Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upUse origin of final HTTP response as document origin #23887
Conversation
highfive
commented
Jul 29, 2019
|
Heads up! This PR modifies the following files:
|
highfive
commented
Jul 29, 2019
|
|
|
This doesn't affect any test results? That's surprising! You can r=me |
|
I made the PR so I could check the test results :) |
Use origin of final HTTP response as document origin I discovered surprising problems when loading pages from http://joshmatthews.net that load same-origin images and try to use them as webgl textures. Since there's a redirect from joshmatthews.net to www.joshmatthews.net, the images are not considered same-origin in Servo because the document stores the origin for the original request's URL, rather than the origin of the response that is received after processing any redirections. <!-- Reviewable:start --> --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/23887) <!-- Reviewable:end -->
|
|
|
That's kind of unnerving. |
|
Er yes, there are tests for similar-but-not-same-origin forwarding? |
|
I added a test that failed before this change and now passes. |
|
|
Use origin of final HTTP response as document origin I discovered surprising problems when loading pages from http://joshmatthews.net that load same-origin images and try to use them as webgl textures. Since there's a redirect from joshmatthews.net to www.joshmatthews.net, the images are not considered same-origin in Servo because the document stores the origin for the original request's URL, rather than the origin of the response that is received after processing any redirections. <!-- Reviewable:start --> --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/23887) <!-- Reviewable:end -->
|
|
| var path = new URL("document_origin_redirect_subpage.html", document.location).pathname; | ||
| var CROSS_ORIGIN_URL = new URL(path, get_host_info().HTTP_REMOTE_ORIGIN); | ||
| var SAME_ORIGIN_URL = "/common/redirect.py?location=" + CROSS_ORIGIN_URL; | ||
| console.log(SAME_ORIGIN_URL); |
This comment has been minimized.
This comment has been minimized.
jdm commentedJul 29, 2019
•
edited by SimonSapin
I discovered surprising problems when loading pages from http://joshmatthews.net that load same-origin images and try to use them as webgl textures. Since there's a redirect from joshmatthews.net to www.joshmatthews.net, the images are not considered same-origin in Servo because the document stores the origin for the original request's URL, rather than the origin of the response that is received after processing any redirections.
This change is