diff options
| author | raymes <raymes@chromium.org> | 2015-03-12 17:35:43 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-03-13 00:36:18 +0000 |
| commit | ea64fb20a0c9480046264075d056428d9ab3918c (patch) | |
| tree | b55034f7ab545076fb5eb5f170379fb9a36f4cb1 /extensions/renderer/guest_view | |
| parent | cb7f762e30888f8ea8c8ba27d5bac447a53c1a0d (diff) | |
| download | chromium_src-ea64fb20a0c9480046264075d056428d9ab3918c.zip chromium_src-ea64fb20a0c9480046264075d056428d9ab3918c.tar.gz chromium_src-ea64fb20a0c9480046264075d056428d9ab3918c.tar.bz2 | |
Always set allowCredentials for embedded MimeHandlerView requests.
This ensures that credentials/cookies are always sent with the request. This
should be safe as we control the request tightly - it is a GET request
triggered by a site containing an <embed src="<url>"> tag. The only user
supplied value in the request (besides the credentials) is the <url>.
This behavior should be similar to iframes.
BUG=465932
Review URL: https://codereview.chromium.org/997783002
Cr-Commit-Position: refs/heads/master@{#320414}
Diffstat (limited to 'extensions/renderer/guest_view')
| -rw-r--r-- | extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc b/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc index e8657e6..6371561 100644 --- a/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc +++ b/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc @@ -127,9 +127,11 @@ void MimeHandlerViewContainer::Ready() { blink::WebFrame* frame = render_frame()->GetWebFrame(); blink::WebURLLoaderOptions options; - // The embedded plugin is allowed to be cross-origin. + // The embedded plugin is allowed to be cross-origin and we should always + // send credentials/cookies with the request. options.crossOriginRequestPolicy = blink::WebURLLoaderOptions::CrossOriginRequestPolicyAllow; + options.allowCredentials = true; DCHECK(!loader_); loader_.reset(frame->createAssociatedURLLoader(options)); |