Original report by me.
Original issue 950 created by magreenblatt on 2013-04-18T17:36:42.000Z:
What steps will reproduce the problem?
- Register a custom standard scheme (for example, "myscheme").
- Attempt an XMLHttpRequest (XHR) where the target URL redirects to a different origin. For example:
A. Add a cross-origin whitelist entry for the domains (current origin is "myscheme://mydomain"):
CefAddCrossOriginWhitelistEntry("myscheme://mydomain", "myscheme", "mydomain2", false);
B. Send an XHR request where "myscheme://mydomain/xhr.html" redirects to "myscheme://mydomain2/xhr.html":
xhr = new XMLHttpRequest();
xhr.open("GET", "myscheme://mydomain/xhr.html", true);
xhr.onload = function(e) { ... }
xhr.send();
What is the expected output? What do you see instead?
The request should succeed. Instead, the request fails.
There are a few different problems here:
-
Custom standard schemes are not currently registered as CORS-enabled so all CORS checks fail immediately.
-
All synchronous cross-origin XHR redirects are denied in SyncResourceHandler::OnRequestRedirected().
-
Asynchronous cross-origin XHR redirects are filtered based on CORS restrictions in DocumentThreadableLoader::redirectReceived(). However, some redirects are handled internally using URLRequestRedirectJob (for example, changing the URL in CefRequestHandler::OnBeforeResourceLoad) and there is no opportunity for the client to add the necessary CORS headers.
Original report by me.
Original issue 950 created by magreenblatt on 2013-04-18T17:36:42.000Z:
What steps will reproduce the problem?
A. Add a cross-origin whitelist entry for the domains (current origin is "myscheme://mydomain"):
CefAddCrossOriginWhitelistEntry("myscheme://mydomain", "myscheme", "mydomain2", false);
B. Send an XHR request where "myscheme://mydomain/xhr.html" redirects to "myscheme://mydomain2/xhr.html":
xhr = new XMLHttpRequest();
xhr.open("GET", "myscheme://mydomain/xhr.html", true);
xhr.onload = function(e) { ... }
xhr.send();
What is the expected output? What do you see instead?
The request should succeed. Instead, the request fails.
There are a few different problems here:
Custom standard schemes are not currently registered as CORS-enabled so all CORS checks fail immediately.
All synchronous cross-origin XHR redirects are denied in SyncResourceHandler::OnRequestRedirected().
Asynchronous cross-origin XHR redirects are filtered based on CORS restrictions in DocumentThreadableLoader::redirectReceived(). However, some redirects are handled internally using URLRequestRedirectJob (for example, changing the URL in CefRequestHandler::OnBeforeResourceLoad) and there is no opportunity for the client to add the necessary CORS headers.