1554538 - Consider stripping credentials from URLs for cross-origin loads instead of failing the CORS load

Status: NEW

(Core :: DOM: Networking, defect, P3)

Description

[(no longer active)]

We currently fail https://searchfox.org/mozilla-central/source/testing/web-platform/tests/xhr/access-control-preflight-credential-async.htm and https://searchfox.org/mozilla-central/source/testing/web-platform/tests/xhr/access-control-preflight-credential-sync.htm because we raise an error event. This happens because we bail out here: https://searchfox.org/mozilla-central/rev/aba472751e24763d0c18bae8408e9d7106e9acea/netwerk/protocol/http/nsCORSListenerProxy.cpp#951.

This test was originally added in https://bugs.webkit.org/show_bug.cgi?id=37781. Comment 2 of that bug suggests that WebKit has historically done this for cross-origin loads (not sure if that means CORS loads or not...). We should probably consider adopting the same behaviour.

Anne, is this specified in fetch?

Comment 1

[Anne (:annevk)]

Yeah, step 5.17.2.3 of https://fetch.spec.whatwg.org/#http-network-or-cache-fetch would not have the authentication-fetch flag set. (That only gets set after a 401 that the browser handles, which isn't allowed during CORS.)