Handle private network preflight call (#354)

Chrome has a preflight check for local network requests that requires
our loopback listener to respond in a specific way in order to receive
the proper GET request.

Chrome document: https://developer.chrome.com/blog/private-network-access-preflight/

This document also says we need to include the
`Access-Control-Allow-Origin` header as well in order to succeed, but in
my (admittedly limited) tests that wasn't necessary. If it's deemed
prudent, I can add that to this PR as well.

Sources/AppAuth/macOS/OKTRedirectHTTPHandler.m

@@ -128,6 +128,30 @@ - (void)stopHTTPListener {
 }
 
 - (void)HTTPConnection:(HTTPConnection *)conn didReceiveRequest:(HTTPServerRequest *)mess {
+ // Handle private network preflight
+ // https://developer.chrome.com/blog/private-network-access-preflight/
+ CFStringRef method = CFHTTPMessageCopyRequestMethod(mess.request);
+ BOOL isOptionsRequest = CFStringCompare(method, (__bridge CFStringRef)@"OPTIONS", 0) == kCFCompareEqualTo;
+
+ CFStringRef requestPrivateNetwork = isOptionsRequest ? CFHTTPMessageCopyHeaderFieldValue(mess.request, (__bridge CFStringRef)@"Access-Control-Request-Private-Network") : nil;
+ BOOL doesRequestPrivateNetwork = requestPrivateNetwork != nil && CFStringCompare(requestPrivateNetwork, (__bridge CFStringRef)@"true", 0) == kCFCompareEqualTo;
+ if (isOptionsRequest && doesRequestPrivateNetwork) {
+ CFHTTPMessageRef response = CFHTTPMessageCreateResponse(
+ kCFAllocatorDefault,
+ 200,
+ NULL,
+ kCFHTTPVersion1_1);
+ CFHTTPMessageSetHeaderFieldValue(response,
+ (__bridge CFStringRef)@"Access-Control-Allow-Private-Network",
+ (__bridge CFStringRef)@"true");
+ CFHTTPMessageSetHeaderFieldValue(response,
+ (__bridge CFStringRef)@"Content-Length",
+ (__bridge CFStringRef)@"0");
+ [mess setResponse:response];
+ CFRelease(response);
+ return;
+ }
+
  // Sends URL to AppAuth.
  CFURLRef url = CFHTTPMessageCopyRequestURL(mess.request);
  BOOL handled = [_currentAuthorizationFlow resumeExternalUserAgentFlowWithURL:(__bridge NSURL *)url];