diff options
Diffstat (limited to 'chromium/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc')
| -rw-r--r-- | chromium/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/chromium/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc b/chromium/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc index 5b6548957fa..32e05d15ca4 100644 --- a/chromium/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc +++ b/chromium/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc @@ -152,6 +152,26 @@ void ModuleScriptLoader::FetchInternal( fetch_client_settings_object->GetSecurityOrigin(), options_.CredentialsMode()); + // <spec step="6">If destination is "worker" or "sharedworker" and the + // top-level module fetch flag is set, then set request's mode to + // "same-origin".</spec> + // + // `kServiceWorker` is included here for consistency, while it isn't mentioned + // in the spec. This doesn't affect the behavior, because we already forbid + // redirects and cross-origin response URLs in other places. + if ((module_request.Destination() == + WebURLRequest::kRequestContextWorker || + module_request.Destination() == + WebURLRequest::kRequestContextSharedWorker || + module_request.Destination() == + WebURLRequest::kRequestContextServiceWorker) && + level == ModuleGraphLevel::kTopLevelModuleFetch) { + // This should be done after SetCrossOriginAccessControl() that sets the + // mode to kCors. + fetch_params.MutableResourceRequest().SetMode( + network::mojom::RequestMode::kSameOrigin); + } + // Step 5. "... referrer is referrer, ..." [spec text] fetch_params.MutableResourceRequest().SetHTTPReferrer( module_request.GetReferrer()); |