From 32498a069430ab02b56adfaeeef96623306589bc Mon Sep 17 00:00:00 2001 From: Boris Zbarsky Date: Tue, 1 Oct 2024 00:03:06 +0200 Subject: [PATCH] Bug 1493449 - Change the default credentials mode for module scripts from 'omit' to 'same-origin' Resolves #2642 --- dom/script/ScriptLoader.cpp | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp index 636816863d..d7553b024e 100644 --- a/dom/script/ScriptLoader.cpp +++ b/dom/script/ScriptLoader.cpp @@ -1307,9 +1307,8 @@ ScriptLoader::StartLoad(ScriptLoadRequest *aRequest, const nsAString &aType, // According to the spec, module scripts have different behaviour to classic // scripts and always use CORS. securityFlags = nsILoadInfo::SEC_REQUIRE_CORS_DATA_INHERITS; - if (aRequest->CORSMode() == CORS_NONE) { - securityFlags |= nsILoadInfo::SEC_COOKIES_OMIT; - } else if (aRequest->CORSMode() == CORS_ANONYMOUS) { + if (aRequest->CORSMode() == CORS_NONE || + aRequest->CORSMode() == CORS_ANONYMOUS) { securityFlags |= nsILoadInfo::SEC_COOKIES_SAME_ORIGIN; } else { MOZ_ASSERT(aRequest->CORSMode() == CORS_USE_CREDENTIALS);