react-native-windows 0.0.0-canary.95 → 0.0.0-canary.950

package/Shared/Networking/OriginPolicyHttpFilter.cpp

@@ -0,0 +1,798 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+// cspell:ignore Referer
+
+#include "OriginPolicyHttpFilter.h"
+
+// React Native Windows
+#include <CppRuntimeOptions.h>
+#include "WinRTTypes.h"
+
+// Boost Library
+#include <boost/algorithm/string.hpp>
+#include <boost/lexical_cast/try_lexical_convert.hpp>
+
+// Standard Library
+#include <queue>
+#include <regex>
+
+using std::set;
+using std::string;
+using std::wstring;
+
+using winrt::hresult_error;
+using winrt::hstring;
+using winrt::to_hstring;
+using winrt::Windows::Foundation::IInspectable;
+using winrt::Windows::Foundation::IPropertyValue;
+using winrt::Windows::Foundation::Uri;
+using winrt::Windows::Foundation::Collections::IMap;
+using winrt::Windows::Web::Http::HttpMethod;
+using winrt::Windows::Web::Http::HttpRequestMessage;
+using winrt::Windows::Web::Http::HttpResponseMessage;
+using winrt::Windows::Web::Http::Filters::IHttpBaseProtocolFilter;
+using winrt::Windows::Web::Http::Filters::IHttpFilter;
+using winrt::Windows::Web::Http::Headers::HttpMediaTypeHeaderValue;
+using winrt::Windows::Web::Http::Headers::HttpRequestHeaderCollection;
+
+namespace Microsoft::React::Networking {
+
+#pragma region OriginPolicyHttpFilter
+
+#pragma region CaseInsensitiveComparer
+
+bool OriginPolicyHttpFilter::CaseInsensitiveComparer::operator()(const wchar_t *a, const wchar_t *b) const {
+  return _wcsicmp(a, b) < 0;
+}
+
+bool OriginPolicyHttpFilter::CaseInsensitiveComparer::operator()(const wstring &a, const wstring &b) const {
+  return _wcsicmp(a.c_str(), b.c_str()) < 0;
+}
+
+#pragma endregion CaseInsensitiveComparer
+
+// https://fetch.spec.whatwg.org/#forbidden-method
+/*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
+    OriginPolicyHttpFilter::s_forbiddenMethods = {L"CONNECT", L"TRACE", L"TRACK"};
+
+/*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
+    OriginPolicyHttpFilter::s_simpleCorsMethods = {L"GET", L"HEAD", L"POST"};
+
+/*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
+    OriginPolicyHttpFilter::s_simpleCorsRequestHeaderNames = {
+        L"Accept",
+        L"Accept-Language",
+        L"Content-Language",
+        L"Content-Type",
+        L"DPR",
+        L"Downlink",
+        L"Save-Data",
+        L"Viewport-Width",
+        L"Width"};
+
+/*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
+    OriginPolicyHttpFilter::s_simpleCorsResponseHeaderNames =
+        {L"Cache-Control", L"Content-Language", L"Content-Type", L"Expires", L"Last-Modified", L"Pragma"};
+
+/*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
+    OriginPolicyHttpFilter::s_simpleCorsContentTypeValues = {
+        L"application/x-www-form-urlencoded",
+        L"multipart/form-data",
+        L"text/plain"};
+
+// https://fetch.spec.whatwg.org/#forbidden-header-name
+// Chromium still bans "User-Agent" due to https://crbug.com/571722
+/*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
+    OriginPolicyHttpFilter::s_corsForbiddenRequestHeaderNames = {
+        L"Accept-Charset",
+        L"Accept-Encoding",
+        L"Access-Control-Request-Headers",
+        L"Access-Control-Request-Method",
+        L"Connection",
+        L"Content-Length",
+        L"Cookie",
+        L"Cookie2",
+        L"Date",
+        L"DNT",
+        L"Expect",
+        L"Host",
+        L"Keep-Alive",
+        L"Origin",
+        L"Referer",
+        L"TE",
+        L"Trailer",
+        L"Transfer-Encoding",
+        L"Upgrade",
+        L"Via"};
+
+/*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
+    OriginPolicyHttpFilter::s_cookieSettingResponseHeaders = {
+        L"Set-Cookie",
+        L"Set-Cookie2", // Deprecated by the spec, but probably still used
+};
+
+/*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
+    OriginPolicyHttpFilter::s_corsForbiddenRequestHeaderNamePrefixes = {L"Proxy-", L"Sec-"};
+
+/*static*/ bool OriginPolicyHttpFilter::IsSameOrigin(Uri const &u1, Uri const &u2) noexcept {
+  return (u1 && u2) && u1.SchemeName() == u2.SchemeName() && u1.Host() == u2.Host() && u1.Port() == u2.Port();
+}
+
+/*static*/ bool OriginPolicyHttpFilter::IsSimpleCorsRequest(HttpRequestMessage const &request) noexcept {
+  // Ensure header is in Simple CORS allowlist
+  for (const auto &header : request.Headers()) {
+    if (s_simpleCorsRequestHeaderNames.find(header.Key().c_str()) == s_simpleCorsRequestHeaderNames.cend())
+      return false;
+
+    // Ensure Content-Type value is in Simple CORS allowlist, if present
+    if (boost::iequals(header.Key(), L"Content-Type")) {
+      if (s_simpleCorsContentTypeValues.find(header.Value().c_str()) != s_simpleCorsContentTypeValues.cend())
+        return false;
+    }
+  }
+
+  // WinRT separates request headers from request content headers
+  if (auto content = request.Content()) {
+    for (const auto &header : content.Headers()) {
+      // WinRT automatically appends non-allowlisted header Content-Length when Content-Type is set. Skip it.
+      if (s_simpleCorsRequestHeaderNames.find(header.Key().c_str()) == s_simpleCorsRequestHeaderNames.cend() &&
+          !boost::iequals(header.Key(), "Content-Length"))
+        return false;
+
+      // Ensure Content-Type value is in Simple CORS allowlist, if present
+      if (boost::iequals(header.Key(), L"Content-Type")) {
+        if (s_simpleCorsContentTypeValues.find(header.Value().c_str()) == s_simpleCorsContentTypeValues.cend())
+          return false;
+      }
+    }
+  }
+
+  // Ensure method is in Simple CORS allowlist
+  return s_simpleCorsMethods.find(request.Method().ToString().c_str()) != s_simpleCorsMethods.cend();
+}
+
+/*static*/ const hstring OriginPolicyHttpFilter::GetOrigin(Uri const &uri) noexcept {
+  auto const &scheme = uri.SchemeName();
+  auto port = uri.Port();
+
+  hstring result = scheme + L"://" + uri.Host();
+  if (!(port == 80 && scheme == L"http") && !(port == 443 && scheme == L"https")) {
+    result = result + L":" + to_hstring(port);
+  }
+
+  return result;
+}
+
+/*static*/ bool OriginPolicyHttpFilter::AreSafeRequestHeaders(
+    winrt::Windows::Web::Http::Headers::HttpRequestHeaderCollection const &headers) noexcept {
+  for (const auto &header : headers) {
+    if (s_corsForbiddenRequestHeaderNames.find(header.Key().c_str()) != s_corsForbiddenRequestHeaderNames.cend())
+      return false;
+
+    for (const auto &prefix : s_corsForbiddenRequestHeaderNamePrefixes) {
+      if (boost::istarts_with(header.Key(), prefix))
+        return false;
+    }
+  }
+
+  return true;
+}
+
+// See https://fetch.spec.whatwg.org/#cors-safelisted-request-header
+// "A CORS-safelisted header is a header whose name is either one of 'Accept', 'Accept-Language', and
+// 'Content-Language', or whose name is 'Content-Type' and value is one of 'application/x-www-form-urlencoded',
+// 'multipart/form-data', and 'text/plain'
+/*static*/ bool OriginPolicyHttpFilter::IsCorsSafelistedRequestHeader(
+    hstring const &name,
+    hstring const &value) noexcept {
+  // 1. If value's length is greater than 128, then return false.
+  if (value.size() > 128)
+    return false;
+
+  // 2. Byte-lowercase name and switch on the result:
+  static const wchar_t *const safeHeaderNames[] = {
+      // The following four headers are from the CORS spec
+      L"accept",
+      L"accept-language",
+      L"content-language",
+      L"content-type",
+
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Save-Data
+      L"save-data",
+
+      // https://w3c.github.io/device-memory/#sec-device-memory-client-hint-header
+      L"device-memory",
+      L"dpr",
+      L"width",
+      L"viewport-width",
+
+      // https://tools.ietf.org/html/draft-west-lang-client-hint
+      L"sec-ch-lang",
+
+      // https://tools.ietf.org/html/draft-west-ua-client-hints
+      L"sec-ch-ua",
+      L"sec-ch-ua-platform",
+      L"sec-ch-ua-arch",
+      L"sec-ch-ua-model",
+      L"sec-ch-ua-mobile",
+      L"sec-ch-ua-full-version",
+      L"sec-ch-ua-platform-version",
+  };
+
+  auto nameLower = boost::to_lower_copy(wstring{name.c_str()});
+  if (std::find(std::cbegin(safeHeaderNames), std::cend(safeHeaderNames), nameLower) == std::end(safeHeaderNames))
+    return false;
+
+  double doubleHolder;
+  if (nameLower == L"device-memory" || nameLower == L"dpr")
+    return boost::conversion::try_lexical_convert<double, wstring>(value.c_str(), doubleHolder);
+
+  int intHolder;
+  if (nameLower == L"width" || nameLower == L"viewport-width")
+    return boost::conversion::try_lexical_convert<int, wstring>(value.c_str(), intHolder);
+
+  auto valueLower = boost::to_lower_copy(wstring{value.c_str()});
+  if (nameLower == L"save-data")
+    return valueLower == L"on";
+
+  if (nameLower == L"accept")
+    return !std::any_of(valueLower.cbegin(), valueLower.cend(), IsCorsUnsafeRequestHeaderByte);
+
+  if (nameLower == L"accept-language" || nameLower == L"content-language") {
+    return std::all_of(valueLower.cbegin(), valueLower.cend(), [](wchar_t c) noexcept {
+      return (0x30 <= c && c <= 0x39) || // 0-9
+          (0x41 <= c && c <= 0x5A) || // A-Z
+          (0x61 <= c && c <= 0x7A) || // a-z
+          c == 0x20 || c == 0x2A || c == 0x2C || c == 0x2D || c == 0x2E || c == 0x3B || c == 0x3D; // *,-.;=
+    });
+  }
+
+  if (nameLower == L"content-type") {
+    if (std::any_of(valueLower.cbegin(), valueLower.cend(), IsCorsUnsafeRequestHeaderByte))
+      return false;
+
+    // https://mimesniff.spec.whatwg.org/#parse-a-mime-type
+    HttpMediaTypeHeaderValue mediaType{nullptr};
+    if (HttpMediaTypeHeaderValue::TryParse(valueLower, mediaType))
+      return mediaType.ToString() == L"application/x-www-form-urlencoded" ||
+          mediaType.ToString() == L"multipart/form-data" || mediaType.ToString() == L"text/plain";
+
+    return false;
+  }
+
+  return true;
+}
+
+// https://fetch.spec.whatwg.org/#cors-unsafe-request-header-byte
+/*static*/ bool OriginPolicyHttpFilter::IsCorsUnsafeRequestHeaderByte(wchar_t c) noexcept {
+  return (c < 0x20 && c != 0x09) || c == 0x22 || c == 0x28 || c == 0x29 || c == 0x3a || c == 0x3c || c == 0x3e ||
+      c == 0x3f || c == 0x40 || c == 0x5b || c == 0x5c || c == 0x5d || c == 0x7b || c == 0x7d || c == 0x7f;
+}
+
+/*static*/ set<const wchar_t *> OriginPolicyHttpFilter::CorsUnsafeNotForbiddenRequestHeaderNames(
+    HttpRequestHeaderCollection const &headers) noexcept {
+  constexpr size_t maxSafelistValueSize = 1024;
+  size_t safelistValueSize = 0;
+  std::vector<const wchar_t *> potentiallyUnsafeNames;
+  set<const wchar_t *> result;
+  for (const auto &header : headers) {
+    const auto headerName = header.Key().c_str();
+
+    // If header is not safe
+    if (boost::istarts_with(headerName, L"Proxy-") || boost::istarts_with(headerName, L"Sec-") ||
+        s_corsForbiddenRequestHeaderNames.find(headerName) != s_corsForbiddenRequestHeaderNames.cend())
+      continue;
+
+    if (!IsCorsSafelistedRequestHeader(header.Key(), header.Value())) {
+      result.emplace(header.Key().c_str());
+    } else {
+      potentiallyUnsafeNames.emplace_back(std::wstring_view{header.Key()}.data());
+      safelistValueSize += header.Value().size();
+    }
+  }
+
+  if (safelistValueSize > maxSafelistValueSize)
+    result.insert(potentiallyUnsafeNames.begin(), potentiallyUnsafeNames.end());
+
+  return result;
+}
+
+/*static*/ OriginPolicyHttpFilter::AccessControlValues OriginPolicyHttpFilter::ExtractAccessControlValues(
+    IMap<hstring, hstring> const &headers) {
+  using std::wregex;
+  using std::wsregex_token_iterator;
+
+  // https://tools.ietf.org/html/rfc2616#section-4.2
+  wregex rgx{L"\\s*,\\s*"};
+  AccessControlValues result;
+
+  auto ciStrCmp = [](const wstring &a, const wstring &b) { return _wcsicmp(a.c_str(), b.c_str()) < 0; };
+  set<wstring, decltype(ciStrCmp)> allowedHeaders{ciStrCmp};
+  set<wstring, decltype(ciStrCmp)> allowedMethods{ciStrCmp};
+  set<wstring, decltype(ciStrCmp)> exposedHeaders{ciStrCmp};
+
+  for (const auto &header : headers) {
+    if (boost::iequals(header.Key(), L"Access-Control-Allow-Headers")) {
+      auto value = wstring{header.Value().c_str()};
+
+      // TODO: Avoid redundant comparison.
+      auto parsed = set<wstring, decltype(ciStrCmp)>{
+          wsregex_token_iterator{value.cbegin(), value.cend(), rgx, -1}, wsregex_token_iterator{}, ciStrCmp};
+      allowedHeaders.insert(parsed.cbegin(), parsed.cend());
+      result.AllowedHeaders.insert(allowedHeaders.cbegin(), allowedHeaders.cend());
+    } else if (boost::iequals(header.Key(), L"Access-Control-Allow-Methods")) {
+      auto value = wstring{header.Value().c_str()};
+
+      // TODO: Avoid redundant comparison.
+      auto parsed = set<wstring, decltype(ciStrCmp)>{
+          wsregex_token_iterator{value.cbegin(), value.cend(), rgx, -1}, wsregex_token_iterator{}, ciStrCmp};
+      allowedMethods.insert(parsed.cbegin(), parsed.cend());
+      result.AllowedMethods.insert(allowedMethods.cbegin(), allowedMethods.cend());
+    } else if (boost::iequals(header.Key(), L"Access-Control-Allow-Origin")) {
+      result.AllowedOrigin = header.Value();
+    } else if (boost::iequals(header.Key(), L"Access-Control-Expose-Headers")) {
+      auto value = wstring{header.Value().c_str()};
+
+      // TODO: Avoid redundant comparison.
+      auto parsed = set<wstring, decltype(ciStrCmp)>{
+          wsregex_token_iterator{value.cbegin(), value.cend(), rgx, -1}, wsregex_token_iterator{}, ciStrCmp};
+      exposedHeaders.insert(parsed.cbegin(), parsed.cend());
+      result.ExposedHeaders.insert(exposedHeaders.cbegin(), exposedHeaders.cend());
+    } else if (boost::iequals(header.Key(), L"Access-Control-Allow-Credentials")) {
+      result.AllowedCredentials = header.Value();
+    } else if (boost::iequals(header.Key(), L"Access-Control-Max-Age")) {
+      result.MaxAge = _wtoi(header.Value().c_str());
+    }
+  }
+
+  return result;
+} // ExtractAccessControlValues
+
+/*static*/ void OriginPolicyHttpFilter::RemoveHttpOnlyCookiesFromResponseHeaders(
+    HttpResponseMessage const &response,
+    bool removeAll) {
+  // Example: "Set-Cookie", L"id=a3fWa; Expires=Wed, 21 Oct 2020 07:28:00 GMT;  HttpOnly"
+  std::queue<hstring> httpOnlyCookies;
+  for (const auto &header : response.Headers()) {
+    if (s_cookieSettingResponseHeaders.find(header.Key().c_str()) == s_cookieSettingResponseHeaders.cend())
+      continue;
+
+    if (removeAll) {
+      httpOnlyCookies.push(header.Key());
+      continue;
+    }
+
+    // Anchors (^$) can't be part of bracket expressions ([]).
+    // Create 3 matching groups: 1. Beginning of string 2. Between delimiters 3. End of string
+    const std::wregex re(L"(^HttpOnly\\s*;)|(;\\s*HttpOnly\\s*;)|(;\\s*HttpOnly$)", std::regex_constants::icase);
+    if (!std::regex_search(header.Value().c_str(), re))
+      continue;
+
+    // HttpOnly cookie detected. Removing.
+    httpOnlyCookies.push(header.Key());
+  } // const auto &header : response.Headers()
+
+  while (!httpOnlyCookies.empty()) {
+    response.Headers().Remove(httpOnlyCookies.front());
+    httpOnlyCookies.pop();
+  }
+}
+
+OriginPolicyHttpFilter::OriginPolicyHttpFilter(string &&origin, IHttpFilter const &innerFilter)
+    : m_origin{nullptr}, m_innerFilter{innerFilter} {
+  if (!origin.empty())
+    m_origin = Uri{to_hstring(origin)};
+}
+
+OriginPolicyHttpFilter::OriginPolicyHttpFilter(string &&origin)
+    : OriginPolicyHttpFilter(std::move(origin), winrt::Windows::Web::Http::Filters::HttpBaseProtocolFilter{}) {}
+
+OriginPolicy OriginPolicyHttpFilter::ValidateRequest(HttpRequestMessage const &request) {
+  auto effectiveOriginPolicy =
+      static_cast<OriginPolicy>(request.Properties().Lookup(L"OriginPolicy").as<IPropertyValue>().GetUInt64());
+  switch (effectiveOriginPolicy) {
+    case OriginPolicy::None:
+      return effectiveOriginPolicy;
+
+    case OriginPolicy::SameOrigin:
+      if (!IsSameOrigin(m_origin, request.RequestUri()))
+        throw hresult_error{E_INVALIDARG, L"SOP (same-origin policy) is enforced"};
+      break;
+
+    case OriginPolicy::SimpleCrossOriginResourceSharing:
+      // Check for disallowed mixed content
+      if (GetRuntimeOptionBool("Http.BlockMixedContentSimpleCors") &&
+          m_origin.SchemeName() != request.RequestUri().SchemeName())
+        throw hresult_error{E_INVALIDARG, L"The origin and request URLs must have the same scheme"};
+
+      if (IsSameOrigin(m_origin, request.RequestUri()))
+        // Same origin. Therefore, skip Cross-Origin handling.
+        effectiveOriginPolicy = OriginPolicy::SameOrigin;
+      else if (!IsSimpleCorsRequest(request))
+        throw hresult_error{
+            E_INVALIDARG,
+            L"The request does not meet the requirements for Same-Origin policy or Simple Cross-Origin resource sharing"};
+      break;
+
+    case OriginPolicy::CrossOriginResourceSharing:
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests
+      // Refer to CorsURLLoaderFactory::IsValidRequest in chrome\src\services\network\cors\cors_url_loader_factory.cc.
+      // Forbidden headers should be blocked regardless of origins.
+      // Example: On the Edge browser, an XHR request with the "Host" header set gets rejected as unsafe.
+      // https://fetch.spec.whatwg.org/#forbidden-header-name
+
+      if (m_origin.SchemeName() != request.RequestUri().SchemeName())
+        throw hresult_error{E_INVALIDARG, L"The origin and request URLs must have the same scheme"};
+
+      if (!AreSafeRequestHeaders(request.Headers()))
+        throw hresult_error{E_INVALIDARG, L"Request header not allowed in cross-origin resource sharing"};
+
+      if (s_forbiddenMethods.find(request.Method().ToString().c_str()) != s_forbiddenMethods.cend())
+        throw hresult_error{E_INVALIDARG, L"Request method not allowed in cross-origin resource sharing"};
+
+      if (IsSameOrigin(m_origin, request.RequestUri()))
+        effectiveOriginPolicy = OriginPolicy::SameOrigin;
+      else if (IsSimpleCorsRequest(request))
+        effectiveOriginPolicy = OriginPolicy::SimpleCrossOriginResourceSharing;
+      else
+        effectiveOriginPolicy = OriginPolicy::CrossOriginResourceSharing;
+
+      break;
+
+    default:
+      throw hresult_error{
+          E_INVALIDARG, L"Invalid OriginPolicy type: " + to_hstring(static_cast<size_t>(effectiveOriginPolicy))};
+  }
+
+  return effectiveOriginPolicy;
+}
+
+// See https://fetch.spec.whatwg.org/#cors-check
+void OriginPolicyHttpFilter::ValidateAllowOrigin(
+    hstring const &allowedOrigin,
+    hstring const &allowCredentials,
+    IMap<hstring, IInspectable> props) const {
+  // 4.10.1-2 - null allow origin
+  if (L"null" == allowedOrigin)
+    throw hresult_error{
+        E_INVALIDARG,
+        L"Response header Access-Control-Allow-Origin has a value of [null] which differs from the supplied origin"};
+
+  bool withCredentials = props.Lookup(L"RequestArgs").as<RequestArgs>()->WithCredentials;
+  // 4.10.3 - valid wild card allow origin
+  if (!withCredentials && L"*" == allowedOrigin)
+    return;
+
+  // We assume the source (request) origin is not "*", "null", or empty string. Valid URI is expected
+  // 4.10.4 - Mismatched allow origin
+  auto taintedOriginProp = props.TryLookup(L"TaintedOrigin");
+  auto taintedOrigin = taintedOriginProp && winrt::unbox_value<bool>(taintedOriginProp);
+  auto origin = taintedOrigin ? nullptr : m_origin;
+  if (allowedOrigin.empty() || !IsSameOrigin(origin, Uri{allowedOrigin})) {
+    hstring errorMessage;
+    if (allowedOrigin.empty())
+      errorMessage = L"No valid origin in response";
+
+    // See https://fetch.spec.whatwg.org/#http-access-control-allow-origin.
+    else if (boost::contains(allowedOrigin, L" ,"))
+      errorMessage = L"Response header Access-Control-Allow-Origin can not have multiple values";
+
+    // A wildcard Access-Control-Allow-Origin can not be used if credentials are to be sent,
+    // even with Access-Control-Allow-Credentials set to true
+    // See https://fetch.spec.whatwg.org/#cors-protocol-and-credentials
+    else if (L"*" == allowedOrigin)
+      errorMessage =
+          L"Response header Access-Control-Allow-Origin can not have a wildcard value when the request includes credentials";
+
+    else
+      errorMessage = L"The Access-Control-Allow-Origin header has a value of [" + allowedOrigin +
+          L"] which differs from the supplied origin";
+
+    throw hresult_error{E_INVALIDARG, errorMessage};
+  }
+
+  // 4.10.5
+  if (!withCredentials)
+    return;
+
+  // 4.10.6-8
+  // https://fetch.spec.whatwg.org/#http-access-control-allow-credentials
+  // This check should be case sensitive.
+  // See also https://fetch.spec.whatwg.org/#http-new-header-syntax
+  if (L"true" != allowCredentials)
+    throw hresult_error{
+        E_INVALIDARG,
+        L"Access-Control-Allow-Credentials value must be \"true\" when the response includes credentials"};
+};
+
+void OriginPolicyHttpFilter::ValidatePreflightResponse(
+    HttpRequestMessage const &request,
+    HttpResponseMessage const &response) const {
+  // https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSExternalRedirectNotAllowed
+  using winrt::Windows::Web::Http::HttpStatusCode;
+  switch (response.StatusCode()) {
+    case HttpStatusCode::MovedPermanently:
+    case HttpStatusCode::TemporaryRedirect:
+    case HttpStatusCode::PermanentRedirect:
+      throw hresult_error{INET_E_REDIRECTING, L"Redirect is not allowed in a preflight request"};
+
+    default:
+      break;
+  }
+
+  auto controlValues = ExtractAccessControlValues(response.Headers());
+
+  auto props = request.Properties();
+  // Check if the origin is allowed in conjuction with the withCredentials flag
+  // CORS preflight should always exclude credentials although the subsequent CORS request may include credentials.
+  ValidateAllowOrigin(controlValues.AllowedOrigin, controlValues.AllowedCredentials, props);
+
+  // See https://fetch.spec.whatwg.org/#cors-preflight-fetch, section 4.8.7.5
+  // Check if the request method is allowed
+  bool withCredentials = props.Lookup(L"RequestArgs").as<RequestArgs>()->WithCredentials;
+  bool requestMethodAllowed = false;
+  for (const auto &method : controlValues.AllowedMethods) {
+    if (L"*" == method) {
+      if (!withCredentials) {
+        requestMethodAllowed = true;
+        break;
+      }
+    } else if (boost::iequals(method, request.Method().ToString())) {
+      requestMethodAllowed = true;
+      break;
+    }
+  }
+
+  // Preflight should always allow simple CORS methods
+  requestMethodAllowed |= s_simpleCorsMethods.find(request.Method().ToString().c_str()) != s_simpleCorsMethods.cend();
+
+  if (!requestMethodAllowed)
+    throw hresult_error{
+        E_INVALIDARG,
+        L"Method [" + request.Method().ToString() +
+            L"] is not allowed by Access-Control-Allow-Methods in preflight response"};
+
+  // Check if request headers are allowed
+  // See https://fetch.spec.whatwg.org/#cors-preflight-fetch, section 4.8.7.6-7
+  // Check if the header should be allowed through wildcard, if the request does not have credentials.
+  bool requestHeadersAllowed = false;
+  if (!withCredentials && controlValues.AllowedHeaders.find(L"*") != controlValues.AllowedHeaders.cend()) {
+    // "Authorization" header cannot be allowed through wildcard alone.
+    // "Authorization" is the only member of https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name.
+    if (request.Headers().HasKey(L"Authorization") &&
+        controlValues.AllowedHeaders.find(L"Authorization") == controlValues.AllowedHeaders.cend())
+      throw hresult_error{
+          E_INVALIDARG,
+          L"Request header field [Authorization] is not allowed by Access-Control-Allow-Headers in preflight response"};
+
+    requestHeadersAllowed = true;
+  }
+  if (!requestHeadersAllowed) {
+    // Forbidden headers are excluded from the JavaScript layer.
+    // User agents may use these headers internally.
+    const set unsafeNotForbiddenHeaderNames = CorsUnsafeNotForbiddenRequestHeaderNames(request.Headers());
+    for (const auto name : unsafeNotForbiddenHeaderNames) {
+      if (controlValues.AllowedHeaders.find(name) == controlValues.AllowedHeaders.cend())
+        throw hresult_error{
+            E_INVALIDARG,
+            L"Request header field [" + to_hstring(name) +
+                L"] is not allowed by Access-Control-Allow-Headers in preflight response"};
+    }
+  }
+
+  // #9770 - insert into preflight cache
+}
+
+// See 10.7.4 of https://fetch.spec.whatwg.org/#http-network-or-cache-fetch
+void OriginPolicyHttpFilter::ValidateResponse(HttpResponseMessage const &response, const OriginPolicy originPolicy)
+    const {
+  bool removeAllCookies = false;
+  if (originPolicy == OriginPolicy::SimpleCrossOriginResourceSharing ||
+      originPolicy == OriginPolicy::CrossOriginResourceSharing) {
+    auto controlValues = ExtractAccessControlValues(response.Headers());
+    auto props = response.RequestMessage().Properties();
+    auto withCredentials = props.Lookup(L"RequestArgs").try_as<RequestArgs>()->WithCredentials;
+
+    if (GetRuntimeOptionBool("Http.StrictOriginCheckSimpleCors") &&
+        originPolicy == OriginPolicy::SimpleCrossOriginResourceSharing) {
+      bool originAllowed = false;
+      for (const auto &header : response.Headers()) {
+        if (boost::iequals(header.Key(), L"Access-Control-Allow-Origin")) {
+          originAllowed |= L"*" == header.Value() || m_origin == Uri{header.Value()};
+        }
+      }
+
+      if (!originAllowed) {
+        throw hresult_error{E_INVALIDARG, L"The server does not support CORS or the origin is not allowed"};
+      }
+    } else {
+      ValidateAllowOrigin(controlValues.AllowedOrigin, controlValues.AllowedCredentials, props);
+    }
+
+    if (originPolicy == OriginPolicy::SimpleCrossOriginResourceSharing) {
+      // Filter out response headers that are not in the Simple CORS allowlist
+      std::queue<hstring> nonSimpleNames;
+      for (const auto &header : response.Headers().GetView()) {
+        if (s_simpleCorsResponseHeaderNames.find(header.Key().c_str()) == s_simpleCorsResponseHeaderNames.cend())
+          nonSimpleNames.push(header.Key());
+      }
+
+      while (!nonSimpleNames.empty()) {
+        response.Headers().Remove(nonSimpleNames.front());
+        nonSimpleNames.pop();
+      }
+    } else {
+      // Filter out response headers that are not simple headers and not in expose list
+
+      // Keep simple headers and those found in the expose header list.
+      if (withCredentials || controlValues.ExposedHeaders.find(L"*") == controlValues.ExposedHeaders.cend()) {
+        std::queue<hstring> nonSimpleNonExposedHeaders;
+
+        for (const auto &header : response.Headers().GetView()) {
+          if (s_simpleCorsResponseHeaderNames.find(header.Key().c_str()) == s_simpleCorsResponseHeaderNames.cend() &&
+              controlValues.ExposedHeaders.find(header.Key().c_str()) == controlValues.ExposedHeaders.cend()) {
+            nonSimpleNonExposedHeaders.push(header.Key());
+          }
+        }
+
+        while (!nonSimpleNonExposedHeaders.empty()) {
+          response.Headers().Remove(nonSimpleNonExposedHeaders.front());
+          nonSimpleNonExposedHeaders.pop();
+        }
+      }
+    }
+
+    // When withCredentials is false, request cannot include cookies. Also, cookies will be ignored in responses.
+    removeAllCookies = !withCredentials && GetRuntimeOptionBool("Http.RemoveCookiesFromResponse");
+  } // originPolicy == SimpleCrossOriginResourceSharing || CrossOriginResourceSharing
+
+  // Don't expose HttpOnly cookies to JavaScript
+  RemoveHttpOnlyCookiesFromResponseHeaders(response, removeAllCookies);
+}
+
+ResponseOperation OriginPolicyHttpFilter::SendPreflightAsync(HttpRequestMessage const &request) const {
+  auto coRequest = request;
+
+  HttpRequestMessage preflightRequest;
+
+  // Section 4.8.2 https://fetch.spec.whatwg.org/#cors-preflight-fetch
+  preflightRequest.Method(HttpMethod::Options());
+  preflightRequest.RequestUri(coRequest.RequestUri());
+  preflightRequest.Headers().Insert(L"Accept", L"*/*");
+  preflightRequest.Headers().Insert(L"Access-Control-Request-Method", coRequest.Method().ToString());
+
+  auto headerNames = wstring{};
+  auto writeSeparator = false;
+  for (const auto &header : coRequest.Headers()) {
+    if (writeSeparator) {
+      headerNames += L", ";
+    } else {
+      writeSeparator = true;
+    }
+
+    headerNames += header.Key();
+  }
+
+  if (coRequest.Content()) {
+    for (const auto &header : coRequest.Content().Headers()) {
+      if (writeSeparator) {
+        headerNames += L", ";
+      } else {
+        writeSeparator = true;
+      }
+
+      headerNames += header.Key();
+    }
+  }
+
+  preflightRequest.Headers().Insert(L"Access-Control-Request-Headers", headerNames);
+  preflightRequest.Headers().Insert(L"Origin", GetOrigin(m_origin));
+  preflightRequest.Headers().Insert(L"Sec-Fetch-Mode", L"CORS");
+
+  co_return {co_await m_innerFilter.SendRequestAsync(preflightRequest)};
+}
+
+#pragma region IRedirectEventSource
+
+bool OriginPolicyHttpFilter::OnRedirecting(
+    HttpRequestMessage const &request,
+    HttpResponseMessage const &response) noexcept {
+  // Consider the following scenario.
+  // User signs in to http://a.com and visits a page that makes CORS request to http://b.com with origin=http://a.com.
+  // Http://b.com responds with a redirect to http://a.com. The browser follows the redirect to http://a.com with
+  // origin=http://a.com. Since the origin matches the URL, the request is authorized at http://a.com, but it actually
+  // allows http://b.com to bypass the CORS check at http://a.com since the redirected URL is from http://b.com.
+  if (!IsSameOrigin(response.Headers().Location(), request.RequestUri()) &&
+      !IsSameOrigin(m_origin, request.RequestUri())) {
+    // By masking the origin field in the request header, we make it impossible for the server to set a single value for
+    // the access-control-allow-origin header. It means, the only way to support redirect is that server allows access
+    // from all sites through wildcard.
+    request.Headers().Insert(L"Origin", L"null");
+
+    auto props = request.Properties();
+    // Look for 'RequestArgs' key to ensure we are redirecting the main request.
+    if (auto iReqArgs = props.TryLookup(L"RequestArgs")) {
+      props.Insert(L"TaintedOrigin", winrt::box_value(true));
+    } else {
+      // Abort redirection if the request is either preflight or extraneous.
+      return false;
+    }
+  }
+
+  return true;
+}
+
+#pragma endregion IRedirectEventSource
+
+#pragma region IHttpFilter
+
+ResponseOperation OriginPolicyHttpFilter::SendRequestAsync(HttpRequestMessage const &request) {
+  auto coRequest = request;
+
+  // Set initial origin policy to global runtime option.
+  request.Properties().Insert(L"OriginPolicy", winrt::box_value(GetRuntimeOptionInt("Http.OriginPolicy")));
+
+  // Allow only HTTP or HTTPS schemes
+  if (GetRuntimeOptionBool("Http.StrictScheme") && coRequest.RequestUri().SchemeName() != L"https" &&
+      coRequest.RequestUri().SchemeName() != L"http")
+    throw hresult_error{E_INVALIDARG, L"Invalid URL scheme: [" + m_origin.SchemeName() + L"]"};
+
+  if (!GetRuntimeOptionBool("Http.OmitCredentials")) {
+    coRequest.Properties().Lookup(L"RequestArgs").as<RequestArgs>()->WithCredentials = false;
+  }
+
+  // Ensure absolute URL
+  coRequest.RequestUri(Uri{coRequest.RequestUri().AbsoluteCanonicalUri()});
+
+  auto originPolicy = ValidateRequest(coRequest);
+  if (originPolicy == OriginPolicy::SimpleCrossOriginResourceSharing ||
+      originPolicy == OriginPolicy::CrossOriginResourceSharing) {
+    if (coRequest.RequestUri().UserName().size() > 0 || coRequest.RequestUri().Password().size() > 0) {
+      coRequest.RequestUri(Uri{coRequest.RequestUri().DisplayUri()});
+    }
+  }
+
+  try {
+    // #9770 - Validate preflight cache
+    if (originPolicy == OriginPolicy::CrossOriginResourceSharing) {
+      // If inner filter can AllowRedirect, disable for preflight.
+      winrt::impl::com_ref<IHttpBaseProtocolFilter> baseFilter;
+      if (baseFilter = m_innerFilter.try_as<IHttpBaseProtocolFilter>()) {
+        baseFilter.AllowAutoRedirect(false);
+      }
+
+      auto preflightResponse = co_await SendPreflightAsync(coRequest);
+
+      if (baseFilter) {
+        baseFilter.AllowAutoRedirect(true);
+      }
+
+      ValidatePreflightResponse(coRequest, preflightResponse);
+    }
+
+    if (originPolicy == OriginPolicy::SimpleCrossOriginResourceSharing ||
+        originPolicy == OriginPolicy::CrossOriginResourceSharing) {
+      coRequest.Headers().Insert(L"Origin", GetOrigin(m_origin));
+    }
+
+    auto response = co_await m_innerFilter.SendRequestAsync(coRequest);
+
+    ValidateResponse(response, originPolicy);
+
+    co_return response;
+
+  } catch (hresult_error const &e) {
+    throw e;
+  } catch (const std::exception &e) {
+    throw hresult_error{E_FAIL, to_hstring(e.what())};
+  } catch (...) {
+    throw hresult_error{E_FAIL, L"Unspecified error processing Origin Policy request"};
+  }
+}
+
+#pragma endregion IHttpFilter
+
+#pragma endregion OriginPolicyHttpFilter
+
+} // namespace Microsoft::React::Networking