Authorization header for loading type=module scripts is not set
Reported by
m...@rkusa.st,
Sep 18 2017
|
||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.18 Safari/537.36 Steps to reproduce the problem: With demo test case: 1. Install demo dependencies with `npm install` 2. Start example Node application with `node server.js` 3. Open `http://localhost:3000/ 4. Insert any username or password (example accepts all inputs) Without demo test case: 1. Find and open page that is protected with basic authentication and includes scripts with `<script type="module">`. What is the expected behavior? The script loaded with `<script type="module">` should be loaded and executed. For the testcase: An alert window printing "Works!" should open. What went wrong? The request that loads the script referenced in `<script type="module">` does not have the `Authorization` header set. The request will consequentially fail with a `401 Unauthorized`. Did this work before? N/A Does this work in other browsers? Yes Chrome version: 62.0.3202.18 Channel: beta OS Version: OS X 10.13.0 Flash Version:
,
Sep 22 2017
@ m@rkusa.st: Unable to reproduce the issue on reported version 62.0.3202.18 by following below steps 1. Install demo dependencies with `npm install` 2. Start example Node application with `node server.js` 3. Open `http://localhost:3000/ 4. Insert any username or password It leads to blank page Could you let us know if we are missing any steps from our end?
,
Sep 22 2017
Thanks for testing! Steps are correct. I've retried the uploaded example (on both Mac and Win) and got the issue on both. I've attached a screenshot to show what I am getting. Is the example showing an Alert window for you?
,
Sep 22 2017
Thank you for providing more feedback. Adding requester "divya.padigela@techmahindra.com" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 22 2017
,
Sep 28 2017
,
Oct 3 2017
kouhei, can you direct this appropriately? Not sure if this is something in Blink loading or further down the net stack.
,
Oct 4 2017
This *was* a spec compliant behavior that all module scripts should be fetched w/ credentials mode "omit". However, a spec change landed today that we should respect crossorigin attribute for module script too. [1] https://github.com/whatwg/html/commit/9275d955dcd604e959cfcc672e0c234b1b8c00db I'll update the impl to match the spec.
,
Oct 4 2017
aiming for m63.
,
Oct 4 2017
|
||||||||||||
►
Sign in to add a comment |
||||||||||||
Comment 1 by manoranj...@chromium.org
, Sep 18 2017