8000 CSP 3: Update Content Security Policy when header sent as part of a 3… · WebKit/WebKit@9bcb547 · GitHub
[go: up one dir, main page]
Skip to content

Commit 9bcb547

Browse files
rrenorreno
committed
CSP 3: Update Content Security Policy when header sent as part of a 304 response
https://bugs.webkit.org/show_bug.cgi?id=244637 rdar://99405897 Reviewed by Brent Fulgham. We ignore any headers with the "Content-" prefix in a 304 response. This change special-cases the Content-Security-Policy and Content-Security-Policy-Report-Only headers to be included in the cached response. This has the effect of updating the cache entry's CSP if the server sends a new CSP in a 304 response. * LayoutTests/imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub-expected.txt: * Source/WebCore/platform/network/CacheValidation.cpp: (WebCore::shouldUpdateHeaderAfterRevalidation): Canonical link: https://commits.webkit.org/258931@main
1 parent 0b04b92 commit 9bcb547

File tree

2 files changed

+5
-2
lines changed

2 files changed

+5
-2
lines changed

‎LayoutTests/imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub-expected.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22

33
PASS Test that the first frame uses nonce abc
44
PASS Test that the first frame does not use nonce def
5-
FAIL Test that the second frame uses nonce def assert_unreached: Unexpected message received Reached unreachable code
6-
FAIL Test that the second frame does not use nonce abc assert_unreached: Unexpected message received Reached unreachable code
5+
PASS Test that the second frame uses nonce def
6+
PASS Test that the second frame does not use nonce abc
77

‎Source/WebCore/platform/network/CacheValidation.cpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,9 @@ static constexpr ASCIILiteral headerPrefixesToIgnoreAfterRevalidation[] = {
6868

6969
static inline bool shouldUpdateHeaderAfterRevalidation(const String& header)
7070
{
71+
if (header.startsWithIgnoringASCIICase("content-security-"_s))
72+
return true;
73+
7174
for (auto& headerToIgnore : headersToIgnoreAfterRevalidation) {
7275
if (equalIgnoringASCIICase(header, headerToIgnore))
7376
return false;

0 commit comments

Comments
 (0)
0