08766d47f4
When an HTTPS response carries a Strict-Transport-Security header, the received policy is now respected. Subsequent HTTP requests to a known HSTS host are upgraded to HTTPS before the fetch algorithm makes further decisions such as CORS and mixed content. Fixes tpexpress.co.uk, where an XHR redirects HTTPS -> HTTP -> HTTPS, relying on a HSTS policy received on the document response to avoid the CORS failure.
21 lines
1.1 KiB
Text
21 lines
1.1 KiB
Text
#include <LibHTTP/Cookie/Cookie.h>
|
|
#include <LibHTTP/HSTS/ParsedHSTSPolicy.h>
|
|
#include <LibIPC/TransportHandle.h>
|
|
#include <LibURL/URL.h>
|
|
#include <LibWeb/Bindings/AgentType.h>
|
|
#include <LibWeb/HTML/BroadcastChannelMessage.h>
|
|
#include <LibWeb/HTML/WorkerAgentTypes.h>
|
|
|
|
endpoint WebWorkerClient {
|
|
did_close_worker() =|
|
|
did_finish_loading_worker_script(bool worker_is_secure_context) =|
|
|
did_fail_loading_worker_script() =|
|
|
did_report_worker_exception(String message, String filename, u32 lineno, u32 colno) =|
|
|
did_request_cookie(URL::URL url, HTTP::Cookie::Source source) => (HTTP::Cookie::VersionedCookie cookie)
|
|
did_request_file(ByteString path, i32 request_id) =|
|
|
did_store_hsts_policy(String domain, HTTP::HSTS::ParsedHSTSPolicy policy) =|
|
|
did_is_known_hsts_host(String domain) => (bool result)
|
|
did_post_broadcast_channel_message(Web::HTML::BroadcastChannelMessage message) =|
|
|
start_worker_agent(Web::HTML::WorkerAgentStartRequest request) => (Web::HTML::WorkerAgentId agent_id)
|
|
close_worker_agent(Web::HTML::WorkerAgentId agent_id, Web::HTML::WorkerAgentOwnerToken owner_token) =|
|
|
}
|