Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: dce5d978c4f3d14be8bdddd6beb978f865554df7
https://github.com/WebKit/WebKit/commit/dce5d978c4f3d14be8bdddd6beb978f865554df7
Author: Jessica Lee <[email protected]>
Date: 2026-10-15 (Thu, 15 Oct 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/dynamic-imports-credentials-setTimeout.sub-expected.txt
M Source/WebCore/bindings/js/CachedScriptFetcher.cpp
M Source/WebCore/bindings/js/CachedScriptFetcher.h
M Source/WebCore/dom/ScriptElement.cpp
M Source/WebCore/dom/ScriptElementCachedScriptFetcher.cpp
M Source/WebCore/dom/ScriptElementCachedScriptFetcher.h
M Source/WebCore/html/parser/HTMLResourcePreloader.cpp
Log Message:
-----------
Dynamic import()'s should fetch with crossorigin=anonymous by default
https://bugs.webkit.org/show_bug.cgi?id=327580
rdar://183340529
Reviewed by Ryosuke Niwa.
Currently, import() from setTimeout(string) sends cookies on cross-origin
fetches
when crossorigin is unspecified. The fix makes every dynamic import() a CORS
request, even the ones that don't come from a <script> element. This change also
rebaselines dynamic-imports-credentials-setTimeout.sub.html results which have
an overall progression. Now, WebKit's behavior matches Chrome's but diverges
from
Firefox's for module script case.
No new tests needed.
*
LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/dynamic-imports-credentials-setTimeout.sub-expected.txt:
* Source/WebCore/bindings/js/CachedScriptFetcher.cpp:
(WebCore::CachedScriptFetcher::requestModuleResource const):
* Source/WebCore/bindings/js/CachedScriptFetcher.h:
* Source/WebCore/dom/ScriptElement.cpp:
(WebCore::ScriptElement::requestModuleScript):
* Source/WebCore/dom/ScriptElementCachedScriptFetcher.cpp:
(): Deleted.
* Source/WebCore/dom/ScriptElementCachedScriptFetcher.h:
* Source/WebCore/html/parser/HTMLResourcePreloader.cpp:
(WebCore::PreloadRequest::resourceRequest):
Canonical link: https://commits.webkit.org/323807@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
