diff options
| -rw-r--r-- | components/net/fetch/methods.rs | 2 | ||||
| -rw-r--r-- | components/net/http_loader.rs | 8 |
2 files changed, 6 insertions, 4 deletions
diff --git a/components/net/fetch/methods.rs b/components/net/fetch/methods.rs index 2c2bd877eae..f43cd591636 100644 --- a/components/net/fetch/methods.rs +++ b/components/net/fetch/methods.rs @@ -118,7 +118,7 @@ pub fn main_fetch(request: &mut Request, // TODO: handle upgrade to a potentially secure URL. // Step 5. - if should_be_blocked_due_to_bad_port(&request.url()) { + if should_be_blocked_due_to_bad_port(&request.current_url()) { response = Some(Response::network_error(NetworkError::Internal("Request attempted on bad port".into()))); } // TODO: handle blocking as mixed content. diff --git a/components/net/http_loader.rs b/components/net/http_loader.rs index 05fb6dbf1ee..932318ce1ae 100644 --- a/components/net/http_loader.rs +++ b/components/net/http_loader.rs @@ -670,8 +670,10 @@ pub fn http_redirect_fetch(request: &mut Request, request.redirect_count += 1; // Step 7 - // FIXME: Correctly use request's origin - let same_origin = location_url.origin() == request.current_url().origin(); + let same_origin = match request.origin { + Origin::Origin(ref origin) => *origin == location_url.origin(), + Origin::Client => panic!("Request origin should not be client for {}", request.current_url()), + }; let has_credentials = has_credentials(&location_url); if request.mode == RequestMode::CorsMode && !same_origin && has_credentials { @@ -690,7 +692,7 @@ pub fn http_redirect_fetch(request: &mut Request, } // Step 10 - if cors_flag && !same_origin { + if cors_flag && location_url.origin() != request.current_url().origin() { request.origin = Origin::Origin(ImmutableOrigin::new_opaque()); } |