Diff
Modified: trunk/LayoutTests/ChangeLog (173515 => 173516)
--- trunk/LayoutTests/ChangeLog 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/LayoutTests/ChangeLog 2014-09-11 17:20:18 UTC (rev 173516)
@@ -1,3 +1,12 @@
+2014-09-11 Youenn Fablet <[email protected]>
+
+ [WK2] Authentication dialog is displayed for cross-origin XHR
+ https://bugs.webkit.org/show_bug.cgi?id=131349
+
+ Reviewed by Alexey Proskuryakov.
+
+ * platform/mac-wk2/TestExpectations: Unskipped tests.
+
2014-09-11 Chris Fleizach <[email protected]>
AX: Children inside a <legend> are not accessible
Modified: trunk/LayoutTests/platform/mac-wk2/TestExpectations (173515 => 173516)
--- trunk/LayoutTests/platform/mac-wk2/TestExpectations 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/LayoutTests/platform/mac-wk2/TestExpectations 2014-09-11 17:20:18 UTC (rev 173516)
@@ -341,10 +341,6 @@
webkit.org/b/127960 [ MountainLion ] http/tests/security/cross-origin-plugin-private-browsing-toggled.html [ Pass Failure ]
-webkit.org/b/131349 http/tests/xmlhttprequest/access-control-preflight-credential-async.html [ Failure ]
-webkit.org/b/131349 http/tests/xmlhttprequest/cross-origin-no-authorization.html [ Failure ]
-webkit.org/b/131349 http/tests/xmlhttprequest/cross-origin-no-credential-prompt.html [ Failure ]
-
webkit.org/b/134550 [ Mavericks ] http/tests/cache/iframe-304-crash.html [ Pass Failure ]
# Subpixel wrong cliprect on WK2
Modified: trunk/Source/WebCore/ChangeLog (173515 => 173516)
--- trunk/Source/WebCore/ChangeLog 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/Source/WebCore/ChangeLog 2014-09-11 17:20:18 UTC (rev 173516)
@@ -1,3 +1,16 @@
+2014-09-11 Youenn Fablet <[email protected]>
+
+ [WK2] Authentication dialog is displayed for cross-origin XHR
+ https://bugs.webkit.org/show_bug.cgi?id=131349
+
+ Reviewed by Alexey Proskuryakov.
+
+ * WebCore.exp.in: Export of isAllowedToAskUserForCredentials.
+ * loader/ResourceLoader.cpp:
+ (WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Replacing clientCredentialPolicy method. Returns true if credentials can be requested to the user.
+ (WebCore::ResourceLoader::didReceiveAuthenticationChallenge): Updated to use isAllowedToAskUserForCredentials.
+ * loader/ResourceLoader.h: Removing clientCredentialPolicy method and adding isAllowedToAskUserForCredentials method.
+
2014-09-11 Chris Fleizach <[email protected]>
AX: Children inside a <legend> are not accessible
Modified: trunk/Source/WebCore/WebCore.exp.in (173515 => 173516)
--- trunk/Source/WebCore/WebCore.exp.in 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/Source/WebCore/WebCore.exp.in 2014-09-11 17:20:18 UTC (rev 173516)
@@ -1693,6 +1693,7 @@
__ZNK7WebCore14ResourceBuffer7isEmptyEv
__ZNK7WebCore14ResourceHandle10connectionEv
__ZNK7WebCore14ResourceLoader11frameLoaderEv
+__ZNK7WebCore14ResourceLoader32isAllowedToAskUserForCredentialsEv
__ZNK7WebCore14ScrollableArea13scrolledToTopEv
__ZNK7WebCore14ScrollableArea14scrollAnimatorEv
__ZNK7WebCore14ScrollableArea14scrolledToLeftEv
Modified: trunk/Source/WebCore/loader/ResourceLoader.cpp (173515 => 173516)
--- trunk/Source/WebCore/loader/ResourceLoader.cpp 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/Source/WebCore/loader/ResourceLoader.cpp 2014-09-11 17:20:18 UTC (rev 173516)
@@ -538,6 +538,11 @@
return frameLoader()->client().shouldUseCredentialStorage(documentLoader(), identifier());
}
+bool ResourceLoader::isAllowedToAskUserForCredentials() const
+{
+ return m_options.clientCredentialPolicy() == AskClientForAllCredentials || (m_options.clientCredentialPolicy() == DoNotAskClientForCrossOriginCredentials && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()));
+}
+
void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)
{
ASSERT(m_handle->hasAuthenticationChallenge());
@@ -547,7 +552,7 @@
Ref<ResourceLoader> protect(*this);
if (m_options.allowCredentials() == AllowStoredCredentials) {
- if (m_options.clientCredentialPolicy() == AskClientForAllCredentials || (m_options.clientCredentialPolicy() == DoNotAskClientForCrossOriginCredentials && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()))) {
+ if (isAllowedToAskUserForCredentials()) {
frameLoader()->notifier().didReceiveAuthenticationChallenge(this, challenge);
return;
}
Modified: trunk/Source/WebCore/loader/ResourceLoader.h (173515 => 173516)
--- trunk/Source/WebCore/loader/ResourceLoader.h 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/Source/WebCore/loader/ResourceLoader.h 2014-09-11 17:20:18 UTC (rev 173516)
@@ -122,10 +122,11 @@
bool shouldSendResourceLoadCallbacks() const { return m_options.sendLoadCallbacks() == SendCallbacks; }
void setSendCallbackPolicy(SendCallbackPolicy sendLoadCallbacks) { m_options.setSendLoadCallbacks(sendLoadCallbacks); }
bool shouldSniffContent() const { return m_options.sniffContent() == SniffContent; }
- ClientCredentialPolicy clientCredentialPolicy() const { return m_options.clientCredentialPolicy(); }
+ WEBCORE_EXPORT bool isAllowedToAskUserForCredentials() const;
bool reachedTerminalState() const { return m_reachedTerminalState; }
+
const ResourceRequest& request() const { return m_request; }
void setDataBufferingPolicy(DataBufferingPolicy);
Modified: trunk/Source/WebKit2/ChangeLog (173515 => 173516)
--- trunk/Source/WebKit2/ChangeLog 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/Source/WebKit2/ChangeLog 2014-09-11 17:20:18 UTC (rev 173516)
@@ -1,3 +1,19 @@
+2014-09-11 Youenn Fablet <[email protected]>
+
+ [WK2] Authentication dialog is displayed for cross-origin XHR
+ https://bugs.webkit.org/show_bug.cgi?id=131349
+
+ Reviewed by Alexey Proskuryakov.
+
+ Precomputing client credential policy in the Web Process before sending the resource load task to the Network Process.
+
+ * NetworkProcess/NetworkResourceLoader.cpp:
+ (WebKit::NetworkResourceLoader::didReceiveAuthenticationChallenge): Added an ASSERT to ensure that credential policy is never set to DoNotAskClientForCrossOriginCredentials.
+ * WebProcess/Network/WebResourceLoadScheduler.cpp:
+ (WebKit::WebResourceLoadScheduler::scheduleLoad): Precomputing client credential policy to handle the case of cross-origin requests.
+ * WebProcess/Network/WebResourceLoader.cpp:
+ (WebKit::WebResourceLoader::willSendRequest): Added a TODO to check whether redirections need a specific handling.
+
2014-09-11 Carlos Garcia Campos <[email protected]>
[GTK] Merge WebKitAuthenticationWidget into WebKitAuthenticationDialog
Modified: trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp (173515 => 173516)
--- trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp 2014-09-11 17:20:18 UTC (rev 173516)
@@ -357,10 +357,9 @@
void NetworkResourceLoader::didReceiveAuthenticationChallenge(ResourceHandle* handle, const AuthenticationChallenge& challenge)
{
ASSERT_UNUSED(handle, handle == m_handle);
+ // NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
+ ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);
- // FIXME (http://webkit.org/b/115291): Since we go straight to the UI process for authentication we don't get WebCore's
- // cross-origin check before asking the client for credentials.
- // Therefore we are too permissive in the case where the ClientCredentialPolicy is DoNotAskClientForCrossOriginCredentials.
if (m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials) {
challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
return;
Modified: trunk/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp (173515 => 173516)
--- trunk/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp 2014-09-11 17:20:18 UTC (rev 173516)
@@ -169,7 +169,7 @@
loadParameters.contentSniffingPolicy = contentSniffingPolicy;
loadParameters.allowStoredCredentials = allowStoredCredentials;
// If there is no WebFrame then this resource cannot be authenticated with the client.
- loadParameters.clientCredentialPolicy = (webFrame && webPage) ? resourceLoader->clientCredentialPolicy() : DoNotAskClientForAnyCredentials;
+ loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader->isAllowedToAskUserForCredentials()) ? AskClientForAllCredentials : DoNotAskClientForAnyCredentials;
loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;
loadParameters.isMainResource = resource && resource->type() == CachedResource::MainResource;
loadParameters.defersLoading = resourceLoader->defersLoading();
Modified: trunk/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp (173515 => 173516)
--- trunk/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp 2014-09-11 16:13:23 UTC (rev 173515)
+++ trunk/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp 2014-09-11 17:20:18 UTC (rev 173516)
@@ -89,6 +89,7 @@
ResourceRequest newRequest = proposedRequest;
if (m_coreLoader->documentLoader()->applicationCacheHost()->maybeLoadFallbackForRedirect(m_coreLoader.get(), newRequest, redirectResponse))
return;
+ // FIXME: Do we need to update NetworkResourceLoader clientCredentialPolicy in case loader policy is DoNotAskClientForCrossOriginCredentials?
m_coreLoader->willSendRequest(newRequest, redirectResponse);
if (!m_coreLoader)
