Preserve custom headers when following cross-origin redirects
Reported by
j...@nottheoilrig.com,
Nov 2 2016
|
|||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.113 Safari/537.36 Example URL: http://w3c-test.org/fetch/api/cors/cors-redirect-preflight.html Steps to reproduce the problem: 1. Make a same-origin request with custom headers: fetch('http://SAME.example', { headers: { 'X-ServiceWorker-Test': 'test' } }) 2. Receive and follow a cross-origin redirect: to http://OTHER.example What is the expected behavior? The custom header is present in both the initial request to http://SAME.example and the subsequent request to http://OTHER.example What went wrong? The custom header is present in only the initial request to http://SAME.example Did this work before? N/A Chrome version: 53.0.2785.113 Channel: n/a OS Version: Flash Version:
,
Nov 2 2016
I'm interested in working on this issue. I cooked up a CL to address it [1]. Chromium already preserves CORS-safelisted headers, so in general, the approach I have in mind is to extend this code to cover custom headers as well [2]. Issue 162183 introduced the code that preserves CORS-safelisted headers. [1] https://codereview.chromium.org/2471533005 [2] https://chromium.googlesource.com/chromium/src.git/+/master/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp#202
,
Nov 3 2016
,
Nov 3 2016
I assume this behavior is deliberate, and respects the fetch spec.
,
Nov 3 2016
I think the correct behavior would be to preserve the headers, but preflight on the redirect. We also need to ensure that we're doing the rest of the checks in https://fetch.spec.whatwg.org/#concept-http-redirect-fetch correctly. tyoshino@: Would you mind taking a look at the uploaded patch, and the related test results? We're failing 20/30, Firefox is only failing 10. :)
,
Nov 19 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/75318e021b295e4285017b661f7cf9ae41efc85d commit 75318e021b295e4285017b661f7cf9ae41efc85d Author: jack <jack@nottheoilrig.com> Date: Sat Nov 19 17:47:36 2016 Preserve custom headers when following cross-origin redirects. BUG= 661782 Review-Url: https://codereview.chromium.org/2471533005 Cr-Commit-Position: refs/heads/master@{#433421} [modify] https://crrev.com/75318e021b295e4285017b661f7cf9ae41efc85d/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/redirect.js [modify] https://crrev.com/75318e021b295e4285017b661f7cf9ae41efc85d/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-tripmine-expected.txt [modify] https://crrev.com/75318e021b295e4285017b661f7cf9ae41efc85d/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp [modify] https://crrev.com/75318e021b295e4285017b661f7cf9ae41efc85d/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h
,
Dec 1 2016
Can this issue be marked fixed now?
,
Dec 12 2016
Yes. Thanks jack for fixing this.
,
Dec 12 2016
Thank you for helping me with it!
,
Feb 9 2017
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by j...@nottheoilrig.com
, Nov 2 2016