Attachment #282784 for bug #159413

View Details Raw Unified Return to Bug 159413

| Differences between



2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159413

        Reviewed by NOBODY (OOPS!).

        ClientCredentialPolicy had three values (not ask, ask, ask only for same origin).
        The distinction between allowing cross-origin or same-origin credentials is misleading as it is not supported
        for synchronous loads and not supported by Network process.
        It is best replaced by a boolean option (ask or not ask).

        Same-origin ClientCredentialPolicy option was only used by DocumentThreadableLoader for asynchronous loads.
        Since DocumentThreadableLoader is already computing whether the request is cross-origin, it can also computes
        whether credentials may be requested or not. In case of cross-origin redirections, credentials are omitted, thus
        disabling any possibility for requesting credentials for cross-origin resources after redirections.

        Moving ClientCredentialPolicy to ResourceLoaderOptions since it is not used by platform code except for some
        mac-specific code that is already using ResourceLoaderOptions.

        Covered by existing tests.

        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::startPreflight): Setting clearly credential mode to Omit credentials.
        (WebCore::CrossOriginPreflightChecker::doPreflight): Ditto.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): AskClientForAllCredentials ->
        ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::loadRequest): Disabling requesting credentials for any cross-origin request.
        * loader/FrameLoader.h:
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Ditto.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Disabling client credential request if ClientCredentialPolicy is CannotAskClientForCredentials.
        Otherwise, returns true if fetch credentials mode allows it.
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
        (WebCore::ResourceLoaderOptions::clientCredentialPolicy): Deleted.
        (WebCore::ResourceLoaderOptions::setClientCredentialPolicy): Deleted.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading): DoNotAskClientForAnyCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
        This is ok as credentials mode is omit and stored credentials are not allowed.
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
        * platform/network/ResourceHandleTypes.h:
        * xml/XSLTProcessorLibxslt.cpp: DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        This is ok as this is a synchronous load.
        (WebCore::docLoaderFunc):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::openFunc): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        This is ok as this is a synchronous load.

2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove CredentialRequest ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159404




2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159413

        Reviewed by NOBODY (OOPS!).

        Renaming of ClientCredentialPolicy values.

        * NetworkProcess/Downloads/DownloadManager.cpp:
        (WebKit::DownloadManager::startDownload):
        * NetworkProcess/NetworkLoad.cpp:
        (WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace):
        (WebKit::NetworkLoad::didReceiveAuthenticationChallenge):
        * NetworkProcess/NetworkLoadParameters.h:
        * NetworkProcess/NetworkResourceLoadParameters.cpp:
        (WebKit::NetworkResourceLoadParameters::NetworkResourceLoadParameters):
        * NetworkProcess/NetworkResourceLoader.cpp:
        (WebKit::NetworkResourceLoader::NetworkResourceLoader):
        * WebProcess/Network/WebLoaderStrategy.cpp:
        (WebKit::WebLoaderStrategy::scheduleLoad):
        * WebProcess/Network/WebResourceLoader.cpp:
        (WebKit::WebResourceLoader::willSendRequest):

2016-07-04  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Coordinated Graphics] Modernize and cleanup CompositingCoordinator



void CrossOriginPreflightChecker::startPreflight()
{
    auto options = m_loader.options();
    options.credentials = FetchOptions::Credentials::Omit;
    options.setSecurityCheck(DoSecurityCheck);
    // Don't sniff content or send load callbacks for the preflight request.
    options.setSendLoadCallbacks(DoNotSendCallbacks);

    ResourceError error;
    ResourceResponse response;
    RefPtr<SharedBuffer> data;
    unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, error, response, data);

    if (!error.isNull() && response.httpStatusCode() <= 0) {
        error.setType(ResourceError::Type::AccessControl);

Lines 1510-1516 void DocumentLoader::startLoadingMainResource() a/Source/WebCore/loader/DocumentLoader.cpp_sec1
- a/Source/WebCore/loader/DocumentLoader.cpp -1 / +1 lines
1510	// If this is a reload the cache layer might have made the previous request conditional. DocumentLoader can't handle 304 responses itself.	1510	// If this is a reload the cache layer might have made the previous request conditional. DocumentLoader can't handle 304 responses itself.
1511	request.makeUnconditional();	1511	request.makeUnconditional();
1512		1512
1513	static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);	1513	static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
1514	CachedResourceRequest cachedResourceRequest(request, mainResourceLoadOptions);	1514	CachedResourceRequest cachedResourceRequest(request, mainResourceLoadOptions);
1515	cachedResourceRequest.setInitiator(*this);	1515	cachedResourceRequest.setInitiator(*this);
1516	m_mainResource = m_cachedResourceLoader->requestMainResource(cachedResourceRequest);	1516	m_mainResource = m_cachedResourceLoader->requestMainResource(cachedResourceRequest);




    if (m_async) {
        ThreadableLoaderOptions options = m_options;
        options.clientCredentialPolicy = m_sameOriginRequest ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;

        CachedResourceRequest newRequest(request, options);
        if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())

    ResourceResponse response;
    unsigned long identifier = std::numeric_limits<unsigned long>::max();
    if (m_document.frame())
        identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy, error, response, data);

    if (!error.isNull() && response.httpStatusCode() <= 0) {
        if (requestURL.isLocalFile()) {

Lines 39-44 a/Source/WebCore/loader/FrameLoader.h_sec1
- a/Source/WebCore/loader/FrameLoader.h +1 lines
39	#include "PageThrottler.h"	39	#include "PageThrottler.h"
40	#include "ResourceHandleTypes.h"	40	#include "ResourceHandleTypes.h"
41	#include "ResourceLoadNotifier.h"	41	#include "ResourceLoadNotifier.h"
		42	#include "ResourceLoaderOptions.h"
42	#include "ResourceRequestBase.h"	43	#include "ResourceRequestBase.h"
43	#include "SecurityContext.h"	44	#include "SecurityContext.h"
44	#include "Timer.h"	45	#include "Timer.h"

Lines 66-72 RefPtr<PlatformMediaResource> MediaResourceLoader::requestResource(const Resourc a/Source/WebCore/loader/MediaResourceLoader.cpp_sec1
- a/Source/WebCore/loader/MediaResourceLoader.cpp -1 / +1 lines
66	auto cachingPolicy = options & LoadOption::DisallowCaching ? CachingPolicy::DisallowCaching : CachingPolicy::AllowCaching;	66	auto cachingPolicy = options & LoadOption::DisallowCaching ? CachingPolicy::DisallowCaching : CachingPolicy::AllowCaching;
67		67
68	// FIXME: Skip Content Security Policy check if the element that inititated this request is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.	68	// FIXME: Skip Content Security Policy check if the element that inititated this request is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.
69	CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, cachingPolicy));	69	CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, cachingPolicy));
70		70
71	cacheRequest.setAsPotentiallyCrossOrigin(m_crossOriginMode, *m_document);	71	cacheRequest.setAsPotentiallyCrossOrigin(m_crossOriginMode, *m_document);
72		72

Lines 43-49 namespace WebCore { a/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp_sec1
- a/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp -1 / +1 lines
43	// FIXME: Skip Content Security Policy check when associated plugin element is in a user agent shadow tree.	43	// FIXME: Skip Content Security Policy check when associated plugin element is in a user agent shadow tree.
44	// See <https://bugs.webkit.org/show_bug.cgi?id=146663>.	44	// See <https://bugs.webkit.org/show_bug.cgi?id=146663>.
45	NetscapePlugInStreamLoader::NetscapePlugInStreamLoader(Frame& frame, NetscapePlugInStreamLoaderClient& client)	45	NetscapePlugInStreamLoader::NetscapePlugInStreamLoader(Frame& frame, NetscapePlugInStreamLoaderClient& client)
46	: ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching))	46	: ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching))
47	, m_client(&client)	47	, m_client(&client)
48	{	48	{
49	#if ENABLE(CONTENT_EXTENSIONS)	49	#if ENABLE(CONTENT_EXTENSIONS)

Lines 687-693 bool ResourceLoader::shouldUseCredentialStorage() a/Source/WebCore/loader/ResourceLoader.cpp_sec1
- a/Source/WebCore/loader/ResourceLoader.cpp -1 / +3 lines
687		687
688	bool ResourceLoader::isAllowedToAskUserForCredentials() const	688	bool ResourceLoader::isAllowedToAskUserForCredentials() const
689	{	689	{
690	return m_options.clientCredentialPolicy() == AskClientForAllCredentials \|\| (m_options.clientCredentialPolicy() == DoNotAskClientForCrossOriginCredentials && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()));	690	if (m_options.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials)
		691	return false;
		692	return m_options.credentials == FetchOptions::Credentials::Include \|\| (m_options.credentials == FetchOptions::Credentials::SameOrigin && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()));
691	}	693	}
692		694
693	void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)	695	void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)



    DisallowCaching
};

enum class ClientCredentialPolicy : uint8_t {
    CannotAskClientForCredentials,
    MayAskClientForCredentials
};

struct ResourceLoaderOptions : public FetchOptions {
    ResourceLoaderOptions()
        : m_sendLoadCallbacks(DoNotSendCallbacks)
        , m_sniffContent(DoNotSniffContent)
        , m_dataBufferingPolicy(BufferData)
        , m_allowCredentials(DoNotAllowStoredCredentials)
        , m_clientCredentialPolicy(DoNotAskClientForAnyCredentials)
        , m_securityCheck(DoSecurityCheck)
        , m_certificateInfoPolicy(DoNotIncludeCertificateInfo)
    {

        , m_sniffContent(sniffContent)
        , m_dataBufferingPolicy(dataBufferingPolicy)
        , m_allowCredentials(allowCredentials)
        , m_clientCredentialPolicy(credentialPolicy)
        , m_securityCheck(securityCheck)
        , m_certificateInfoPolicy(certificateInfoPolicy)
        , m_contentSecurityPolicyImposition(contentSecurityPolicyImposition)
        , m_defersLoadingPolicy(defersLoadingPolicy)
        , m_cachingPolicy(cachingPolicy)
        , clientCredentialPolicy(credentialPolicy)
    {
        this->credentials = credentials;
        this->mode = mode;

    void setDataBufferingPolicy(DataBufferingPolicy policy) { m_dataBufferingPolicy = policy; }
    StoredCredentials allowCredentials() const { return static_cast<StoredCredentials>(m_allowCredentials); }
    void setAllowCredentials(StoredCredentials allow) { m_allowCredentials = allow; }
    ClientCredentialPolicy clientCredentialPolicy() const { return static_cast<ClientCredentialPolicy>(m_clientCredentialPolicy); }
    void setClientCredentialPolicy(ClientCredentialPolicy policy) { m_clientCredentialPolicy = policy; }
    SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }
    void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }
    CertificateInfoPolicy certificateInfoPolicy() const { return static_cast<CertificateInfoPolicy>(m_certificateInfoPolicy); }

    unsigned m_sniffContent : 1;
    unsigned m_dataBufferingPolicy : 1;
    unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.
    unsigned m_clientCredentialPolicy : 2; // When we should ask the client for credentials (if we allow credentials at all).
    unsigned m_securityCheck : 1;
    unsigned m_certificateInfoPolicy : 1; // Whether the response should include certificate info.
    ContentSecurityPolicyImposition m_contentSecurityPolicyImposition { ContentSecurityPolicyImposition::DoPolicyCheck };
    DefersLoadingPolicy m_defersLoadingPolicy { DefersLoadingPolicy::AllowDefersLoading };
    CachingPolicy m_cachingPolicy { CachingPolicy::AllowCaching };

    ClientCredentialPolicy clientCredentialPolicy { ClientCredentialPolicy::CannotAskClientForCredentials };
};

} // namespace WebCore



        memoryCache.add(*userSheet);
    // FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?

    userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
    
    return userSheet;
}


const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()
{
    static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
    return options;
}


Lines 59-65 void IconLoader::startLoading() a/Source/WebCore/loader/icon/IconLoader.cpp_sec1
- a/Source/WebCore/loader/icon/IconLoader.cpp -1 / +1 lines
59	return;	59	return;
60		60
61	// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.	61	// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
62	CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForAnyCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));	62	CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
63		63
64	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);	64	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
65	request.setInitiator(cachedResourceRequestInitiators().icon);	65	request.setInitiator(cachedResourceRequestInitiators().icon);

Lines 71-77 void WebCoreAVCFResourceLoader::startLoading() a/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp_sec1
- a/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp -1 / +1 lines
71	RetainPtr<CFURLRequestRef> urlRequest = AVCFAssetResourceLoadingRequestGetURLRequest(m_avRequest.get());	71	RetainPtr<CFURLRequestRef> urlRequest = AVCFAssetResourceLoadingRequestGetURLRequest(m_avRequest.get());
72		72
73	// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.	73	// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
74	CachedResourceRequest request(ResourceRequest(urlRequest.get()), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));	74	CachedResourceRequest request(ResourceRequest(urlRequest.get()), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));
75		75
76	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);	76	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
77	CachedResourceLoader* loader = m_parent->player()->cachedResourceLoader();	77	CachedResourceLoader* loader = m_parent->player()->cachedResourceLoader();

Lines 69-75 void WebCoreAVFResourceLoader::startLoading() a/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm_sec1
- a/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm -1 / +1 lines
69		69
70	// FIXME: Skip Content Security Policy check if the element that inititated this request	70	// FIXME: Skip Content Security Policy check if the element that inititated this request
71	// is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.	71	// is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.
72	CachedResourceRequest request(nsRequest, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));	72	CachedResourceRequest request(nsRequest, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));
73	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);	73	request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
74	if (auto* loader = m_parent->player()->cachedResourceLoader())	74	if (auto* loader = m_parent->player()->cachedResourceLoader())
75	m_resource = loader->requestMedia(request);	75	m_resource = loader->requestMedia(request);



    DoNotAllowStoredCredentials
};

enum ClientCredentialPolicy {
    AskClientForAllCredentials,
    DoNotAskClientForCrossOriginCredentials,
    DoNotAskClientForAnyCredentials
};

} // namespace WebCore

#endif // ResourceHandleTypes_h

Lines 127-133 static xmlDocPtr docLoaderFunc(const xmlChar* uri, a/Source/WebCore/xml/XSLTProcessorLibxslt.cpp_sec1
- a/Source/WebCore/xml/XSLTProcessorLibxslt.cpp -1 / +1 lines
127		127
128	bool requestAllowed = globalCachedResourceLoader->frame() && globalCachedResourceLoader->document()->securityOrigin()->canRequest(url);	128	bool requestAllowed = globalCachedResourceLoader->frame() && globalCachedResourceLoader->document()->securityOrigin()->canRequest(url);
129	if (requestAllowed) {	129	if (requestAllowed) {
130	globalCachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);	130	globalCachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, error, response, data);
131	if (error.isNull())	131	if (error.isNull())
132	requestAllowed = globalCachedResourceLoader->document()->securityOrigin()->canRequest(response.url());	132	requestAllowed = globalCachedResourceLoader->document()->securityOrigin()->canRequest(response.url());
133	else if (data)	133	else if (data)

Lines 463-469 static void* openFunc(const char* uri) a/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp_sec1
- a/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp -1 / +1 lines
463	// FIXME: We should restore the original global error handler as well.	463	// FIXME: We should restore the original global error handler as well.
464		464
465	if (cachedResourceLoader->frame())	465	if (cachedResourceLoader->frame())
466	cachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);	466	cachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, error, response, data);
467	}	467	}
468		468
469	// We have to check the URL again after the load to catch redirects.	469	// We have to check the URL again after the load to catch redirects.

Lines 53-59 void DownloadManager::startDownload(SessionID sessionID, DownloadID downloadID, a/Source/WebKit2/NetworkProcess/Downloads/DownloadManager.cpp_sec1
- a/Source/WebKit2/NetworkProcess/Downloads/DownloadManager.cpp -1 / +1 lines
53	NetworkLoadParameters parameters;	53	NetworkLoadParameters parameters;
54	parameters.sessionID = sessionID;	54	parameters.sessionID = sessionID;
55	parameters.request = request;	55	parameters.request = request;
56	parameters.clientCredentialPolicy = AskClientForAllCredentials;	56	parameters.clientCredentialPolicy = ClientCredentialPolicy::MayAskClientForCredentials;
57	m_pendingDownloads.add(downloadID, std::make_unique<PendingDownload>(WTFMove(parameters), downloadID));	57	m_pendingDownloads.add(downloadID, std::make_unique<PendingDownload>(WTFMove(parameters), downloadID));
58	#else	58	#else
59	auto download = std::make_unique<Download>(*this, downloadID, request, suggestedName);	59	auto download = std::make_unique<Download>(*this, downloadID, request, suggestedName);




void NetworkLoad::didReceiveChallenge(const AuthenticationChallenge& challenge, ChallengeCompletionHandler&& completionHandler)
{
    // NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
    ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);

    // Handle server trust evaluation at platform-level if requested, for performance reasons.
    if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested
        && !NetworkProcess::singleton().canHandleHTTPSServerTrustEvaluation()) {

        return;
    }

    if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
        completionHandler(AuthenticationChallengeDisposition::UseCredential, { });
        return;
    }

void NetworkLoad::didReceiveAuthenticationChallenge(ResourceHandle* handle, const AuthenticationChallenge& challenge)
{
    ASSERT_UNUSED(handle, handle == m_handle);
    // NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
    ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);

    if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
        challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
        return;
    }

Lines 45-51 public: a/Source/WebKit2/NetworkProcess/NetworkLoadParameters.h_sec1
- a/Source/WebKit2/NetworkProcess/NetworkLoadParameters.h -1 / +1 lines
45	WebCore::ResourceRequest request;	45	WebCore::ResourceRequest request;
46	WebCore::ContentSniffingPolicy contentSniffingPolicy { WebCore::SniffContent };	46	WebCore::ContentSniffingPolicy contentSniffingPolicy { WebCore::SniffContent };
47	WebCore::StoredCredentials allowStoredCredentials { WebCore::DoNotAllowStoredCredentials };	47	WebCore::StoredCredentials allowStoredCredentials { WebCore::DoNotAllowStoredCredentials };
48	WebCore::ClientCredentialPolicy clientCredentialPolicy { WebCore::DoNotAskClientForAnyCredentials };	48	WebCore::ClientCredentialPolicy clientCredentialPolicy { WebCore::ClientCredentialPolicy::CannotAskClientForCredentials };
49	bool shouldClearReferrerOnHTTPSToHTTPRedirect { true };	49	bool shouldClearReferrerOnHTTPSToHTTPRedirect { true };
50	bool defersLoading { false };	50	bool defersLoading { false };
51	bool needsCertificateInfo { false };	51	bool needsCertificateInfo { false };

Lines 41-47 NetworkResourceLoadParameters::NetworkResourceLoadParameters() a/Source/WebKit2/NetworkProcess/NetworkResourceLoadParameters.cpp_sec1
- a/Source/WebKit2/NetworkProcess/NetworkResourceLoadParameters.cpp -1 / +1 lines
41	, sessionID(SessionID::emptySessionID())	41	, sessionID(SessionID::emptySessionID())
42	, contentSniffingPolicy(SniffContent)	42	, contentSniffingPolicy(SniffContent)
43	, allowStoredCredentials(DoNotAllowStoredCredentials)	43	, allowStoredCredentials(DoNotAllowStoredCredentials)
44	, clientCredentialPolicy(DoNotAskClientForAnyCredentials)	44	, clientCredentialPolicy(ClientCredentialPolicy::CannotAskClientForCredentials)
45	, shouldClearReferrerOnHTTPSToHTTPRedirect(true)	45	, shouldClearReferrerOnHTTPSToHTTPRedirect(true)
46	, defersLoading(false)	46	, defersLoading(false)
47	, needsCertificateInfo(false)	47	, needsCertificateInfo(false)

Lines 86-92 NetworkResourceLoader::NetworkResourceLoader(const NetworkResourceLoadParameters a/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp_sec1
- a/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp -1 / +1 lines
86	ASSERT(RunLoop::isMain());	86	ASSERT(RunLoop::isMain());
87	// FIXME: This is necessary because of the existence of EmptyFrameLoaderClient in WebCore.	87	// FIXME: This is necessary because of the existence of EmptyFrameLoaderClient in WebCore.
88	// Once bug 116233 is resolved, this ASSERT can just be "m_webPageID && m_webFrameID"	88	// Once bug 116233 is resolved, this ASSERT can just be "m_webPageID && m_webFrameID"
89	ASSERT((m_parameters.webPageID && m_parameters.webFrameID) \|\| m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials);	89	ASSERT((m_parameters.webPageID && m_parameters.webFrameID) \|\| m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials);
90		90
91	if (originalRequest().httpBody()) {	91	if (originalRequest().httpBody()) {
92	for (const auto& element : originalRequest().httpBody()->elements()) {	92	for (const auto& element : originalRequest().httpBody()->elements()) {



    loadParameters.contentSniffingPolicy = contentSniffingPolicy;
    loadParameters.allowStoredCredentials = allowStoredCredentials;
    // If there is no WebFrame then this resource cannot be authenticated with the client.
    loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader.isAllowedToAskUserForCredentials()) ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
    loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;
    loadParameters.defersLoading = resourceLoader.defersLoading();
    loadParameters.needsCertificateInfo = resourceLoader.shouldIncludeCertificateInfo();
    loadParameters.maximumBufferingTime = maximumBufferingTime(resource);

    ASSERT((loadParameters.webPageID && loadParameters.webFrameID) || loadParameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials);

    if (!WebProcess::singleton().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(loadParameters), 0)) {
        WEBLOADERSTRATEGY_LOG_ALWAYS_ERROR("WebLoaderStrategy::scheduleLoad: Unable to schedule resource with the NetworkProcess with priority = %d, pageID = %llu, frameID = %llu", static_cast<int>(resourceLoader.request().priority()), static_cast<unsigned long long>(loadParameters.webPageID), static_cast<unsigned long long>(loadParameters.webFrameID));

Lines 84-90 void WebResourceLoader::willSendRequest(ResourceRequest&& proposedRequest, Resou a/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp_sec1
- a/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp -1 / +1 lines
84		84
85	if (m_coreLoader->documentLoader()->applicationCacheHost()->maybeLoadFallbackForRedirect(m_coreLoader.get(), proposedRequest, redirectResponse))	85	if (m_coreLoader->documentLoader()->applicationCacheHost()->maybeLoadFallbackForRedirect(m_coreLoader.get(), proposedRequest, redirectResponse))
86	return;	86	return;
87	// FIXME: Do we need to update NetworkResourceLoader clientCredentialPolicy in case loader policy is DoNotAskClientForCrossOriginCredentials?	87	// FIXME: Do we need to update NetworkResourceLoader clientCredentialPolicy in case loader policy is FetchOptions::Credentials::SameOrigin?
88	m_coreLoader->willSendRequest(WTFMove(proposedRequest), redirectResponse, [protectedThis](ResourceRequest&& request) {	88	m_coreLoader->willSendRequest(WTFMove(proposedRequest), redirectResponse, [protectedThis](ResourceRequest&& request) {
89	if (!protectedThis->m_coreLoader)	89	if (!protectedThis->m_coreLoader)
90	return;	90	return;



2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159413

        Reviewed by NOBODY (OOPS!).

        * platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/credentials/authentication-basic-expected.txt: Removed.

2016-07-04  Fujii Hironori  <Hironori.Fujii@sony.com>

        [GTK] Null Node dereference in FrameSelection::notifyAccessibilityForSelectionChange of FrameSelectionAtk.cpp



2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159413

        Reviewed by NOBODY (OOPS!).

        Below test changes as ResourceLoader is now computing whether to request credentials to clients if:
        - request is authorized to request credentials (DocumentThreadableLoader only allows same-origin to make such thing)
        - credential policy is Include or Same-Origin and request is same-origin.
        This test changes as current fetch loader sets the credential mode to Omit, thus disabling credential request.

        To be noted that only fetch API is allowing to disable credentials sending for same-origin request using "Omit"
        credential mode.

        * web-platform-tests/fetch/api/credentials/authentication-basic-expected.txt: Rebasing test.

2016-06-30  Youenn Fablet  <youennf@gmail.com>

        LayoutTests intermittently failing to run due to issues starting Web Platform Test server

Lines 1-6 a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/credentials/authentication-basic-expected.txt_sec1
- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/credentials/authentication-basic-expected.txt -3 lines
1	localhost:8800 - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
2	localhost:8800 - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
3	localhost:8800 - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
4		1
5	FAIL User-added Authorization header with include mode assert_equals: HTTP status is 200 expected 200 but got 401	2	FAIL User-added Authorization header with include mode assert_equals: HTTP status is 200 expected 200 but got 401
6	FAIL User-added Authorization header with same-origin mode assert_equals: HTTP status is 200 expected 200 but got 401	3	FAIL User-added Authorization header with same-origin mode assert_equals: HTTP status is 200 expected 200 but got 401



http://localhost:8800/fetch/api/resources/authentication.py?realm=test - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
http://localhost:8800/fetch/api/resources/authentication.py?realm=test - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
http://localhost:8800/fetch/api/resources/authentication.py?realm=test - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet

FAIL User-added Authorization header with include mode assert_equals: HTTP status is 200 expected 200 but got 401
FAIL User-added Authorization header with same-origin mode assert_equals: HTTP status is 200 expected 200 but got 401
FAIL User-added Authorization header with omit mode assert_equals: HTTP status is 200 expected 200 but got 401


Return to Bug 159413

Lines 354-360 void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur a/Source/WebCore/loader/DocumentThreadableLoader.cpp_sec1
- a/Source/WebCore/loader/DocumentThreadableLoader.cpp -2 / +2 lines
354		354
355	if (m_async) {	355	if (m_async) {
356	ThreadableLoaderOptions options = m_options;	356	ThreadableLoaderOptions options = m_options;
357	options.setClientCredentialPolicy(DoNotAskClientForCrossOriginCredentials);	357	options.clientCredentialPolicy = m_sameOriginRequest ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
358		358
359	CachedResourceRequest newRequest(request, options);	359	CachedResourceRequest newRequest(request, options);
360	if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())	360	if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())
Lines 373-379 void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur a/Source/WebCore/loader/DocumentThreadableLoader.cpp_sec2
373	ResourceResponse response;	373	ResourceResponse response;
374	unsigned long identifier = std::numeric_limits<unsigned long>::max();	374	unsigned long identifier = std::numeric_limits<unsigned long>::max();
375	if (m_document.frame())	375	if (m_document.frame())
376	identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy(), error, response, data);	376	identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy, error, response, data);
377		377
378	if (!error.isNull() && response.httpStatusCode() <= 0) {	378	if (!error.isNull() && response.httpStatusCode() <= 0) {
379	if (requestURL.isLocalFile()) {	379	if (requestURL.isLocalFile()) {

Lines 241-247 CachedResourceHandle<CachedCSSStyleSheet> CachedResourceLoader::requestUserCSSSt a/Source/WebCore/loader/cache/CachedResourceLoader.cpp_sec1
- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp -2 / +2 lines
241	memoryCache.add(*userSheet);	241	memoryCache.add(*userSheet);
242	// FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?	242	// FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?
243		243
244	userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));	244	userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
245		245
246	return userSheet;	246	return userSheet;
247	}	247	}
Lines 1190-1196 void CachedResourceLoader::printPreloadStats() a/Source/WebCore/loader/cache/CachedResourceLoader.cpp_sec2
1190		1190
1191	const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()	1191	const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()
1192	{	1192	{
1193	static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);	1193	static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
1194	return options;	1194	return options;
1195	}	1195	}
1196		1196

Lines 214-222 void NetworkLoad::willPerformHTTPRedirection(ResourceResponse&& response, Resour a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp_sec1
- a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp -7 / +2 lines
214		214
215	void NetworkLoad::didReceiveChallenge(const AuthenticationChallenge& challenge, ChallengeCompletionHandler&& completionHandler)	215	void NetworkLoad::didReceiveChallenge(const AuthenticationChallenge& challenge, ChallengeCompletionHandler&& completionHandler)
216	{	216	{
217	// NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
218	ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);
219
220	// Handle server trust evaluation at platform-level if requested, for performance reasons.	217	// Handle server trust evaluation at platform-level if requested, for performance reasons.
221	if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested	218	if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested
222	&& !NetworkProcess::singleton().canHandleHTTPSServerTrustEvaluation()) {	219	&& !NetworkProcess::singleton().canHandleHTTPSServerTrustEvaluation()) {
Lines 353-359 void NetworkLoad::continueCanAuthenticateAgainstProtectionSpace(bool result) a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp_sec2
353	return;	350	return;
354	}	351	}
355		352
356	if (m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials) {	353	if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
357	completionHandler(AuthenticationChallengeDisposition::UseCredential, { });	354	completionHandler(AuthenticationChallengeDisposition::UseCredential, { });
358	return;	355	return;
359	}	356	}
Lines 420-429 bool NetworkLoad::shouldUseCredentialStorage(ResourceHandle* handle) a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp_sec3
420	void NetworkLoad::didReceiveAuthenticationChallenge(ResourceHandle* handle, const AuthenticationChallenge& challenge)	417	void NetworkLoad::didReceiveAuthenticationChallenge(ResourceHandle* handle, const AuthenticationChallenge& challenge)
421	{	418	{
422	ASSERT_UNUSED(handle, handle == m_handle);	419	ASSERT_UNUSED(handle, handle == m_handle);
423	// NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
424	ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);
425		420
426	if (m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials) {	421	if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
427	challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);	422	challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
428	return;	423	return;
429	}	424	}

Lines 194-206 void WebLoaderStrategy::scheduleLoad(ResourceLoader& resourceLoader, CachedResou a/Source/WebKit2/WebProcess/Network/WebLoaderStrategy.cpp_sec1
- a/Source/WebKit2/WebProcess/Network/WebLoaderStrategy.cpp -2 / +2 lines
194	loadParameters.contentSniffingPolicy = contentSniffingPolicy;	194	loadParameters.contentSniffingPolicy = contentSniffingPolicy;
195	loadParameters.allowStoredCredentials = allowStoredCredentials;	195	loadParameters.allowStoredCredentials = allowStoredCredentials;
196	// If there is no WebFrame then this resource cannot be authenticated with the client.	196	// If there is no WebFrame then this resource cannot be authenticated with the client.
197	loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader.isAllowedToAskUserForCredentials()) ? AskClientForAllCredentials : DoNotAskClientForAnyCredentials;	197	loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader.isAllowedToAskUserForCredentials()) ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
198	loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;	198	loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;
199	loadParameters.defersLoading = resourceLoader.defersLoading();	199	loadParameters.defersLoading = resourceLoader.defersLoading();
200	loadParameters.needsCertificateInfo = resourceLoader.shouldIncludeCertificateInfo();	200	loadParameters.needsCertificateInfo = resourceLoader.shouldIncludeCertificateInfo();
201	loadParameters.maximumBufferingTime = maximumBufferingTime(resource);	201	loadParameters.maximumBufferingTime = maximumBufferingTime(resource);
202		202
203	ASSERT((loadParameters.webPageID && loadParameters.webFrameID) \|\| loadParameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials);	203	ASSERT((loadParameters.webPageID && loadParameters.webFrameID) \|\| loadParameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials);
204		204
205	if (!WebProcess::singleton().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(loadParameters), 0)) {	205	if (!WebProcess::singleton().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(loadParameters), 0)) {
206	WEBLOADERSTRATEGY_LOG_ALWAYS_ERROR("WebLoaderStrategy::scheduleLoad: Unable to schedule resource with the NetworkProcess with priority = %d, pageID = %llu, frameID = %llu", static_cast<int>(resourceLoader.request().priority()), static_cast<unsigned long long>(loadParameters.webPageID), static_cast<unsigned long long>(loadParameters.webFrameID));	206	WEBLOADERSTRATEGY_LOG_ALWAYS_ERROR("WebLoaderStrategy::scheduleLoad: Unable to schedule resource with the NetworkProcess with priority = %d, pageID = %llu, frameID = %llu", static_cast<int>(resourceLoader.request().priority()), static_cast<unsigned long long>(loadParameters.webPageID), static_cast<unsigned long long>(loadParameters.webFrameID));

Lines 1-5 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +60 lines
1	2016-07-05 Youenn Fablet <youenn@apple.com>	1	2016-07-05 Youenn Fablet <youenn@apple.com>
2		2
		3	Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
		4	https://bugs.webkit.org/show_bug.cgi?id=159413
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	ClientCredentialPolicy had three values (not ask, ask, ask only for same origin).
		9	The distinction between allowing cross-origin or same-origin credentials is misleading as it is not supported
		10	for synchronous loads and not supported by Network process.
		11	It is best replaced by a boolean option (ask or not ask).
		12
		13	Same-origin ClientCredentialPolicy option was only used by DocumentThreadableLoader for asynchronous loads.
		14	Since DocumentThreadableLoader is already computing whether the request is cross-origin, it can also computes
		15	whether credentials may be requested or not. In case of cross-origin redirections, credentials are omitted, thus
		16	disabling any possibility for requesting credentials for cross-origin resources after redirections.
		17
		18	Moving ClientCredentialPolicy to ResourceLoaderOptions since it is not used by platform code except for some
		19	mac-specific code that is already using ResourceLoaderOptions.
		20
		21	Covered by existing tests.
		22
		23	* loader/CrossOriginPreflightChecker.cpp:
		24	(WebCore::CrossOriginPreflightChecker::startPreflight): Setting clearly credential mode to Omit credentials.
		25	(WebCore::CrossOriginPreflightChecker::doPreflight): Ditto.
		26	* loader/DocumentLoader.cpp:
		27	(WebCore::DocumentLoader::startLoadingMainResource): AskClientForAllCredentials ->
		28	ClientCredentialPolicy::MayAskClientForCredentials.
		29	* loader/DocumentThreadableLoader.cpp:
		30	(WebCore::DocumentThreadableLoader::loadRequest): Disabling requesting credentials for any cross-origin request.
		31	* loader/FrameLoader.h:
		32	* loader/MediaResourceLoader.cpp:
		33	(WebCore::MediaResourceLoader::requestResource): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		34	* loader/NetscapePlugInStreamLoader.cpp:
		35	(WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Ditto.
		36	* loader/ResourceLoader.cpp:
		37	(WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Disabling client credential request if ClientCredentialPolicy is CannotAskClientForCredentials.
		38	Otherwise, returns true if fetch credentials mode allows it.
		39	* loader/ResourceLoaderOptions.h:
		40	(WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
		41	(WebCore::ResourceLoaderOptions::clientCredentialPolicy): Deleted.
		42	(WebCore::ResourceLoaderOptions::setClientCredentialPolicy): Deleted.
		43	* loader/cache/CachedResourceLoader.cpp:
		44	(WebCore::CachedResourceLoader::requestUserCSSStyleSheet): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		45	(WebCore::CachedResourceLoader::defaultCachedResourceOptions): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		46	* loader/icon/IconLoader.cpp:
		47	(WebCore::IconLoader::startLoading): DoNotAskClientForAnyCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
		48	* platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
		49	(WebCore::WebCoreAVCFResourceLoader::startLoading): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
		50	This is ok as credentials mode is omit and stored credentials are not allowed.
		51	* platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
		52	(WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
		53	* platform/network/ResourceHandleTypes.h:
		54	* xml/XSLTProcessorLibxslt.cpp: DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		55	This is ok as this is a synchronous load.
		56	(WebCore::docLoaderFunc):
		57	* xml/parser/XMLDocumentParserLibxml2.cpp:
		58	(WebCore::openFunc): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
		59	This is ok as this is a synchronous load.
		60
		61	2016-07-05 Youenn Fablet <youenn@apple.com>
		62
3	Remove CredentialRequest ResourceLoaderOptions	63	Remove CredentialRequest ResourceLoaderOptions
4	https://bugs.webkit.org/show_bug.cgi?id=159404	64	https://bugs.webkit.org/show_bug.cgi?id=159404
5		65

Lines 1-3 a/Source/WebKit2/ChangeLog_sec1
- a/Source/WebKit2/ChangeLog +24 lines
		1	2016-07-05 Youenn Fablet <youenn@apple.com>
		2
		3	Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
		4	https://bugs.webkit.org/show_bug.cgi?id=159413
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Renaming of ClientCredentialPolicy values.
		9
		10	* NetworkProcess/Downloads/DownloadManager.cpp:
		11	(WebKit::DownloadManager::startDownload):
		12	* NetworkProcess/NetworkLoad.cpp:
		13	(WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace):
		14	(WebKit::NetworkLoad::didReceiveAuthenticationChallenge):
		15	* NetworkProcess/NetworkLoadParameters.h:
		16	* NetworkProcess/NetworkResourceLoadParameters.cpp:
		17	(WebKit::NetworkResourceLoadParameters::NetworkResourceLoadParameters):
		18	* NetworkProcess/NetworkResourceLoader.cpp:
		19	(WebKit::NetworkResourceLoader::NetworkResourceLoader):
		20	* WebProcess/Network/WebLoaderStrategy.cpp:
		21	(WebKit::WebLoaderStrategy::scheduleLoad):
		22	* WebProcess/Network/WebResourceLoader.cpp:
		23	(WebKit::WebResourceLoader::willSendRequest):
		24
1	2016-07-04 Carlos Garcia Campos <cgarcia@igalia.com>	25	2016-07-04 Carlos Garcia Campos <cgarcia@igalia.com>
2		26
3	[Coordinated Graphics] Modernize and cleanup CompositingCoordinator	27	[Coordinated Graphics] Modernize and cleanup CompositingCoordinator

Lines 101-107 void CrossOriginPreflightChecker::notifyFinished(CachedResource* resource) a/Source/WebCore/loader/CrossOriginPreflightChecker.cpp_sec1
- a/Source/WebCore/loader/CrossOriginPreflightChecker.cpp -2 / +2 lines
101	void CrossOriginPreflightChecker::startPreflight()	101	void CrossOriginPreflightChecker::startPreflight()
102	{	102	{
103	auto options = m_loader.options();	103	auto options = m_loader.options();
104	options.setClientCredentialPolicy(DoNotAskClientForCrossOriginCredentials);	104	options.credentials = FetchOptions::Credentials::Omit;
105	options.setSecurityCheck(DoSecurityCheck);	105	options.setSecurityCheck(DoSecurityCheck);
106	// Don't sniff content or send load callbacks for the preflight request.	106	// Don't sniff content or send load callbacks for the preflight request.
107	options.setSendLoadCallbacks(DoNotSendCallbacks);	107	options.setSendLoadCallbacks(DoNotSendCallbacks);
Lines 130-136 void CrossOriginPreflightChecker::doPreflight(DocumentThreadableLoader& loader, a/Source/WebCore/loader/CrossOriginPreflightChecker.cpp_sec2
130	ResourceError error;	130	ResourceError error;
131	ResourceResponse response;	131	ResourceResponse response;
132	RefPtr<SharedBuffer> data;	132	RefPtr<SharedBuffer> data;
133	unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);	133	unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, error, response, data);
134		134
135	if (!error.isNull() && response.httpStatusCode() <= 0) {	135	if (!error.isNull() && response.httpStatusCode() <= 0) {
136	error.setType(ResourceError::Type::AccessControl);	136	error.setType(ResourceError::Type::AccessControl);

Lines 75-87 enum class CachingPolicy : uint8_t { a/Source/WebCore/loader/ResourceLoaderOptions.h_sec1
- a/Source/WebCore/loader/ResourceLoaderOptions.h -5 / +8 lines
75	DisallowCaching	75	DisallowCaching
76	};	76	};
77		77
		78	enum class ClientCredentialPolicy : uint8_t {
		79	CannotAskClientForCredentials,
		80	MayAskClientForCredentials
		81	};
		82
78	struct ResourceLoaderOptions : public FetchOptions {	83	struct ResourceLoaderOptions : public FetchOptions {
79	ResourceLoaderOptions()	84	ResourceLoaderOptions()
80	: m_sendLoadCallbacks(DoNotSendCallbacks)	85	: m_sendLoadCallbacks(DoNotSendCallbacks)
81	, m_sniffContent(DoNotSniffContent)	86	, m_sniffContent(DoNotSniffContent)
82	, m_dataBufferingPolicy(BufferData)	87	, m_dataBufferingPolicy(BufferData)
83	, m_allowCredentials(DoNotAllowStoredCredentials)	88	, m_allowCredentials(DoNotAllowStoredCredentials)
84	, m_clientCredentialPolicy(DoNotAskClientForAnyCredentials)
85	, m_securityCheck(DoSecurityCheck)	89	, m_securityCheck(DoSecurityCheck)
86	, m_certificateInfoPolicy(DoNotIncludeCertificateInfo)	90	, m_certificateInfoPolicy(DoNotIncludeCertificateInfo)
87	{	91	{
Lines 92-103 struct ResourceLoaderOptions : public FetchOptions { a/Source/WebCore/loader/ResourceLoaderOptions.h_sec2
92	, m_sniffContent(sniffContent)	96	, m_sniffContent(sniffContent)
93	, m_dataBufferingPolicy(dataBufferingPolicy)	97	, m_dataBufferingPolicy(dataBufferingPolicy)
94	, m_allowCredentials(allowCredentials)	98	, m_allowCredentials(allowCredentials)
95	, m_clientCredentialPolicy(credentialPolicy)
96	, m_securityCheck(securityCheck)	99	, m_securityCheck(securityCheck)
97	, m_certificateInfoPolicy(certificateInfoPolicy)	100	, m_certificateInfoPolicy(certificateInfoPolicy)
98	, m_contentSecurityPolicyImposition(contentSecurityPolicyImposition)	101	, m_contentSecurityPolicyImposition(contentSecurityPolicyImposition)
99	, m_defersLoadingPolicy(defersLoadingPolicy)	102	, m_defersLoadingPolicy(defersLoadingPolicy)
100	, m_cachingPolicy(cachingPolicy)	103	, m_cachingPolicy(cachingPolicy)
		104	, clientCredentialPolicy(credentialPolicy)
101	{	105	{
102	this->credentials = credentials;	106	this->credentials = credentials;
103	this->mode = mode;	107	this->mode = mode;
Lines 111-118 struct ResourceLoaderOptions : public FetchOptions { a/Source/WebCore/loader/ResourceLoaderOptions.h_sec3
111	void setDataBufferingPolicy(DataBufferingPolicy policy) { m_dataBufferingPolicy = policy; }	115	void setDataBufferingPolicy(DataBufferingPolicy policy) { m_dataBufferingPolicy = policy; }
112	StoredCredentials allowCredentials() const { return static_cast<StoredCredentials>(m_allowCredentials); }	116	StoredCredentials allowCredentials() const { return static_cast<StoredCredentials>(m_allowCredentials); }
113	void setAllowCredentials(StoredCredentials allow) { m_allowCredentials = allow; }	117	void setAllowCredentials(StoredCredentials allow) { m_allowCredentials = allow; }
114	ClientCredentialPolicy clientCredentialPolicy() const { return static_cast<ClientCredentialPolicy>(m_clientCredentialPolicy); }
115	void setClientCredentialPolicy(ClientCredentialPolicy policy) { m_clientCredentialPolicy = policy; }
116	SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }	118	SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }
117	void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }	119	void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }
118	CertificateInfoPolicy certificateInfoPolicy() const { return static_cast<CertificateInfoPolicy>(m_certificateInfoPolicy); }	120	CertificateInfoPolicy certificateInfoPolicy() const { return static_cast<CertificateInfoPolicy>(m_certificateInfoPolicy); }
Lines 128-139 struct ResourceLoaderOptions : public FetchOptions { a/Source/WebCore/loader/ResourceLoaderOptions.h_sec4
128	unsigned m_sniffContent : 1;	130	unsigned m_sniffContent : 1;
129	unsigned m_dataBufferingPolicy : 1;	131	unsigned m_dataBufferingPolicy : 1;
130	unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.	132	unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.
131	unsigned m_clientCredentialPolicy : 2; // When we should ask the client for credentials (if we allow credentials at all).
132	unsigned m_securityCheck : 1;	133	unsigned m_securityCheck : 1;
133	unsigned m_certificateInfoPolicy : 1; // Whether the response should include certificate info.	134	unsigned m_certificateInfoPolicy : 1; // Whether the response should include certificate info.
134	ContentSecurityPolicyImposition m_contentSecurityPolicyImposition { ContentSecurityPolicyImposition::DoPolicyCheck };	135	ContentSecurityPolicyImposition m_contentSecurityPolicyImposition { ContentSecurityPolicyImposition::DoPolicyCheck };
135	DefersLoadingPolicy m_defersLoadingPolicy { DefersLoadingPolicy::AllowDefersLoading };	136	DefersLoadingPolicy m_defersLoadingPolicy { DefersLoadingPolicy::AllowDefersLoading };
136	CachingPolicy m_cachingPolicy { CachingPolicy::AllowCaching };	137	CachingPolicy m_cachingPolicy { CachingPolicy::AllowCaching };
		138
		139	ClientCredentialPolicy clientCredentialPolicy { ClientCredentialPolicy::CannotAskClientForCredentials };
137	};	140	};
138		141
139	} // namespace WebCore	142	} // namespace WebCore

Lines 33-44 enum StoredCredentials { a/Source/WebCore/platform/network/ResourceHandleTypes.h_sec1
- a/Source/WebCore/platform/network/ResourceHandleTypes.h -6 lines
33	DoNotAllowStoredCredentials	33	DoNotAllowStoredCredentials
34	};	34	};
35		35
36	enum ClientCredentialPolicy {
37	AskClientForAllCredentials,
38	DoNotAskClientForCrossOriginCredentials,
39	DoNotAskClientForAnyCredentials
40	};
41
42	} // namespace WebCore	36	} // namespace WebCore
43		37
44	#endif // ResourceHandleTypes_h	38	#endif // ResourceHandleTypes_h

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +9 lines
		1	2016-07-05 Youenn Fablet <youenn@apple.com>
		2
		3	Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
		4	https://bugs.webkit.org/show_bug.cgi?id=159413
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/credentials/authentication-basic-expected.txt: Removed.
		9
1	2016-07-04 Fujii Hironori <Hironori.Fujii@sony.com>	10	2016-07-04 Fujii Hironori <Hironori.Fujii@sony.com>
2		11
3	[GTK] Null Node dereference in FrameSelection::notifyAccessibilityForSelectionChange of FrameSelectionAtk.cpp	12	[GTK] Null Node dereference in FrameSelection::notifyAccessibilityForSelectionChange of FrameSelectionAtk.cpp

Lines 1-3 a/LayoutTests/imported/w3c/ChangeLog_sec1
- a/LayoutTests/imported/w3c/ChangeLog +17 lines
		1	2016-07-05 Youenn Fablet <youenn@apple.com>
		2
		3	Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
		4	https://bugs.webkit.org/show_bug.cgi?id=159413
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Below test changes as ResourceLoader is now computing whether to request credentials to clients if:
		9	- request is authorized to request credentials (DocumentThreadableLoader only allows same-origin to make such thing)
		10	- credential policy is Include or Same-Origin and request is same-origin.
		11	This test changes as current fetch loader sets the credential mode to Omit, thus disabling credential request.
		12
		13	To be noted that only fetch API is allowing to disable credentials sending for same-origin request using "Omit"
		14	credential mode.
		15
		16	* web-platform-tests/fetch/api/credentials/authentication-basic-expected.txt: Rebasing test.
		17
1	2016-06-30 Youenn Fablet <youennf@gmail.com>	18	2016-06-30 Youenn Fablet <youennf@gmail.com>
2		19
3	LayoutTests intermittently failing to run due to issues starting Web Platform Test server	20	LayoutTests intermittently failing to run due to issues starting Web Platform Test server

Lines 1-8 a/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/credentials/authentication-basic-expected.txt_sec1
- a/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/credentials/authentication-basic-expected.txt -8 lines
1	http://localhost:8800/fetch/api/resources/authentication.py?realm=test - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
2	http://localhost:8800/fetch/api/resources/authentication.py?realm=test - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
3	http://localhost:8800/fetch/api/resources/authentication.py?realm=test - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
4
5	FAIL User-added Authorization header with include mode assert_equals: HTTP status is 200 expected 200 but got 401
6	FAIL User-added Authorization header with same-origin mode assert_equals: HTTP status is 200 expected 200 but got 401
7	FAIL User-added Authorization header with omit mode assert_equals: HTTP status is 200 expected 200 but got 401
8