bool CrossOriginPreflightResultCacheItem::allowsRequest(bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const
{
String ignoredExplanation;
if (m_absoluteExpiryTime < currentTime())
return false;
if (includeCredentials && !m_credentials)
return false;
if (!allowsCrossOriginMethod(method, ignoredExplanation))
return false;
if (!allowsCrossOriginHeaders(requestHeaders, ignoredExplanation))
return false;
return true;
}
bool CrossOriginPreflightResultCacheItem::allowsRequest(StoredCredentials includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const
{
String ignoredExplanation;
if (m_absoluteExpiryTime < monotonicallyIncreasingTime())
return false;
if (includeCredentials == AllowStoredCredentials && m_credentials == DoNotAllowStoredCredentials)
return false;
if (!allowsCrossOriginMethod(method, ignoredExplanation))
return false;
if (!allowsCrossOriginHeaders(requestHeaders, ignoredExplanation))
return false;
return true;
}
void DocumentThreadableLoader::didReceiveResponse(unsigned long identifier, const ResourceResponse& response)
{
ASSERT(m_client);
String accessControlErrorDescription;
if (m_actualRequest) {
DocumentLoader* loader = m_document.frame()->loader().documentLoader();
InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceResponse(m_document.frame());
InspectorInstrumentation::didReceiveResourceResponse(cookie, identifier, loader, response, 0);
if (!passesAccessControlCheck(response, m_options.allowCredentials(), securityOrigin(), accessControlErrorDescription)) {
preflightFailure(identifier, response.url(), accessControlErrorDescription);
return;
}
StoredCredentials allowCredentials = m_options.allowCredentials();
auto preflightResult = std::make_unique<CrossOriginPreflightResultCacheItem>(allowCredentials);
if (!preflightResult->parse(response, accessControlErrorDescription)
|| !preflightResult->allowsCrossOriginMethod(m_actualRequest->httpMethod(), accessControlErrorDescription)
|| !preflightResult->allowsCrossOriginHeaders(m_actualRequest->httpHeaderFields(), accessControlErrorDescription)) {
preflightFailure(identifier, response.url(), accessControlErrorDescription);
return;
}
CrossOriginPreflightResultCache::singleton().appendEntry(securityOrigin()->toString(), m_actualRequest->url(), WTFMove(preflightResult));
} else {
if (!m_sameOriginRequest && m_options.crossOriginRequestPolicy == UseAccessControl) {
if (!passesAccessControlCheck(response, m_options.allowCredentials(), securityOrigin(), accessControlErrorDescription)) {
m_client->didFailAccessControlCheck(ResourceError(errorDomainWebKitInternal, 0, response.url(), accessControlErrorDescription));
return;
}
}
m_client->didReceiveResponse(identifier, response);
}
}
