{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/112","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/112/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/112/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/112/events","html_url":"https://github.com/whatwg/fetch/issues/112","id":101910352,"number":112,"title":"redirecting from same-origin to cross-origin CORS with userpass should fail","user":{"login":"wanderview","id":1256526,"avatar_url":"https://avatars.githubusercontent.com/u/1256526?v=3","gravatar_id":"","url":"https://api.github.com/users/wanderview","html_url":"https://github.com/wanderview","followers_url":"https://api.github.com/users/wanderview/followers","following_url":"https://api.github.com/users/wanderview/following{/other_user}","gists_url":"https://api.github.com/users/wanderview/gists{/gist_id}","starred_url":"https://api.github.com/users/wanderview/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wanderview/subscriptions","organizations_url":"https://api.github.com/users/wanderview/orgs","repos_url":"https://api.github.com/users/wanderview/repos","events_url":"https://api.github.com/users/wanderview/events{/privacy}","received_events_url":"https://api.github.com/users/wanderview/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-19T14:43:19Z","updated_at":"2015-08-20T08:28:20Z","closed_at":"2015-08-20T08:26:58Z","body":"Currently the redirect section of [HTTP Fetch](https://fetch.spec.whatwg.org/#http-fetch) step 5 says:\r\n\r\n> If the CORS flag is set and either locationURL's username is not the empty string or locationURL's password is non-null, return a network error.\r\n\r\nAs far as I can tell, the only way for the CORS flag to be set is if we've previously already redirected through a CORS origin.  If the CORS location with userpass was reached from a same-origin URL redirecting, then the CORS flag is not set.\r\n\r\nThis is counter to how the existing gecko CORS infrastructure works.  It blocks userpass when redirecting to a CORS enabled server regardless of the originating origin doing the redirect.  Gecko code is here:\r\n\r\n  https://dxr.mozilla.org/mozilla-central/source/dom/security/nsCORSListenerProxy.cpp?case=true&from=nsCORSListenerProxy.cpp#957\r\n\r\nWhich is correct?  It seems the gecko version is safer, but maybe its too conservative?\r\n\r\nIt seems whatever we decide here should also be applied to:\r\n\r\n> If the CORS flag is set and locationURL's origin is not request's current url's origin, set request's origin to an opaque identifier. \r\n\r\nIn both cases it seems perhaps we should be checking if the RequestMode is 'cors' instead of checking the CORS flag."},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/132935011","html_url":"https://github.com/whatwg/fetch/issues/112#issuecomment-132935011","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/112","id":132935011,"user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"created_at":"2015-08-20T08:28:20Z","updated_at":"2015-08-20T08:28:20Z","body":"Thank you, fixed.\r\n\r\nI ended up checking both the _CORS flag_ and the mode. Otherwise cross-origin to same-origin would not be covered."}}