Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(ext/fetch): no auth on cross origin redirect #16745

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

fix(ext/fetch): no auth on cross origin redirect #16745

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
cc513dc
fix(ext/fetch): no auth on cross origin redirect
lucacasonato Nov 21, 2022
251555d
Merge branch 'main' into fetch_no_auth_cross_origin_redirect
aapoalas Jul 7, 2023
408dd7a
Merge branch 'main' into fetch_no_auth_cross_origin_redirect
bartlomieju Aug 27, 2023
a49b09c
Merge branch 'main' into fetch_no_auth_cross_origin_redirect
bartlomieju Aug 28, 2023
9dde766
update expectations.json
bartlomieju Aug 28, 2023
55b30ca
Merge branch 'main' into fetch_no_auth_cross_origin_redirect
dsherret Sep 18, 2023
c0fe17d
Merge branch 'main' into fetch_no_auth_cross_origin_redirect
aapoalas Oct 28, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
18 changes: 18 additions & 0 deletions ext/fetch/26_fetch.js
View file
Open in desktop
Expand Up @@ -308,6 +308,16 @@
return response;
}

/**
* @param {URL} a
* @param {URL} b
* @returns {boolean}
*/
function isSameOrigin(a, b) {
if (a.origin === null) return false;
return a.origin === b.origin;
}

/**
* @param {InnerRequest} request
* @param {InnerResponse} response
Expand Down Expand Up @@ -366,6 +376,14 @@
}
}
}
if (!isSameOrigin(request.currentUrl(), locationURL)) {
for (let i = 0; i < request.headerList.length; i++) {
if (byteLowerCase(request.headerList[i][0]) == "authorization") {
ArrayPrototypeSplice(request.headerList, i, 1);
i--;
}
}
}
if (request.body !== null) {
const res = extractBody(request.body.source);
request.body = res.body;
Expand Down