Worker: Change the default credentials option from 'omit' to 'same-origin' #11274
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wpt-pr-bot
approved these changes
May 31, 2018
…igin' This is a follow-up for the spec change: whatwg/html#3656 Note that ES Modules for dedicated workers is still behind the flag and this change doesn't affect applications in the real world. Bug: 848247 Change-Id: I25083f3f11f9d13663e16e2f4c137095e9b12b01 Reviewed-on: https://chromium-review.googlesource.com/1080668 Reviewed-by: Matt Falkenhagen <falken@chromium.org> Commit-Queue: Hiroki Nakagawa <nhiroki@chromium.org> Cr-Commit-Position: refs/heads/master@{#563465}
chromium-wpt-export-bot
force-pushed
the
chromium-export-cl-1080668
branch
from
f9c0034
to
c5306b0
Compare
5 tasks
domenic
pushed a commit
to whatwg/html
that referenced
this pull request
Oct 9, 2018
* Module scripts are always fetched with request credentials mode "same-origin" by default, instead of the previous default of "omit". Only worker module scripts can still set that to "omit", using the credentials option to the Worker constructor. Non-worker module scripts, which only have the crossorigin="" attribute available, can only toggle between "same-origin" and "include", similar to how crossorigin="" works for other platform features. * Similarly, import() statements inside of classic scripts now use the "same-origin" credentials mode, instead of "omit". This affects both <script> elements, where the default can be changed using crossorigin="", and other contexts like javascript: URLs and classic worker scripts, where the default cannot be changed. * The top-level script for module workers is always fetched with request mode "same-origin". Cross-origin workers did not quite work due to service workers. Fixes #2557. Fixes #3109. Tests: * web-platform-tests/wpt#11274 * web-platform-tests/wpt#13176 * web-platform-tests/wpt#13426
mustaqahmed
pushed a commit
to mustaqahmed/html
that referenced
this pull request
Feb 15, 2019
* Module scripts are always fetched with request credentials mode "same-origin" by default, instead of the previous default of "omit". Only worker module scripts can still set that to "omit", using the credentials option to the Worker constructor. Non-worker module scripts, which only have the crossorigin="" attribute available, can only toggle between "same-origin" and "include", similar to how crossorigin="" works for other platform features. * Similarly, import() statements inside of classic scripts now use the "same-origin" credentials mode, instead of "omit". This affects both <script> elements, where the default can be changed using crossorigin="", and other contexts like javascript: URLs and classic worker scripts, where the default cannot be changed. * The top-level script for module workers is always fetched with request mode "same-origin". Cross-origin workers did not quite work due to service workers. Fixes whatwg#2557. Fixes whatwg#3109. Tests: * web-platform-tests/wpt#11274 * web-platform-tests/wpt#13176 * web-platform-tests/wpt#13426
mustaqahmed
pushed a commit
to mustaqahmed/html
that referenced
this pull request
Feb 15, 2019
* Module scripts are always fetched with request credentials mode "same-origin" by default, instead of the previous default of "omit". Only worker module scripts can still set that to "omit", using the credentials option to the Worker constructor. Non-worker module scripts, which only have the crossorigin="" attribute available, can only toggle between "same-origin" and "include", similar to how crossorigin="" works for other platform features. * Similarly, import() statements inside of classic scripts now use the "same-origin" credentials mode, instead of "omit". This affects both <script> elements, where the default can be changed using crossorigin="", and other contexts like javascript: URLs and classic worker scripts, where the default cannot be changed. * The top-level script for module workers is always fetched with request mode "same-origin". Cross-origin workers did not quite work due to service workers. Fixes whatwg#2557. Fixes whatwg#3109. Tests: * web-platform-tests/wpt#11274 * web-platform-tests/wpt#13176 * web-platform-tests/wpt#13426
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a follow-up for the spec change:
whatwg/html#3656
Note that ES Modules for dedicated workers is still behind the flag and this
change doesn't affect applications in the real world.
Bug: 848247
Change-Id: I25083f3f11f9d13663e16e2f4c137095e9b12b01
Reviewed-on: https://chromium-review.googlesource.com/1080668
Reviewed-by: Matt Falkenhagen falken@chromium.org
Commit-Queue: Hiroki Nakagawa nhiroki@chromium.org
Cr-Commit-Position: refs/heads/master@{#563465}