }

Lines 45-51 public: a/Source/WebKit2/NetworkProcess/NetworkLoadParameters.h_sec1
- a/Source/WebKit2/NetworkProcess/NetworkLoadParameters.h -1 / +1 lines
45	WebCore::ResourceRequest request;	45	WebCore::ResourceRequest request;
46	WebCore::ContentSniffingPolicy contentSniffingPolicy { WebCore::SniffContent };	46	WebCore::ContentSniffingPolicy contentSniffingPolicy { WebCore::SniffContent };
47	WebCore::StoredCredentials allowStoredCredentials { WebCore::DoNotAllowStoredCredentials };	47	WebCore::StoredCredentials allowStoredCredentials { WebCore::DoNotAllowStoredCredentials };
48	WebCore::ClientCredentialPolicy clientCredentialPolicy { WebCore::DoNotAskClientForAnyCredentials };	48	WebCore::ClientCredentialPolicy clientCredentialPolicy { WebCore::ClientCredentialPolicy::CannotAskClientForCredentials };
49	bool shouldClearReferrerOnHTTPSToHTTPRedirect { true };	49	bool shouldClearReferrerOnHTTPSToHTTPRedirect { true };
50	bool defersLoading { false };	50	bool defersLoading { false };
51	bool needsCertificateInfo { false };	51	bool needsCertificateInfo { false };

Lines 41-47 NetworkResourceLoadParameters::NetworkResourceLoadParameters() a/Source/WebKit2/NetworkProcess/NetworkResourceLoadParameters.cpp_sec1
- a/Source/WebKit2/NetworkProcess/NetworkResourceLoadParameters.cpp -1 / +1 lines
41	, sessionID(SessionID::emptySessionID())	41	, sessionID(SessionID::emptySessionID())
42	, contentSniffingPolicy(SniffContent)	42	, contentSniffingPolicy(SniffContent)
43	, allowStoredCredentials(DoNotAllowStoredCredentials)	43	, allowStoredCredentials(DoNotAllowStoredCredentials)
44	, clientCredentialPolicy(DoNotAskClientForAnyCredentials)	44	, clientCredentialPolicy(ClientCredentialPolicy::CannotAskClientForCredentials)
45	, shouldClearReferrerOnHTTPSToHTTPRedirect(true)	45	, shouldClearReferrerOnHTTPSToHTTPRedirect(true)
46	, defersLoading(false)	46	, defersLoading(false)
47	, needsCertificateInfo(false)	47	, needsCertificateInfo(false)

Lines 86-92 NetworkResourceLoader::NetworkResourceLoader(const NetworkResourceLoadParameters a/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp_sec1
- a/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp -1 / +1 lines
86	ASSERT(RunLoop::isMain());	86	ASSERT(RunLoop::isMain());
87	// FIXME: This is necessary because of the existence of EmptyFrameLoaderClient in WebCore.	87	// FIXME: This is necessary because of the existence of EmptyFrameLoaderClient in WebCore.
88	// Once bug 116233 is resolved, this ASSERT can just be "m_webPageID && m_webFrameID"	88	// Once bug 116233 is resolved, this ASSERT can just be "m_webPageID && m_webFrameID"
89	ASSERT((m_parameters.webPageID && m_parameters.webFrameID) \|\| m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials);	89	ASSERT((m_parameters.webPageID && m_parameters.webFrameID) \|\| m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials);
90		90
91	if (originalRequest().httpBody()) {	91	if (originalRequest().httpBody()) {
92	for (const auto& element : originalRequest().httpBody()->elements()) {	92	for (const auto& element : originalRequest().httpBody()->elements()) {



    loadParameters.contentSniffingPolicy = contentSniffingPolicy;
    loadParameters.allowStoredCredentials = allowStoredCredentials;
    // If there is no WebFrame then this resource cannot be authenticated with the client.
    loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader.isAllowedToAskUserForCredentials()) ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
    loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;
    loadParameters.defersLoading = resourceLoader.defersLoading();
    loadParameters.needsCertificateInfo = resourceLoader.shouldIncludeCertificateInfo();
    loadParameters.maximumBufferingTime = maximumBufferingTime(resource);

    ASSERT((loadParameters.webPageID && loadParameters.webFrameID) || loadParameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials);

    if (!WebProcess::singleton().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(loadParameters), 0)) {
        WEBLOADERSTRATEGY_LOG_ALWAYS_ERROR("WebLoaderStrategy::scheduleLoad: Unable to schedule resource with the NetworkProcess with priority = %d, pageID = %llu, frameID = %llu", static_cast<int>(resourceLoader.request().priority()), static_cast<unsigned long long>(loadParameters.webPageID), static_cast<unsigned long long>(loadParameters.webFrameID));

Lines 84-90 void WebResourceLoader::willSendRequest(ResourceRequest&& proposedRequest, Resou a/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp_sec1
- a/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp -1 / +1 lines
84		84
85	if (m_coreLoader->documentLoader()->applicationCacheHost()->maybeLoadFallbackForRedirect(m_coreLoader.get(), proposedRequest, redirectResponse))	85	if (m_coreLoader->documentLoader()->applicationCacheHost()->maybeLoadFallbackForRedirect(m_coreLoader.get(), proposedRequest, redirectResponse))
86	return;	86	return;
87	// FIXME: Do we need to update NetworkResourceLoader clientCredentialPolicy in case loader policy is DoNotAskClientForCrossOriginCredentials?	87	// FIXME: Do we need to update NetworkResourceLoader clientCredentialPolicy in case loader policy is FetchOptions::Credentials::SameOrigin?
88	m_coreLoader->willSendRequest(WTFMove(proposedRequest), redirectResponse, [protectedThis](ResourceRequest&& request) {	88	m_coreLoader->willSendRequest(WTFMove(proposedRequest), redirectResponse, [protectedThis](ResourceRequest&& request) {
89	if (!protectedThis->m_coreLoader)	89	if (!protectedThis->m_coreLoader)
90	return;	90	return;

Return to Bug 159413

Lines 354-360 void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur a/Source/WebCore/loader/DocumentThreadableLoader.cpp_sec1
- a/Source/WebCore/loader/DocumentThreadableLoader.cpp -2 / +2 lines
354		354
355	if (m_async) {	355	if (m_async) {
356	ThreadableLoaderOptions options = m_options;	356	ThreadableLoaderOptions options = m_options;
357	options.setClientCredentialPolicy(DoNotAskClientForCrossOriginCredentials);	357	options.clientCredentialPolicy = m_sameOriginRequest ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
358		358
359	CachedResourceRequest newRequest(request, options);	359	CachedResourceRequest newRequest(request, options);
360	if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())	360	if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())
Lines 373-379 void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur a/Source/WebCore/loader/DocumentThreadableLoader.cpp_sec2
373	ResourceResponse response;	373	ResourceResponse response;
374	unsigned long identifier = std::numeric_limits<unsigned long>::max();	374	unsigned long identifier = std::numeric_limits<unsigned long>::max();
375	if (m_document.frame())	375	if (m_document.frame())
376	identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy(), error, response, data);	376	identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy, error, response, data);
377		377
378	if (!error.isNull() && response.httpStatusCode() <= 0) {	378	if (!error.isNull() && response.httpStatusCode() <= 0) {
379	if (requestURL.isLocalFile()) {	379	if (requestURL.isLocalFile()) {

Lines 241-247 CachedResourceHandle<CachedCSSStyleSheet> CachedResourceLoader::requestUserCSSSt a/Source/WebCore/loader/cache/CachedResourceLoader.cpp_sec1
- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp -2 / +2 lines
241	memoryCache.add(*userSheet);	241	memoryCache.add(*userSheet);
242	// FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?	242	// FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?
243		243
244	userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));	244	userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
245		245
246	return userSheet;	246	return userSheet;
247	}	247	}
Lines 1190-1196 void CachedResourceLoader::printPreloadStats() a/Source/WebCore/loader/cache/CachedResourceLoader.cpp_sec2
1190		1190
1191	const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()	1191	const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()
1192	{	1192	{
1193	static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);	1193	static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
1194	return options;	1194	return options;
1195	}	1195	}
1196		1196

Lines 214-222 void NetworkLoad::willPerformHTTPRedirection(ResourceResponse&& response, Resour a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp_sec1
- a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp -7 / +2 lines
214		214
215	void NetworkLoad::didReceiveChallenge(const AuthenticationChallenge& challenge, ChallengeCompletionHandler&& completionHandler)	215	void NetworkLoad::didReceiveChallenge(const AuthenticationChallenge& challenge, ChallengeCompletionHandler&& completionHandler)
216	{	216	{
217	// NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
218	ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);
219
220	// Handle server trust evaluation at platform-level if requested, for performance reasons.	217	// Handle server trust evaluation at platform-level if requested, for performance reasons.
221	if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested	218	if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested
222	&& !NetworkProcess::singleton().canHandleHTTPSServerTrustEvaluation()) {	219	&& !NetworkProcess::singleton().canHandleHTTPSServerTrustEvaluation()) {
Lines 353-359 void NetworkLoad::continueCanAuthenticateAgainstProtectionSpace(bool result) a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp_sec2
353	return;	350	return;
354	}	351	}
355		352
356	if (m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials) {	353	if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
357	completionHandler(AuthenticationChallengeDisposition::UseCredential, { });	354	completionHandler(AuthenticationChallengeDisposition::UseCredential, { });
358	return;	355	return;
359	}	356	}
Lines 420-429 bool NetworkLoad::shouldUseCredentialStorage(ResourceHandle* handle) a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp_sec3
420	void NetworkLoad::didReceiveAuthenticationChallenge(ResourceHandle* handle, const AuthenticationChallenge& challenge)	417	void NetworkLoad::didReceiveAuthenticationChallenge(ResourceHandle* handle, const AuthenticationChallenge& challenge)
421	{	418	{
422	ASSERT_UNUSED(handle, handle == m_handle);	419	ASSERT_UNUSED(handle, handle == m_handle);
423	// NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
424	ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);
425		420
426	if (m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials) {	421	if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
427	challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);	422	challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
428	return;	423	return;
429	}	424	}

Lines 194-206 void WebLoaderStrategy::scheduleLoad(ResourceLoader& resourceLoader, CachedResou a/Source/WebKit2/WebProcess/Network/WebLoaderStrategy.cpp_sec1
- a/Source/WebKit2/WebProcess/Network/WebLoaderStrategy.cpp -2 / +2 lines
194	loadParameters.contentSniffingPolicy = contentSniffingPolicy;	194	loadParameters.contentSniffingPolicy = contentSniffingPolicy;
195	loadParameters.allowStoredCredentials = allowStoredCredentials;	195	loadParameters.allowStoredCredentials = allowStoredCredentials;
196	// If there is no WebFrame then this resource cannot be authenticated with the client.	196	// If there is no WebFrame then this resource cannot be authenticated with the client.
197	loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader.isAllowedToAskUserForCredentials()) ? AskClientForAllCredentials : DoNotAskClientForAnyCredentials;	197	loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader.isAllowedToAskUserForCredentials()) ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
198	loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;	198	loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;
199	loadParameters.defersLoading = resourceLoader.defersLoading();	199	loadParameters.defersLoading = resourceLoader.defersLoading();
200	loadParameters.needsCertificateInfo = resourceLoader.shouldIncludeCertificateInfo();	200	loadParameters.needsCertificateInfo = resourceLoader.shouldIncludeCertificateInfo();
201	loadParameters.maximumBufferingTime = maximumBufferingTime(resource);	201	loadParameters.maximumBufferingTime = maximumBufferingTime(resource);
202		202
203	ASSERT((loadParameters.webPageID && loadParameters.webFrameID) \|\| loadParameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials);	203	ASSERT((loadParameters.webPageID && loadParameters.webFrameID) \|\| loadParameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials);
204		204
205	if (!WebProcess::singleton().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(loadParameters), 0)) {	205	if (!WebProcess::singleton().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(loadParameters), 0)) {
206	WEBLOADERSTRATEGY_LOG_ALWAYS_ERROR("WebLoaderStrategy::scheduleLoad: Unable to schedule resource with the NetworkProcess with priority = %d, pageID = %llu, frameID = %llu", static_cast<int>(resourceLoader.request().priority()), static_cast<unsigned long long>(loadParameters.webPageID), static_cast<unsigned long long>(loadParameters.webFrameID));	206	WEBLOADERSTRATEGY_LOG_ALWAYS_ERROR("WebLoaderStrategy::scheduleLoad: Unable to schedule resource with the NetworkProcess with priority = %d, pageID = %llu, frameID = %llu", static_cast<int>(resourceLoader.request().priority()), static_cast<unsigned long long>(loadParameters.webPageID), static_cast<unsigned long long>(loadParameters.webFrameID));

Lines 1-5 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +60 lines
1	2016-07-05 Youenn Fablet <youenn@apple.com>	1	2016-07-05 Youenn Fablet <youenn@apple.com>
2		2
		3	Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
		4	https://bugs.webkit.org/show_bug.cgi?id=159413
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	ClientCredentialPolicy had three values (not ask, ask, ask only for same origin).
		9	The distinction between allowing cross-origin or same-origin credentials is misleading as it is not supported
		10	for synchronous loads and not supported by Network process.
		11	It is best replaced by a boolean option (ask or not ask).
		12
		13	Same-origin ClientCredentialPolicy option was only used by DocumentThreadableLoader for asynchronous loads.
		14	Since DocumentThreadableLoader is already computing whether the request is cross-origin, it can also computes
		15	whther credentials may be requested or not. In case of cross-origin redirections, credentials are omitted, thus
		16	disabling any possibility for requesting credentials for cross-origin resources after redirections.
		17
		18	Moving ClientCredentialPolicy to ResourceLoaderOptions since it is not used by platform code except for some
		19	mac-specific code that is already using ResourceLoaderOptions.
		20
		21	Covered by existing tests.
		22
		23	* loader/CrossOriginPreflightChecker.cpp:
		24	(WebCore::CrossOriginPreflightChecker::startPreflight): Setting clearly credential mode to Omit credentials.
		25	(WebCore::CrossOriginPreflightChecker::doPreflight): Ditto.
		26	* loader/DocumentLoader.cpp:
		27	(WebCore::DocumentLoader::startLoadingMainResource): AskClientForAllCredentials ->
		28	ClientCredentialPolicy::MayAskClientForCredentials.
		29	* loader/DocumentThreadableLoader.cpp:
		30	(WebCore::DocumentThreadableLoader::loadRequest): Disabling requesting credentials for any cross-origin request.
		31	* loader/FrameLoader.h:
		32	* loader/MediaResourceLoader.cpp:
		33	(WebCore::MediaResourceLoader::requestResource): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		34	* loader/NetscapePlugInStreamLoader.cpp:
		35	(WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Ditto.
		36	* loader/ResourceLoader.cpp:
		37	(WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Disabling client credential request if ClientCredentialPolicy is CannotAskClientForCredentials.
		38	Otherwise, returns true if fetch credentials mode allows it.
		39	* loader/ResourceLoaderOptions.h:
		40	(WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
		41	(WebCore::ResourceLoaderOptions::clientCredentialPolicy): Deleted.
		42	(WebCore::ResourceLoaderOptions::setClientCredentialPolicy): Deleted.
		43	* loader/cache/CachedResourceLoader.cpp:
		44	(WebCore::CachedResourceLoader::requestUserCSSStyleSheet): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		45	(WebCore::CachedResourceLoader::defaultCachedResourceOptions): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		46	* loader/icon/IconLoader.cpp:
		47	(WebCore::IconLoader::startLoading): DoNotAskClientForAnyCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
		48	* platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
		49	(WebCore::WebCoreAVCFResourceLoader::startLoading): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
		50	This is ok as credentials mode is omit and stored credentials are not allowed.
		51	* platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
		52	(WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
		53	* platform/network/ResourceHandleTypes.h:
		54	* xml/XSLTProcessorLibxslt.cpp: DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		55	This is ok as this is a synchronous load.
		56	(WebCore::docLoaderFunc):
		57	* xml/parser/XMLDocumentParserLibxml2.cpp:
		58	(WebCore::openFunc): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		59	This is ok as this is a synchronous load.
		60
		61	2016-07-05 Youenn Fablet <youenn@apple.com>
		62
3	Remove CredentialRequest ResourceLoaderOptions	63	Remove CredentialRequest ResourceLoaderOptions
4	https://bugs.webkit.org/show_bug.cgi?id=159404	64	https://bugs.webkit.org/show_bug.cgi?id=159404
5		65

Lines 1-3 a/Source/WebKit2/ChangeLog_sec1
- a/Source/WebKit2/ChangeLog +24 lines
		1	2016-07-05 Youenn Fablet <youenn@apple.com>
		2
		3	Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
		4	https://bugs.webkit.org/show_bug.cgi?id=159413
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Renaming of ClientCredentialPolicy values.
		9
		10	* NetworkProcess/Downloads/DownloadManager.cpp:
		11	(WebKit::DownloadManager::startDownload):
		12	* NetworkProcess/NetworkLoad.cpp:
		13	(WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace):
		14	(WebKit::NetworkLoad::didReceiveAuthenticationChallenge):
		15	* NetworkProcess/NetworkLoadParameters.h:
		16	* NetworkProcess/NetworkResourceLoadParameters.cpp:
		17	(WebKit::NetworkResourceLoadParameters::NetworkResourceLoadParameters):
		18	* NetworkProcess/NetworkResourceLoader.cpp:
		19	(WebKit::NetworkResourceLoader::NetworkResourceLoader):
		20	* WebProcess/Network/WebLoaderStrategy.cpp:
		21	(WebKit::WebLoaderStrategy::scheduleLoad):
		22	* WebProcess/Network/WebResourceLoader.cpp:
		23	(WebKit::WebResourceLoader::willSendRequest):
		24
1	2016-07-04 Carlos Garcia Campos <cgarcia@igalia.com>	25	2016-07-04 Carlos Garcia Campos <cgarcia@igalia.com>
2		26
3	[Coordinated Graphics] Modernize and cleanup CompositingCoordinator	27	[Coordinated Graphics] Modernize and cleanup CompositingCoordinator

Lines 101-107 void CrossOriginPreflightChecker::notifyFinished(CachedResource* resource) a/Source/WebCore/loader/CrossOriginPreflightChecker.cpp_sec1
- a/Source/WebCore/loader/CrossOriginPreflightChecker.cpp -2 / +2 lines
101	void CrossOriginPreflightChecker::startPreflight()	101	void CrossOriginPreflightChecker::startPreflight()
102	{	102	{
103	auto options = m_loader.options();	103	auto options = m_loader.options();
104	options.setClientCredentialPolicy(DoNotAskClientForCrossOriginCredentials);	104	options.credentials = FetchOptions::Credentials::Omit;
105	options.setSecurityCheck(DoSecurityCheck);	105	options.setSecurityCheck(DoSecurityCheck);
106	// Don't sniff content or send load callbacks for the preflight request.	106	// Don't sniff content or send load callbacks for the preflight request.
107	options.setSendLoadCallbacks(DoNotSendCallbacks);	107	options.setSendLoadCallbacks(DoNotSendCallbacks);
Lines 130-136 void CrossOriginPreflightChecker::doPreflight(DocumentThreadableLoader& loader, a/Source/WebCore/loader/CrossOriginPreflightChecker.cpp_sec2
130	ResourceError error;	130	ResourceError error;
131	ResourceResponse response;	131	ResourceResponse response;
132	RefPtr<SharedBuffer> data;	132	RefPtr<SharedBuffer> data;
133	unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);	133	unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, error, response, data);
134		134
135	if (!error.isNull() && response.httpStatusCode() <= 0) {	135	if (!error.isNull() && response.httpStatusCode() <= 0) {
136	error.setType(ResourceError::Type::AccessControl);	136	error.setType(ResourceError::Type::AccessControl);

Lines 75-87 enum class CachingPolicy : uint8_t { a/Source/WebCore/loader/ResourceLoaderOptions.h_sec1
- a/Source/WebCore/loader/ResourceLoaderOptions.h -5 / +8 lines
75	DisallowCaching	75	DisallowCaching
76	};	76	};
77		77
		78	enum class ClientCredentialPolicy : uint8_t {
		79	CannotAskClientForCredentials,
		80	MayAskClientForCredentials
		81	};
		82
78	struct ResourceLoaderOptions : public FetchOptions {	83	struct ResourceLoaderOptions : public FetchOptions {
79	ResourceLoaderOptions()	84	ResourceLoaderOptions()
80	: m_sendLoadCallbacks(DoNotSendCallbacks)	85	: m_sendLoadCallbacks(DoNotSendCallbacks)
81	, m_sniffContent(DoNotSniffContent)	86	, m_sniffContent(DoNotSniffContent)
82	, m_dataBufferingPolicy(BufferData)	87	, m_dataBufferingPolicy(BufferData)
83	, m_allowCredentials(DoNotAllowStoredCredentials)	88	, m_allowCredentials(DoNotAllowStoredCredentials)
84	, m_clientCredentialPolicy(DoNotAskClientForAnyCredentials)
85	, m_securityCheck(DoSecurityCheck)	89	, m_securityCheck(DoSecurityCheck)
86	, m_certificateInfoPolicy(DoNotIncludeCertificateInfo)	90	, m_certificateInfoPolicy(DoNotIncludeCertificateInfo)
87	{	91	{
Lines 92-103 struct ResourceLoaderOptions : public FetchOptions { a/Source/WebCore/loader/ResourceLoaderOptions.h_sec2
92	, m_sniffContent(sniffContent)	96	, m_sniffContent(sniffContent)
93	, m_dataBufferingPolicy(dataBufferingPolicy)	97	, m_dataBufferingPolicy(dataBufferingPolicy)
94	, m_allowCredentials(allowCredentials)	98	, m_allowCredentials(allowCredentials)
95	, m_clientCredentialPolicy(credentialPolicy)
96	, m_securityCheck(securityCheck)	99	, m_securityCheck(securityCheck)
97	, m_certificateInfoPolicy(certificateInfoPolicy)	100	, m_certificateInfoPolicy(certificateInfoPolicy)
98	, m_contentSecurityPolicyImposition(contentSecurityPolicyImposition)	101	, m_contentSecurityPolicyImposition(contentSecurityPolicyImposition)
99	, m_defersLoadingPolicy(defersLoadingPolicy)	102	, m_defersLoadingPolicy(defersLoadingPolicy)
100	, m_cachingPolicy(cachingPolicy)	103	, m_cachingPolicy(cachingPolicy)
		104	, clientCredentialPolicy(credentialPolicy)
101	{	105	{
102	this->credentials = credentials;	106	this->credentials = credentials;
103	this->mode = mode;	107	this->mode = mode;
Lines 111-118 struct ResourceLoaderOptions : public FetchOptions { a/Source/WebCore/loader/ResourceLoaderOptions.h_sec3
111	void setDataBufferingPolicy(DataBufferingPolicy policy) { m_dataBufferingPolicy = policy; }	115	void setDataBufferingPolicy(DataBufferingPolicy policy) { m_dataBufferingPolicy = policy; }
112	StoredCredentials allowCredentials() const { return static_cast<StoredCredentials>(m_allowCredentials); }	116	StoredCredentials allowCredentials() const { return static_cast<StoredCredentials>(m_allowCredentials); }
113	void setAllowCredentials(StoredCredentials allow) { m_allowCredentials = allow; }	117	void setAllowCredentials(StoredCredentials allow) { m_allowCredentials = allow; }
114	ClientCredentialPolicy clientCredentialPolicy() const { return static_cast<ClientCredentialPolicy>(m_clientCredentialPolicy); }
115	void setClientCredentialPolicy(ClientCredentialPolicy policy) { m_clientCredentialPolicy = policy; }
116	SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }	118	SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }
117	void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }	119	void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }
118	CertificateInfoPolicy certificateInfoPolicy() const { return static_cast<CertificateInfoPolicy>(m_certificateInfoPolicy); }	120	CertificateInfoPolicy certificateInfoPolicy() const { return static_cast<CertificateInfoPolicy>(m_certificateInfoPolicy); }
Lines 128-139 struct ResourceLoaderOptions : public FetchOptions { a/Source/WebCore/loader/ResourceLoaderOptions.h_sec4
128	unsigned m_sniffContent : 1;	130	unsigned m_sniffContent : 1;
129	unsigned m_dataBufferingPolicy : 1;	131	unsigned m_dataBufferingPolicy : 1;
130	unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.	132	unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.
131	unsigned m_clientCredentialPolicy : 2; // When we should ask the client for credentials (if we allow credentials at all).
132	unsigned m_securityCheck : 1;	133	unsigned m_securityCheck : 1;
133	unsigned m_certificateInfoPolicy : 1; // Whether the response should include certificate info.	134	unsigned m_certificateInfoPolicy : 1; // Whether the response should include certificate info.
134	ContentSecurityPolicyImposition m_contentSecurityPolicyImposition { ContentSecurityPolicyImposition::DoPolicyCheck };	135	ContentSecurityPolicyImposition m_contentSecurityPolicyImposition { ContentSecurityPolicyImposition::DoPolicyCheck };
135	DefersLoadingPolicy m_defersLoadingPolicy { DefersLoadingPolicy::AllowDefersLoading };	136	DefersLoadingPolicy m_defersLoadingPolicy { DefersLoadingPolicy::AllowDefersLoading };
136	CachingPolicy m_cachingPolicy { CachingPolicy::AllowCaching };	137	CachingPolicy m_cachingPolicy { CachingPolicy::AllowCaching };
		138
		139	ClientCredentialPolicy clientCredentialPolicy { ClientCredentialPolicy::CannotAskClientForCredentials };
137	};	140	};
138		141
139	} // namespace WebCore	142	} // namespace WebCore

Lines 33-44 enum StoredCredentials { a/Source/WebCore/platform/network/ResourceHandleTypes.h_sec1
- a/Source/WebCore/platform/network/ResourceHandleTypes.h -6 lines
33	DoNotAllowStoredCredentials	33	DoNotAllowStoredCredentials
34	};	34	};
35		35
36	enum ClientCredentialPolicy {
37	AskClientForAllCredentials,
38	DoNotAskClientForCrossOriginCredentials,
39	DoNotAskClientForAnyCredentials
40	};
41
42	} // namespace WebCore	36	} // namespace WebCore
43		37
44	#endif // ResourceHandleTypes_h	38	#endif // ResourceHandleTypes_h