Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Worker: Change the default credentials option from 'omit' to 'same-origin' #11274

Merged
merged 1 commit into from
Jun 1, 2018

Conversation

chromium-wpt-export-bot
Copy link
Collaborator

@chromium-wpt-export-bot chromium-wpt-export-bot commented May 31, 2018

This is a follow-up for the spec change:
whatwg/html#3656

Note that ES Modules for dedicated workers is still behind the flag and this
change doesn't affect applications in the real world.

Bug: 848247
Change-Id: I25083f3f11f9d13663e16e2f4c137095e9b12b01
Reviewed-on: https://chromium-review.googlesource.com/1080668
Reviewed-by: Matt Falkenhagen [email protected]
Commit-Queue: Hiroki Nakagawa [email protected]
Cr-Commit-Position: refs/heads/master@{#563465}

Copy link
Collaborator

@wpt-pr-bot wpt-pr-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Already reviewed downstream.

…igin'

This is a follow-up for the spec change:
whatwg/html#3656

Note that ES Modules for dedicated workers is still behind the flag and this
change doesn't affect applications in the real world.

Bug: 848247
Change-Id: I25083f3f11f9d13663e16e2f4c137095e9b12b01
Reviewed-on: https://chromium-review.googlesource.com/1080668
Reviewed-by: Matt Falkenhagen <[email protected]>
Commit-Queue: Hiroki Nakagawa <[email protected]>
Cr-Commit-Position: refs/heads/master@{#563465}
@chromium-wpt-export-bot chromium-wpt-export-bot force-pushed the chromium-export-cl-1080668 branch from f9c0034 to c5306b0 Compare June 1, 2018 01:16
@chromium-wpt-export-bot chromium-wpt-export-bot merged commit 72c7cfe into master Jun 1, 2018
@chromium-wpt-export-bot chromium-wpt-export-bot deleted the chromium-export-cl-1080668 branch June 1, 2018 01:27
domenic pushed a commit to whatwg/html that referenced this pull request Oct 9, 2018
* Module scripts are always fetched with request credentials mode
  "same-origin" by default, instead of the previous default of "omit".
  Only worker module scripts can still set that to "omit", using the
  credentials option to the Worker constructor. Non-worker module
  scripts, which only have the crossorigin="" attribute available, can
  only toggle between "same-origin" and "include", similar to how
  crossorigin="" works for other platform features.
* Similarly, import() statements inside of classic scripts now use the
  "same-origin" credentials mode, instead of "omit". This affects both
  <script> elements, where the default can be changed using
  crossorigin="", and other contexts like javascript: URLs and classic
  worker scripts, where the default cannot be changed.
* The top-level script for module workers is always fetched with request
  mode "same-origin". Cross-origin workers did not quite work due to
  service workers.

Fixes #2557. Fixes #3109.

Tests:

* web-platform-tests/wpt#11274
* web-platform-tests/wpt#13176
* web-platform-tests/wpt#13426
mustaqahmed pushed a commit to mustaqahmed/html that referenced this pull request Feb 15, 2019
* Module scripts are always fetched with request credentials mode
  "same-origin" by default, instead of the previous default of "omit".
  Only worker module scripts can still set that to "omit", using the
  credentials option to the Worker constructor. Non-worker module
  scripts, which only have the crossorigin="" attribute available, can
  only toggle between "same-origin" and "include", similar to how
  crossorigin="" works for other platform features.
* Similarly, import() statements inside of classic scripts now use the
  "same-origin" credentials mode, instead of "omit". This affects both
  <script> elements, where the default can be changed using
  crossorigin="", and other contexts like javascript: URLs and classic
  worker scripts, where the default cannot be changed.
* The top-level script for module workers is always fetched with request
  mode "same-origin". Cross-origin workers did not quite work due to
  service workers.

Fixes whatwg#2557. Fixes whatwg#3109.

Tests:

* web-platform-tests/wpt#11274
* web-platform-tests/wpt#13176
* web-platform-tests/wpt#13426
mustaqahmed pushed a commit to mustaqahmed/html that referenced this pull request Feb 15, 2019
* Module scripts are always fetched with request credentials mode
  "same-origin" by default, instead of the previous default of "omit".
  Only worker module scripts can still set that to "omit", using the
  credentials option to the Worker constructor. Non-worker module
  scripts, which only have the crossorigin="" attribute available, can
  only toggle between "same-origin" and "include", similar to how
  crossorigin="" works for other platform features.
* Similarly, import() statements inside of classic scripts now use the
  "same-origin" credentials mode, instead of "omit". This affects both
  <script> elements, where the default can be changed using
  crossorigin="", and other contexts like javascript: URLs and classic
  worker scripts, where the default cannot be changed.
* The top-level script for module workers is always fetched with request
  mode "same-origin". Cross-origin workers did not quite work due to
  service workers.

Fixes whatwg#2557. Fixes whatwg#3109.

Tests:

* web-platform-tests/wpt#11274
* web-platform-tests/wpt#13176
* web-platform-tests/wpt#13426
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants