bcarrella
/
cef
mirror of https://bitbucket.org/chromiumembedded/cef
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix credentials mode for fetch request redirect (fixes #3675) 

Also verified that https://browseraudit.com/ gives the same results
both with and without `--disable-request-handling-for-testing`.
This commit is contained in:
Marshall Greenblatt 2024-05-06 15:09:13 -04:00
parent 311eaf827e
commit 271c6f6446
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libcef/browser/net_service/proxy_url_loader_factory.cc
View File

@ -358,6 +358,7 @@ class InterceptedRequest : public network::mojom::URLLoader,
GURL redirect_url_;
GURL header_client_redirect_url_;
const net::MutableNetworkTrafficAnnotationTag traffic_annotation_;
std::optional<network::mojom::CredentialsMode> original_crendentials_mode_;
mojo::Receiver<network::mojom::URLLoader> proxied_loader_receiver_;
mojo::Remote<network::mojom::URLLoaderClient> target_client_;
@ -506,6 +507,7 @@ void InterceptedRequest::Restart() {
// Match logic in CorsURLLoader::StartNetworkRequest.
const auto response_tainting = CalculateResponseTainting(
should_check_cors, request_.mode, tainted_origin);
original_crendentials_mode_ = request_.credentials_mode;
request_.credentials_mode =
network::cors::CalculateCredentialsFlag(request_.credentials_mode,
response_tainting)
@ -874,6 +876,14 @@ void InterceptedRequest::ContinueAfterIntercept() {
target_loader_.BindNewPipeAndPassReceiver(), id_, options, request_,
proxied_client_receiver_.BindNewPipeAndPassRemote(),
traffic_annotation_);
if (original_crendentials_mode_) {
// Restore the original |credentials_mode| value after calling
// CreateLoaderAndStart. This matches the logic in CorsURLLoader::
// StartNetworkRequest and allows InterceptedRequest::Restart to compute
// the correct |credentials_mode| during a fetch request redirect.
request_.credentials_mode = *original_crendentials_mode_;
original_crendentials_mode_.reset();
}
}
}