55 lines
2.6 KiB
Diff
55 lines
2.6 KiB
Diff
From: uazo <uazo@users.noreply.github.com>
|
|
Date: Wed, 19 Apr 2023 06:53:19 +0000
|
|
Subject: Remove auth header upon cross origin redirect
|
|
|
|
License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
|
|
---
|
|
third_party/blink/common/features.cc | 4 ++--
|
|
.../blink/renderer/platform/loader/fetch/resource_loader.cc | 3 +++
|
|
.../platform/loader/fetch/url_loader/sync_load_context.cc | 4 ++++
|
|
3 files changed, 9 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
|
|
--- a/third_party/blink/common/features.cc
|
|
+++ b/third_party/blink/common/features.cc
|
|
@@ -1526,8 +1526,8 @@ BASE_FEATURE(kRemoteResourceCache,
|
|
base::FEATURE_DISABLED_BY_DEFAULT);
|
|
|
|
BASE_FEATURE(kRemoveAuthroizationOnCrossOriginRedirect,
|
|
- "RemoveAutorizationOnCrossOriginRedirect",
|
|
- base::FEATURE_ENABLED_BY_DEFAULT);
|
|
+ "RemoveAutorizationOnCrossOriginRedirect", // guard
|
|
+ base::FEATURE_ENABLED_BY_DEFAULT); // this
|
|
|
|
BASE_FEATURE(kRenderBlockingFonts,
|
|
"RenderBlockingFonts",
|
|
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
|
|
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
|
|
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
|
|
@@ -822,6 +822,9 @@ bool ResourceLoader::WillFollowRedirect(
|
|
new_url)) {
|
|
fetcher_->GetUseCounter().CountUse(
|
|
mojom::WebFeature::kAuthorizationCrossOrigin);
|
|
+ if (removed_headers) {
|
|
+ removed_headers->push_back(net::HttpRequestHeaders::kAuthorization);
|
|
+ }
|
|
}
|
|
|
|
// TODO(https://crbug.com/471397, https://crbug.com/1406737): Reconsider
|
|
diff --git a/third_party/blink/renderer/platform/loader/fetch/url_loader/sync_load_context.cc b/third_party/blink/renderer/platform/loader/fetch/url_loader/sync_load_context.cc
|
|
--- a/third_party/blink/renderer/platform/loader/fetch/url_loader/sync_load_context.cc
|
|
+++ b/third_party/blink/renderer/platform/loader/fetch/url_loader/sync_load_context.cc
|
|
@@ -197,6 +197,10 @@ void SyncLoadContext::FollowRedirect(std::vector<std::string> removed_headers) {
|
|
return;
|
|
}
|
|
|
|
+ if (response_->has_authorization_header_between_cross_origin_redirect_) {
|
|
+ removed_headers.push_back(net::HttpRequestHeaders::kAuthorization);
|
|
+ }
|
|
+
|
|
response_->redirect_info = net::RedirectInfo();
|
|
*context_for_redirect_ = nullptr;
|
|
std::move(follow_redirect_callback_).Run(std::move(removed_headers));
|
|
--
|
|
2.25.1
|