Attachment 285001 Details for Bug 160399 – Rebasing

[patch] Rebasing

bug-160399-20160801123415.patch (text/plain), 52.87 KB, created by youenn fablet on 2016-08-01 03:35:36 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: youenn fablet

Created: 2016-08-01 03:35:36 PDT

Size: 52.87 KB

patch

obsolete

>Subversion Revision: 203973
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 48e33eee5daf5ee76a12363b2e34189f0cd3df73..e0779c4bdc19e387ab97d7a997deb67c4e17c71d 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,36 @@
>+2016-08-01  Youenn Fablet  <youenn@apple.com>
>+
>+        DocumentThredableLoader should pass the fetch mode to underlying loader code
>+        https://bugs.webkit.org/show_bug.cgi?id=160399
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Covered by existing and rebased tests.
>+
>+        DocumentThredableLoader was previously loading resources in NoCors mode and doing the cors checks on it own.
>+        This was duplicating code and not consistent.
>+        DocumentThreadableLoader is now passing the fetch mode given by client to underlying loader code.
>+        This allows removing some CORS checks in DocumentThreadableLoader code for redirections.
>+
>+        Updated SubresourceLoader redirection CORS checks to be on par with DocumentThreadableLoader.
>+        In particular, a check on whether the redirection URL is valid against CORS was not done early enough.
>+
>+        The error logging situation is not perfect as some errors are properly loggedin the console while some others are not.
>+        For instance blockedError (due to forbidden port for instance) reason is not logged on the console.
>+
>+        * loader/DocumentThreadableLoader.cpp:
>+        (WebCore::DocumentThreadableLoader::redirectReceived): Updating redirection checking as SubresourceLoader is
>+        already doing most of the checks.
>+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Removing temp hack as tainting is now computed by
>+        underlying loader code.
>+        (WebCore::DocumentThreadableLoader::loadRequest): Removing fetch mode change.
>+        * loader/SubresourceLoader.cpp:
>+        (WebCore::SubresourceLoader::willSendRequestInternal): Updating cancellation error and improve error logging.
>+        (WebCore::SubresourceLoader::checkRedirectionCrossOriginAccessControl): Improved the checks and error reporting.
>+        * loader/SubresourceLoader.h:
>+        * xml/XMLHttpRequest.cpp:
>+        (WebCore::XMLHttpRequest::didFail): Added an error message to the console in case of access control error.
>+
> 2016-08-01  Frederic Wang  <fwang@igalia.com>
> 
>         Introduce a RenderMathMLFencedOperator class
>diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
>index 4b72af73ff7ab7f1741c39efeb0fe29ef29c2f4c..02ce5fc8115db65ee0e8f972dfe29499ecdc24d8 100644
>--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
>+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
>@@ -219,43 +219,34 @@ void DocumentThreadableLoader::redirectReceived(CachedResource* resource, Resour
>     if (isAllowedRedirect(request.url()))
>         return;
> 
>-    // When using access control, only simple cross origin requests are allowed to redirect. The new request URL must have a supported
>-    // scheme and not contain the userinfo production. In addition, the redirect response must pass the access control check if the
>-    // original request was not same-origin.
>-    if (m_options.mode == FetchOptions::Mode::Cors) {
>-        bool allowRedirect = false;
>-        if (m_simpleRequest) {
>-            String accessControlErrorDescription;
>-            allowRedirect = isValidCrossOriginRedirectionURL(request.url())
>-                            && (m_sameOriginRequest || passesAccessControlCheck(redirectResponse, m_options.allowCredentials(), securityOrigin(), accessControlErrorDescription));
>-        }
>+    // Force any subsequent request to use these checks.
>+    m_sameOriginRequest = false;
> 
>-        if (allowRedirect) {
>-            if (m_resource)
>-                clearResource();
>+    ASSERT(m_resource);
>+    ASSERT(m_resource->loader());
>+    ASSERT(m_options.mode == FetchOptions::Mode::Cors);
> 
>-            RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::createFromString(redirectResponse.url());
>-            RefPtr<SecurityOrigin> requestOrigin = SecurityOrigin::createFromString(request.url());
>-            // If the original request wasn't same-origin, then if the request URL origin is not same origin with the original URL origin,
>-            // set the source origin to a globally unique identifier. (If the original request was same-origin, the origin of the new request
>-            // should be the original URL origin.)
>-            if (!m_sameOriginRequest && !originalOrigin->isSameSchemeHostPort(requestOrigin.get()))
>-                m_origin = SecurityOrigin::createUnique();
>-            // Force any subsequent request to use these checks.
>-            m_sameOriginRequest = false;
>+    // FIXME: We should remove that restriction, since we are anyway using preflighting if needed in follow-up code.
>+    if (!m_simpleRequest) {
>+        reportCrossOriginResourceSharingError(*m_client, redirectResponse.url());
>+        request = ResourceRequest();
>+        return;
>+    }
>+    // Except in case where preflight is needed, loading should be able to continue on its own.
>+    // But we also handle credentials here if it is restricted to SameOrigin.
>+    if (m_options.credentials != FetchOptions::Credentials::SameOrigin)
>+        return;
> 
>-            if (m_options.credentials == FetchOptions::Credentials::SameOrigin)
>-                m_options.setAllowCredentials(DoNotAllowStoredCredentials);
>+    // Loader might have modified the origin to a unique one, let's reuse it for subsequent loads.
>+    m_origin = m_resource->loader()->origin();
> 
>-            cleanRedirectedRequestForAccessControl(request);
>+    m_options.setAllowCredentials(DoNotAllowStoredCredentials);
> 
>-            makeCrossOriginAccessRequest(ResourceRequest(request));
>-            return;
>-        }
>-    }
>+    clearResource();
> 
>-    reportCrossOriginResourceSharingError(*m_client, redirectResponse.url());
>-    request = ResourceRequest();
>+    // FIXME: We should not need to clean the request again here as SubresourceLoader has done it already.
>+    cleanRedirectedRequestForAccessControl(request);
>+    makeCrossOriginAccessRequest(ResourceRequest(request));
> }
> 
> void DocumentThreadableLoader::dataSent(CachedResource* resource, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
>@@ -284,12 +275,9 @@ void DocumentThreadableLoader::didReceiveResponse(unsigned long identifier, cons
>     }
> 
>     ASSERT(response.type() != ResourceResponse::Type::Error);
>-    if (response.type() == ResourceResponse::Type::Default) {
>-        // FIXME: To be removed once the real fetch mode is passed to underlying loaders.
>-        if (options().mode == FetchOptions::Mode::Cors && tainting == ResourceResponse::Tainting::Opaque)
>-            tainting = ResourceResponse::Tainting::Cors;
>+    if (response.type() == ResourceResponse::Type::Default)
>         m_client->didReceiveResponse(identifier, ResourceResponse::filterResponse(response, tainting));
>-    } else {
>+    else {
>         ASSERT(response.isNull() && response.type() == ResourceResponse::Type::Opaqueredirect);
>         m_client->didReceiveResponse(identifier, response);
>     }
>@@ -365,9 +353,6 @@ void DocumentThreadableLoader::loadRequest(ResourceRequest&& request, SecurityCh
>         ThreadableLoaderOptions options = m_options;
>         options.clientCredentialPolicy = m_sameOriginRequest ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
> 
>-        // Set to NoCors as CORS checks are done in DocumentThreadableLoader
>-        options.mode = FetchOptions::Mode::NoCors;
>-
>         CachedResourceRequest newRequest(WTFMove(request), options);
>         if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())
>             newRequest.setInitiator(m_options.initiator);
>diff --git a/Source/WebCore/loader/SubresourceLoader.cpp b/Source/WebCore/loader/SubresourceLoader.cpp
>index 676a239522050f9fa4868ac5816ebd75de659f6a..4c1b363185520215d5422bbb7a6bd75094f73aad 100644
>--- a/Source/WebCore/loader/SubresourceLoader.cpp
>+++ b/Source/WebCore/loader/SubresourceLoader.cpp
>@@ -206,8 +206,12 @@ void SubresourceLoader::willSendRequestInternal(ResourceRequest& newRequest, con
>             return;
>         }
> 
>-        if (!checkRedirectionCrossOriginAccessControl(request(), redirectResponse, newRequest)) {
>-            cancel();
>+        String errorDescription;
>+        if (!checkRedirectionCrossOriginAccessControl(redirectResponse, newRequest, errorDescription)) {
>+            String errorMessage = "Cross-origin redirection to " + newRequest.url().string() + " denied by Cross-Origin Resource Sharing policy: " + errorDescription;
>+            if (m_frame && m_frame->document())
>+                m_frame->document()->addConsoleMessage(MessageSource::Security, MessageLevel::Error, errorMessage);
>+            cancel(ResourceError(String(), 0, request().url(), errorMessage, ResourceError::Type::AccessControl));
>             return;
>         }
> 
>@@ -400,32 +404,26 @@ static void logResourceLoaded(Frame* frame, CachedResource::Type type)
>     frame->page()->diagnosticLoggingClient().logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceKey(), DiagnosticLoggingKeys::loadedKey(), resourceType, ShouldSample::Yes);
> }
> 
>-bool SubresourceLoader::checkRedirectionCrossOriginAccessControl(const ResourceRequest& previousRequest, const ResourceResponse& redirectResponse, ResourceRequest& newRequest)
>+bool SubresourceLoader::checkRedirectionCrossOriginAccessControl(const ResourceResponse& redirectResponse, ResourceRequest& newRequest, String& errorMessage)
> {
>-    ASSERT(options().mode != FetchOptions::Mode::SameOrigin);
>-
>     bool shouldCheckCrossOrigin = options().mode == FetchOptions::Mode::Cors && m_resource->isCrossOrigin();
> 
>     if (!(m_origin && m_origin->canRequest(newRequest.url())))
>         m_resource->setCrossOrigin();
>+    // Implementing https://fetch.spec.whatwg.org/#concept-http-redirect-fetch step 8.
>+    if (m_resource->isCrossOrigin() && options().mode == FetchOptions::Mode::Cors && !isValidCrossOriginRedirectionURL(newRequest.url())) {
>+        errorMessage = ASCIILiteral("URL is either a non-HTTP URL or contains credentials.");
>+        return false;
>+    }
> 
>     if (!shouldCheckCrossOrigin)
>         return true;
> 
>     ASSERT(m_origin);
>-    String errorDescription;
>-    bool responsePassesCORS = m_origin->canRequest(previousRequest.url())
>-        || passesAccessControlCheck(redirectResponse, options().allowCredentials(), *m_origin, errorDescription);
>-    if (!responsePassesCORS || !isValidCrossOriginRedirectionURL(newRequest.url())) {
>-        if (m_frame && m_frame->document()) {
>-            String errorMessage = "Cross-origin redirection denied by Cross-Origin Resource Sharing policy: " +
>-                (!responsePassesCORS ? errorDescription : "Redirected to either a non-HTTP URL or a URL that contains credentials.");
>-            m_frame->document()->addConsoleMessage(MessageSource::Security, MessageLevel::Error, errorMessage);
>-        }
>+    if (!passesAccessControlCheck(redirectResponse, options().allowCredentials(), *m_origin, errorMessage))
>         return false;
>-    }
> 
>-    // If the request URL origin is not the same as the original origin, the request origin should be set to a globally unique identifier.
>+    // Implementing https://fetch.spec.whatwg.org/#concept-http-redirect-fetch step 10.
>     m_origin = SecurityOrigin::createUnique();
>     cleanRedirectedRequestForAccessControl(newRequest);
>     updateRequestForAccessControl(newRequest, *m_origin, options().allowCredentials());
>diff --git a/Source/WebCore/loader/SubresourceLoader.h b/Source/WebCore/loader/SubresourceLoader.h
>index 31c4b3ea056686400ab5c20d91412e9b25fc99dc..d8ce6346ee3f0cb9424e9a162c1b2f1cb7f119c4 100644
>--- a/Source/WebCore/loader/SubresourceLoader.h
>+++ b/Source/WebCore/loader/SubresourceLoader.h
>@@ -51,6 +51,7 @@ public:
>     bool isSubresourceLoader() override;
>     CachedResource* cachedResource();
> 
>+    SecurityOrigin* origin() { return m_origin.get(); }
> #if PLATFORM(IOS)
>     bool startLoading() override;
> 
>@@ -91,7 +92,7 @@ private:
> #endif
> 
>     bool checkForHTTPStatusCodeError();
>-    bool checkRedirectionCrossOriginAccessControl(const ResourceRequest&, const ResourceResponse&, ResourceRequest& newRequest);
>+    bool checkRedirectionCrossOriginAccessControl(const ResourceResponse&, ResourceRequest&, String&);
> 
>     void didReceiveDataOrBuffer(const char*, int, RefPtr<SharedBuffer>&&, long long encodedDataLength, DataPayloadType);
> 
>diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
>index e25b080cd22e6b69700703b6d1818aeac5aeff66..8d30890211f20d08b5a1b182c48f70f6ae575639 100644
>--- a/Source/WebCore/xml/XMLHttpRequest.cpp
>+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
>@@ -978,6 +978,9 @@ void XMLHttpRequest::didFail(const ResourceError& error)
>     if (error.domain() == errorDomainWebKitInternal) {
>         String message = makeString("XMLHttpRequest cannot load ", error.failingURL().string(), ". ", error.localizedDescription());
>         logConsoleError(scriptExecutionContext(), message);
>+    } else if (error.isAccessControl()) {
>+        String message = makeString("XMLHttpRequest cannot load ", error.failingURL().string(), " due to access control checks.");
>+        logConsoleError(scriptExecutionContext(), message);
>     }
> 
>     m_exceptionCode = NETWORK_ERR;
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 6ab140adbdd0e8f4246b5b04aa5913bdd3f9b808..83c8407541e6aaf73d123bca12e67bd9178a58b5 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,21 @@
>+2016-08-01  Youenn Fablet  <youenn@apple.com>
>+
>+        DocumentThredableLoader should pass the fetch mode to underlying loader code
>+        https://bugs.webkit.org/show_bug.cgi?id=160399
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Rebasing tests as error logging changed.
>+
>+        * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
>+        * http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect-expected.txt:
>+        * http/tests/workers/worker-redirect-expected.txt:
>+        * http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt:
>+        * http/tests/xmlhttprequest/access-control-and-redirects-async.html: Fixed bugs in the test and updated comments.
>+        * http/tests/xmlhttprequest/access-control-and-redirects-expected.txt:
>+        * http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt:
>+        * http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt:
>+
> 2016-07-31  Youenn Fablet  <youenn@apple.com>
> 
>         Fetch Response built-ins should use @makeThisTypeError
>diff --git a/LayoutTests/imported/w3c/ChangeLog b/LayoutTests/imported/w3c/ChangeLog
>index d25700131f3be5180694511342e22000f7be7fce..dabb580b7638ef06057b3f3474a3bb5b5af05fc8 100644
>--- a/LayoutTests/imported/w3c/ChangeLog
>+++ b/LayoutTests/imported/w3c/ChangeLog
>@@ -1,3 +1,20 @@
>+2016-08-01  Youenn Fablet  <youenn@apple.com>
>+
>+        DocumentThredableLoader should pass the fetch mode to underlying loader code
>+        https://bugs.webkit.org/show_bug.cgi?id=160399
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Rebasing tests as error logging changed.
>+
>+        * web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt:
>+        * web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt:
>+        * web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt:
>+        * web-platform-tests/fetch/api/redirect/redirect-location-expected.txt:
>+        * web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt:
>+        * web-platform-tests/fetch/api/redirect/redirect-schemes.html: Updated test so that fetches are done in a
>+        deterministic order, one after the other is finished.
>+
> 2016-07-30  Chris Dumez  <cdumez@apple.com>
> 
>         Enable strict type checking for Window dictionary members
>diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt b/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt
>index 94ca8ef75294a1577ed68b9952716b479106ace2..14a25c77ac89b5c49b66ae624e7d11002e885a08 100644
>--- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt
>+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt
>@@ -1,4 +1,5 @@
>-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the child-src directive of the Content Security Policy.
>+CONSOLE MESSAGE: Unsafe attempt to load URL http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js from frame with URL http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked.html. Domains, protocols and ports must match.
>+
> This tests that the Content Security Policy of the page blocks loading a Web Worker's script from a different origin through a redirect.
> 
> On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>diff --git a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect-expected.txt b/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect-expected.txt
>index 74dabf419c7a165d947aef594e17dd3c6bc50eeb..164971e3384c5d0b208e5bc017e0aaa287c3acb4 100644
>--- a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect-expected.txt
>+++ b/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect-expected.txt
>@@ -1,3 +1,5 @@
>+CONSOLE MESSAGE: Unsafe attempt to load URL http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js from frame with URL http://127.0.0.1:8000/security/isolatedWorld/bypass-main-world-csp-worker-redirect.html. Domains, protocols and ports must match.
>+
> This tests that in an isolated world that the Content Security Policy of the parent origin (this page) is bypassed and a CSP violation is not triggered when a Web Worker's script URL loads a different origin through a redirect. This test PASSED if there is no CSP violation console message and the redirect fails (since Web Workers can only load a script from the same origin).
> 
> PASS worker failed to load script URL.
>diff --git a/LayoutTests/http/tests/workers/worker-redirect-expected.txt b/LayoutTests/http/tests/workers/worker-redirect-expected.txt
>index 94db9800ccfbea51b941ba7dd389614bbc304b56..71ec4413886d75150d6b40abab5516b4e6610130 100644
>--- a/LayoutTests/http/tests/workers/worker-redirect-expected.txt
>+++ b/LayoutTests/http/tests/workers/worker-redirect-expected.txt
>@@ -1,3 +1,5 @@
>+CONSOLE MESSAGE: Unsafe attempt to load URL http://localhost:8000/workers/resources/worker-redirect-target.js from frame with URL http://127.0.0.1:8000/workers/worker-redirect.html. Domains, protocols and ports must match.
>+
> Test that loading the worker's script does not allow a cross origin redirect (bug 26146)
> 
> SUCCESS: threw exception (SecurityError (DOM Exception 18): The operation is insecure.) when attempting to cross origin while loading the worker script.
>diff --git a/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt b/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt
>index db97d39d3d61013cd1ab874006bf136197d358da..e034c9c09ce2624ad874a92ae6dcb4ff992d7a93 100644
>--- a/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt
>+++ b/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt
>@@ -1,7 +1,7 @@
>-CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
>-CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&%20%20access-control-allow-origin=http://localhost:8000. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
>-CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://username:password@localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&%20%20access-control-allow-origin=http://localhost:8000. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
>-CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&%20%20access-control-allow-origin=http://localhost:8000. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi denied by Cross-Origin Resource Sharing policy: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
>+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi due to access control checks.
>+CONSOLE MESSAGE: Cross-origin redirection to foo://bar.cgi denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&%20%20access-control-allow-origin=http://127.0.0.1:8000 due to access control checks.
> CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&%20%20url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&%20%20access-control-allow-origin=*. Preflight response is not successful
> CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=false&%20%20url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&%20%20access-control-allow-origin=*&%20%20access-control-allow-headers=x-webkit. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
> Tests that asynchronous XMLHttpRequests handle redirects according to the CORS standard.
>@@ -9,13 +9,15 @@ Tests that asynchronous XMLHttpRequests handle redirects according to the CORS s
> Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi without credentials
> Expecting success: false
> PASS: 0
>-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://localhost:8000 without credentials
>+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://127.0.0.1:8000 without credentials
> Expecting success: true
>-FAIL: 0
>-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://username:password@localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://localhost:8000 without credentials
>+PASS: PASS: Cross-domain access allowed.
>+
>+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://username:password@localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://127.0.0.1:8000 without credentials
> Expecting success: false
>-PASS: 0
>-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&  access-control-allow-origin=http://localhost:8000 without credentials
>+FAIL: PASS: Cross-domain access allowed.
>+
>+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&  access-control-allow-origin=http://127.0.0.1:8000 without credentials
> Expecting success: false
> PASS: 0
> Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&  url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=* without credentials
>diff --git a/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async.html b/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async.html
>index de5f95f6e3b73663255309e8fdfe983c9ea4d4c0..5bd5326261654ce31baea93991224b7df9e8a741 100644
>--- a/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async.html
>+++ b/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async.html
>@@ -48,22 +48,20 @@ var tests = [
> ["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi",
>   withoutCredentials, noCustomHeader, fails],
> 
>-// Receives a redirect response with CORS headers. The redirect response passes the access check and the resource response
>-// passes the access check.
>-// FIXME: this test fails because the redirect is vetoed. There are continued bugs with redirects when the original
>-// request was cross-origin.
>+// Receives a redirect response with CORS headers. The redirect response passes the access check and the resource response passes the access check.
> ["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&\
>-  access-control-allow-origin=http://localhost:8000",
>+  access-control-allow-origin=http://127.0.0.1:8000",
>   withoutCredentials, noCustomHeader, succeeds],
> 
> // Receives a redirect response with a URL containing the userinfo production.
>+// Underlying HTTP stack currently removes credentials from redirection URL, hence loading is successful.
> ["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://username:password@localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&\
>-  access-control-allow-origin=http://localhost:8000",
>+  access-control-allow-origin=http://127.0.0.1:8000",
>   withoutCredentials, noCustomHeader, fails],
> 
> // Receives a redirect response with a URL with an unsupported scheme.
> ["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&\
>-  access-control-allow-origin=http://localhost:8000",
>+  access-control-allow-origin=http://127.0.0.1:8000",
>   withoutCredentials, noCustomHeader, fails],
> 
> // 2) Test preflighted cross origin requests that receive redirects.
>@@ -74,7 +72,8 @@ var tests = [
>   access-control-allow-origin=*",
>   withoutCredentials, addCustomHeader, fails],
> 
>-// Successful preflight and receives a redirect response to the actual request and fails.
>+// Successful preflight and receives a redirect response to the actual request.
>+// Preflight to the redirected URL should fail as it does not allow custom headers.
> ["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=false&\
>   url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&\
>   access-control-allow-origin=*&\
>diff --git a/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt b/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt
>index e75ae7d0f97b5edb4be3879f155ee5e93485e533..d0fcca86e2f1b0a9bf7974463ddb8eebefccca2a 100644
>--- a/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt
>+++ b/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt
>@@ -1,6 +1,8 @@
>-CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/resources/redirect.php?url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-basic-allow.cgi. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8000/xmlhttprequest/resources/access-control-basic-allow.cgi denied by Cross-Origin Resource Sharing policy: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
>+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/resources/redirect.php?url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-basic-allow.cgi due to access control checks.
> CONSOLE MESSAGE: line 25: XMLHttpRequest cannot load http://localhost:8000/resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
>-CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi denied by Cross-Origin Resource Sharing policy: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
>+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi due to access control checks.
> Tests that redirects between origins are never allowed, even when access control is involved.
> 
> Per the spec, these test cases should be allowed, but cross-origin redirects are currently unsupported in WebCore.
>diff --git a/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt b/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt
>index a187ec28924da1ccf09de21325d32cec40698c27..e74e9f62125da6c5cfa66ef5c5319d0a7ea96f50 100644
>--- a/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt
>+++ b/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt
>@@ -1,4 +1,5 @@
> CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/reply.xml. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
>+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:7/ due to access control checks.
> Test that a cross-origin redirect to a server that responds is indistinguishable from one that does not. Should say PASS:
> 
> PASS
>diff --git a/LayoutTests/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt b/LayoutTests/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt
>index 25dc1f4e0530fabb127ca75e018c2bb50594416b..f8db24234b7d807dfdf6ba9e70ab900eec91fcde 100644
>--- a/LayoutTests/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt
>+++ b/LayoutTests/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt
>@@ -1,4 +1,5 @@
> CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/reply.xml. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
>+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:7/ due to access control checks.
> Test that a simple cross-origin request to a server that responds (but does not permit cross-origin requests) is indistinguishable from one that does not exist. Should say PASS:
> 
> PASS
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt
>index 774696efc0e09faf6dc947dfe4dee7e03538f990..56c143b3c8ee798e50369c85fe26fcea0496819b 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt
>@@ -1,4 +1,5 @@
> Blocked access to external URL http://www1.localhost:8800/XMLHttpRequest/resources/auth2/corsenabled.py
>+CONSOLE MESSAGE: line 34: XMLHttpRequest cannot load http://www1.localhost:8800/XMLHttpRequest/resources/auth2/corsenabled.py due to access control checks.
> 
> FAIL XMLHttpRequest: send() - "Basic" authenticated CORS request using setRequestHeader() (expects to succeed) assert_true: responseText should contain the right user and password expected true got false
> 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt
>index 783b53c5ea6a774226aa1cb4742233ea45049ee5..4762bc838a6ece8ff425768bf7fe6b253d4578c7 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt
>@@ -1,5 +1,7 @@
> Blocked access to external URL http://www1.localhost:8800/XMLHttpRequest/resources/auth7/corsenabled.py
>+CONSOLE MESSAGE: line 33: XMLHttpRequest cannot load http://www1.localhost:8800/XMLHttpRequest/resources/auth7/corsenabled.py due to access control checks.
> Blocked access to external URL http://www1.localhost:8800/XMLHttpRequest/resources/auth8/corsenabled-no-authorize.py
>+CONSOLE MESSAGE: line 33: XMLHttpRequest cannot load http://www1.localhost:8800/XMLHttpRequest/resources/auth8/corsenabled-no-authorize.py due to access control checks.
> 
> FAIL CORS request with setRequestHeader auth to URL accepting Authorization header assert_true: responseText should contain the right user and password expected true got false
> PASS CORS request with setRequestHeader auth to URL NOT accepting Authorization header 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt
>index 4b712119eeb23f2f6517423a0bd39471795247c2..4525798e7dac20e9671ed7c9d4aac77b748b2b65 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt
>@@ -1,3 +1,48 @@
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=301&l=http://user:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=301&l=http://user:@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=301&l=http://:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=301&l=http://user:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=301&l=http://user:@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=301&l=http://:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=301&l=http://user:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=301&l=http://user:@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=301&l=http://:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=302&l=http://user:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=302&l=http://user:@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=302&l=http://:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=302&l=http://user:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=302&l=http://user:@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=302&l=http://:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=302&l=http://user:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=302&l=http://user:@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=302&l=http://:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=303&l=http://user:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=303&l=http://user:@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=303&l=http://:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=303&l=http://user:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=303&l=http://user:@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=303&l=http://:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=303&l=http://user:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=303&l=http://user:@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=303&l=http://:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=307&l=http://user:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=307&l=http://user:@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=307&l=http://:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=307&l=http://user:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=307&l=http://user:@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=307&l=http://:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=307&l=http://user:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=307&l=http://user:@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=307&l=http://:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=308&l=http://user:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=308&l=http://user:@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8800/fetch/api/resources/preflight.py?r=308&l=http://:password@localhost:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=308&l=http://user:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=308&l=http://user:@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8801/fetch/api/resources/preflight.py?r=308&l=http://:password@localhost:8801/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=308&l=http://user:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=308&l=http://user:@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
>+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8800/fetch/api/resources/preflight.py?r=308&l=http://:password@127.0.0.1:8800/fetch/api/cors/../resources/preflight.py&count=1 denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
> 
> PASS Redirect 301 from same origin to remote with user and password 
> PASS Redirect 301 from same origin to remote with user 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-location-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-location-expected.txt
>index ff559953cd2583bc38c8d10f00b7e9d6e8d3fd25..27a3155f6b5851150fa9b8ec23ef6b76f87a9d3f 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-location-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-location-expected.txt
>@@ -1,3 +1,8 @@
>+CONSOLE MESSAGE: Cross-origin redirection to data:,data%20url?r=301&l=data:,data%20url&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Cross-origin redirection to data:,data%20url?r=302&l=data:,data%20url&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Cross-origin redirection to data:,data%20url?r=303&l=data:,data%20url&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Cross-origin redirection to data:,data%20url?r=307&l=data:,data%20url&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Cross-origin redirection to data:,data%20url?r=308&l=data:,data%20url&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
> 
> PASS Redirect 301 in "follow" mode without location 
> PASS Redirect 301 in "manual" mode without location 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt
>index 22ef2853e8526619db3cd7c83b6ea5f557f0a7be..87e260fa54f4b63d6788c28a868326c59f9819fe 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt
>@@ -1,3 +1,8 @@
>+CONSOLE MESSAGE: Cross-origin redirection to mailto:a@a.com?l=mailto:a@a.com&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Cross-origin redirection to data:,HI?l=data:,HI&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Cross-origin redirection to facetime:a@a.org?l=facetime:a@a.org&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Cross-origin redirection to about:blank?l=about:blank&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Cross-origin redirection to about:unicorn?l=about:unicorn&count=1 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
> CONSOLE MESSAGE: Not allowed to load local resource: blob:djfksfjs?l=blob:djfksfjs&count=1
> 
> PASS Fetch: handling different schemes in redirects 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes.html
>index 2abb1203c1f92abe735d8640cc61a8cfd225fda8..cffec19d56a32f4b19eac363bbf48e66d9bcda1e 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes.html
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes.html
>@@ -6,18 +6,18 @@
> <div id=log></div>
> <script>
>   // All non-HTTP(S) schemes cannot survive redirects
>-  var url = "../resources/redirect.py?location=",
>-      tests = [
>-    fetch(url + "mailto:a@a.com"),
>-    fetch(url + "data:,HI"),
>-    fetch(url + "facetime:a@a.org"),
>-    fetch(url + "about:blank"),
>-    fetch(url + "about:unicorn"),
>-    fetch(url + "blob:djfksfjs")
>+  var url = "../resources/redirect.py?location=";
>+  var tests = [
>+    url + "mailto:a@a.com",
>+    url + "data:,HI",
>+    url + "facetime:a@a.org",
>+    url + "about:blank",
>+    url + "about:unicorn",
>+    url + "blob:djfksfjs"
>   ];
>-  tests.forEach(function(f) {
>-    promise_test(function(t) {
>-      return promise_rejects(t, new TypeError(), f)
>+  tests.forEach(function(url) {
>+    promise_test(function(test) {
>+      return promise_rejects(test, new TypeError(), fetch(url))
>     })
>   })
> </script>

Actions: View | Formatted Diff | Diff

Attachments on bug 160399: 284997 | 285001 | 285239 | 285242 | 285244 | 285245 | 285306