Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove Authorization header upon cross-origin redirect #1544

Merged
merged 1 commit into from Nov 25, 2022
Merged

Remove Authorization header upon cross-origin redirect #1544

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
17 changes: 13 additions & 4 deletions fetch.bs
View file
Open in desktop
Expand Up @@ -4934,11 +4934,10 @@ run these steps:
<li><p>If <var>locationURL</var>'s <a for=url>scheme</a> is not an <a>HTTP(S) scheme</a>, then
return a <a>network error</a>.

<li><p>If <var>request</var>'s <a for=request>redirect count</a> is
twenty, return a <a>network error</a>.
<li><p>If <var>request</var>'s <a for=request>redirect count</a> is 20, then return a
<a>network error</a>.

<li><p>Increase <var>request</var>'s
<a for=request>redirect count</a> by one.
<li><p>Increase <var>request</var>'s <a for=request>redirect count</a> by 1.

<li><p>If <var>request</var>'s <a for=request>mode</a> is "<code>cors</code>",
<var>locationURL</var> <a>includes credentials</a>, and <var>request</var>'s
Expand Down Expand Up @@ -4976,6 +4975,16 @@ run these steps:
<a for=request>header list</a>.
</ol>

<li>
<p>If <var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a> is not
<a>same origin</a> with <var>locationURL</var>'s <a for=url>origin</a>, then
<a for=list>for each</a> <var>headerName</var> of <a>CORS non-wildcard request-header name</a>,
<a for="header list">delete</a> <var>headerName</var> from <var>request</var>'s
<a for=request>header list</a>.

<p class=note>I.e., the moment another origin is seen after the initial request, the
`<code>Authorization</code>` header is removed.

<li>
<p>If <var>request</var>'s <a for=request>body</a> is non-null, then set <var>request</var>'s
<a for=request>body</a> to the <a for="body with type">body</a> of the result of
Expand Down