Repository: LadybirdBrowser/ladybird
File: Libraries/LibWeb/Loader/ResourceLoader.cpp (C++)

Code before:
    }

    auto protocol_request = m_request_client->start_request(request.method(), request.url().value(), headers, request.body(), proxy);
    if (!protocol_request) {
        log_failure(request, "Failed to initiate load"sv);
        return nullptr;
    }

    protocol_request->on_certificate_requested = []() -> Requests::Request::CertificateAndKey {
        return {};
    };

    ++m_pending_loads;
    if (on_load_counter_change)
        on_load_counter_change();

    m_active_requests.set(*protocol_request);
    return protocol_request;
}

void ResourceLoader::handle_network_response_headers(LoadRequest const& request, HTTP::HeaderMap const& response_headers)
{
    if (!request.page())
        return;

    if (request.respects_set_cookie()) {
        // From https://fetch.spec.whatwg.org/#http-network-fetch:
        // 15. If includeCredentials is true, then the user agent should parse and store response
        //     `Set-Cookie` headers given request and response.
        for (auto const& [header, value] : response_headers.headers()) {
            if (header.equals_ignoring_ascii_case("Set-Cookie"sv)) {
                store_response_cookies(*request.page(), request.url().value(), value);
            }
        }
    }

    if (auto cache_control = response_headers.get("Cache-Control"); cache_control.has_value()) {
        if (cache_control.value().contains("no-store"sv))
            s_resource_cache.remove(request);
    }
}

void ResourceLoader::finish_network_request(NonnullRefPtr<Requests::Request> protocol_request)
{
    --m_pending_loads;
    if (on_load_counter_change)
        on_load_counter_change();

    deferred_invoke([this, protocol_request = move(protocol_request)] {
        auto did_remove = m_active_requests.remove(protocol_request);
        VERIFY(did_remove);

Review comment (security):
just wondering: why not to pass `include_credentials` enumeration down here, if the spec you cite explicitly mentions it?

Code after:
    }

    auto protocol_request = m_request_client->start_request(request.method(), request.url().value(), headers, request.body(), proxy);
    if (!protocol_request) {
        log_failure(request, "Failed to initiate load"sv);
        return nullptr;
    }

    protocol_request->on_certificate_requested = []() -> Requests::Request::CertificateAndKey {
        return {};
    };

    ++m_pending_loads;
    if (on_load_counter_change)
        on_load_counter_change();

    m_active_requests.set(*protocol_request);
    return protocol_request;
}

void ResourceLoader::handle_network_response_headers(LoadRequest const& request, HTTP::HeaderMap const& response_headers)
{
    if (!request.page())
        return;

    if (request.store_set_cookie_headers()) {
        // From https://fetch.spec.whatwg.org/#concept-http-network-fetch:
        // 15. If includeCredentials is true, then the user agent should parse and store response
        //     `Set-Cookie` headers given request and response.
        for (auto const& [header, value] : response_headers.headers()) {
            if (header.equals_ignoring_ascii_case("Set-Cookie"sv)) {
                store_response_cookies(*request.page(), request.url().value(), value);
            }
        }
    }

    if (auto cache_control = response_headers.get("Cache-Control"); cache_control.has_value()) {
        if (cache_control.value().contains("no-store"sv))
            s_resource_cache.remove(request);
    }
}

void ResourceLoader::finish_network_request(NonnullRefPtr<Requests::Request> protocol_request)
{
    --m_pending_loads;
    if (on_load_counter_change)
        on_load_counter_change();

    deferred_invoke([this, protocol_request = move(protocol_request)] {
        auto did_remove = m_active_requests.remove(protocol_request);
        VERIFY(did_remove);