The Authorization header with a JSON Web Token (JWT) can be sent via
XMLHttpRequest without explicit authorization via Access-Control headers.
According to the spec, this must always explicitly be mentioned in ACAH
request headers and isn't allowed to be wildcarded. However, nobody
currently obeys this rule and many websites are misconfigured because
Chromium and Firefox always allowed it.
This patch adds the more stricter code but keeps it behind an #ifdef 0
to be released later on if and when there is enough consensus on the web
to obey this spec. This patch explicitly avoids the added complexity
Mozilla added to educate web devs since our role in that respect is not
significant. it's not preffed and it won't throw an explicit deprecation
warning.
See Mozilla bugs 1687364 and 1841019.
Vim control lines were re-introduced or not entirely cleaned up.
This nukes them again.
Removing from modules, netwerk, security, storage, testing, toolkit, and
a few scattered misc files. More to come.
This implements a plain interpretations of RFC 6797, which says to only consider
the first HSTS header.
This slightly conflicts with RFC 7230, which says that sending multiple headers
which can't be merged is illegal (except for a specific whitelist which HSTS isn't in),
so this situation should never occur in the first place (and would therefore not need
the explicit entry in RFC 6797).
It improves HSTS robustness dealing with non-compliant servers.
Resolves#2070
This rewrites the websocket channel network change detection function to not
skip part of its logic in a situation that has already been checked, preventing
a thread race. See analysis of the problem in the issue.
The root cause in this bug is that the connection info used by
'SpdyConnectTransaction' is the same instance as the connection info in
'nsHttpTransaction', so we should clone it and let 'SpdyConnectTransaction' use
the cloned one.
Since these are just interpreted comments, there's 0 impact on actual code.
This removes all lines that match /* vim: set(.*)tw=80: */ with S&R -- there are
a few others scattered around which will be removed manually in a second part.
