New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 617902 link

Starred by 3 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

XHR with cross-origin redirect scrubs bad content-types instead of redirecting

Reported by manishsm...@gmail.com, Jun 7 2016

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0

Example URL:

Steps to reproduce the problem:

 - Run `nc -l 9001` locally to capture the redirect
 - Open http://manishearth.anapnea.net/tmp/test-redirect.html
 - Note that a preflight doesn't happen, but the nonstandard x-pony content-type is scrubbed

What is the expected behavior?
A preflight fetch should occur on localhost:9001, to check if the content-type header is an allowed one

See https://fetch.spec.whatwg.org/#cors-safelisted-request-header and https://fetch.spec.whatwg.org/#concept-http-fetch step 4

What went wrong?
Instead of a preflight fetch, it did a direct GET request with the content-type header scrubbed.

Did this work before? N/A 

Chrome version:   Channel: n/a
OS Version: 
Flash Version: Shockwave Flash 11.2 r202

Firefox does this wrong too (differently), corresponding bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1278493
 
Cc: mkwst@chromium.org
Components: -Internals>Network Blink>SecurityFeature
Mike: As Blink/CORS expert, wdyt?

Comment 2 by mkwst@chromium.org, Feb 14 2017

Owner: tyoshino@chromium.org
Status: Assigned (was: Unconfirmed)
It does look like we should be setting the content type and triggering a preflight. WDYT, tyoshino@? I know you've done work here in the last ~year (sorry for the delay!). Is this already fixed?

Comment 3 by est...@chromium.org, Nov 10 2017

Labels: Hotlist-EnamelAndFriendsFixIt

Comment 4 by est...@chromium.org, Feb 18 2018

Labels: -Hotlist-EnamelAndFriendsFixIt

Comment 5 by ricea@chromium.org, May 7 2018

Components: -Blink>SecurityFeature Blink>SecurityFeature>CORS Blink>Network>XHR
Owner: ----
Status: Available (was: Assigned)
tyoshino is gone and so is the original repro. Does anyone want to pick this up?
Labels: OOR-CORS
Owner: toyoshim@chromium.org
Status: Assigned (was: Available)
I will fix this in following up works of OOR-CORS.

Sign in to add a comment