diff --git a/dom/security/ReferrerInfo.cpp b/dom/security/ReferrerInfo.cpp index 050cb916f2e3..0d7107ce0469 100644 --- a/dom/security/ReferrerInfo.cpp +++ b/dom/security/ReferrerInfo.cpp @@ -412,11 +412,13 @@ bool ReferrerInfo::ShouldSetNullOriginHeader(net::HttpBaseChannel* aChannel, } } - // When we're dealing with CORS (mode is "cors"), we shouldn't take the - // Referrer-Policy into account + // When deal with CORS (mode is "cors") and go through a cross-origin URL, + // response tainting is "cors" and we shouldn't take the Referrer-Policy into + // account uint32_t corsMode = CORS_NONE; NS_ENSURE_SUCCESS(aChannel->GetCorsMode(&corsMode), false); - if (corsMode == CORS_USE_CREDENTIALS) { + bool isCrossOriginRequest = ReferrerInfo::IsCrossOriginRequest(aChannel); + if (corsMode == CORS_USE_CREDENTIALS && isCrossOriginRequest) { return false; } @@ -442,7 +444,7 @@ bool ReferrerInfo::ShouldSetNullOriginHeader(net::HttpBaseChannel* aChannel, } if (policy == ReferrerPolicy::Same_origin) { - return ReferrerInfo::IsCrossOriginRequest(aChannel); + return isCrossOriginRequest; } return false; diff --git a/testing/web-platform/meta/fetch/origin/assorted.window.js.ini b/testing/web-platform/meta/fetch/origin/assorted.window.js.ini index 73d1573acce9..8f1e9ab8523d 100644 --- a/testing/web-platform/meta/fetch/origin/assorted.window.js.ini +++ b/testing/web-platform/meta/fetch/origin/assorted.window.js.ini @@ -4,7 +4,3 @@ [Origin header and POST navigation] expected: FAIL - - [Origin header and POST same-origin fetch cors mode with Referrer-Policy no-referrer] - expected: FAIL -