commit 8f7c431821126c0adfd36d8dbce1a38352688471
author sunil mayya <smayya@mozilla.com> Tue Feb 28 12:13:15 2023
committer moz-wptsync-bot <wptsync@mozilla.com> Wed Mar 01 08:37:51 2023
tree 559344cbd95d2403eb82e47f65c9d77d5ad8a412
parent f90ed0c4b4b3918f0e94b08342c558216955f17d

replace ReferrerInfo::IsCrossOriginRequest with nsScriptSecurityManager::CheckSameOriginURI for determining cross-origin redirects.

Since Bug 1802086, we strip authentication headers when redirected to a cross-origin page. However, the api   ReferrerInfo::IsCrossOriginRequest  used for determining whether a request is cross-origin cannot be used as it compares the triggering principal's uri with the redirected channel's uri. This comparison might sometimes yield to false positives.
For e.g consider the following scenario:
1. Load `https://example.org/` and send the following fetch request from browser console
```
fetch("https://test.com/some_location", {
  "headers": {
    "Authorization": "Token foo"
  }
});
```
2. Server responds with  a redirect to https://test.com/another_location

In the above scenario, the api ReferrerInfo::IsCrossOriginRequest  will yield the above request as cross origin since the triggering principal uri here is example.com. Hence, this will be treated as cross-origin redirect resulting in removal of auth headers.

Thus ReferrerInfo::IsCrossOriginRequest  has been replaced with nsScriptSecurityManager::CheckSameOriginURI  where we directly compare the origins for the two requests.

Differential Revision: https://phabricator.services.mozilla.com/D170868

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1817980
gecko-commit: daf70dc1a75ac02f50c49e960a2aad8eca8adace
gecko-reviewers: necko-reviewers, valentin