New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 841308 link

Starred by 4 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: 2018-05-11
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 2
Type: Bug



Sign in to add a comment

Fetch: content-length header is being added to the safe-list

Reported by shac...@peer5.com, May 9 2018

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36

Steps to reproduce the problem:
1. create a CORS fetch request to a url that has content-length in its response and doesn't add content-length to access-control-expose-headers
2.  content-length should be accessible in the response's headers
3. 

What is the expected behavior?
When doing a CORS fetch request if content-length exists in the http response it should be exposed on the response headers even if it's not added to the access-control-expose-headers.

What went wrong?
content-length is not exposed

Did this work before? N/A 

Does this work in other browsers? N/A

Chrome version: 66.0.3359.139  Channel: stable
OS Version: OS X 10.12.6
Flash Version: 

see:
https://github.com/whatwg/fetch/pull/626
https://github.com/w3c/web-platform-tests/pull/10930
 
lukasza: As the relevant CORB expert, is it 'just' as simple as updating kCorsSafelistedHeaders in the Network Service?
Components: Blink>SecurityFeature>CORS Blink>Network>FetchAPI
Owner: lukasza@chromium.org
Status: Untriaged (was: Unconfirmed)
Trying again as monorail ate my tags
Labels: OS-Android OS-Chrome OS-Fuchsia OS-Linux OS-Windows
shachar@, during the repro, does the DevTools console have any messages like:
    Blocked current origin from receiving cross-site document at
    https://example.com/ with MIME type text/html.
?

I assume (based on mention of CORS) that the problematic response includes access-control-allow-origin response header?  If it does, then I would expect CORB to allow the response (and so kCorsSafelistedHeaders in the Network Service [pointed out in #c1] shouldn't matter).


For now I assume that this bug is not related to CORB (*) in any way and instead is asking Chromium to add Content-Length to the list of headers in third_party/blink/renderer/platform/exported/web_cors.cc:

    bool IsOnAccessControlResponseHeaderWhitelist(const WebString& name) {
      DEFINE_THREAD_SAFE_STATIC_LOCAL(
          WebHTTPHeaderSet, allowed_cross_origin_response_headers,
          ({
              "cache-control", "content-language", "content-type", "expires",
              "last-modified", "pragma",
          }));


(*) CORB = Cross-Origin Read Blocking - see:
- https://github.com/whatwg/fetch/issues/681
- https://github.com/whatwg/fetch/pull/686
- https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md
NextAction: 2018-05-11
Let's wait until WPT changes propagate to Chromium.
 Issue 841307  has been merged into this issue.

Comment 7 by ricea@chromium.org, May 10 2018

Status: Assigned (was: Untriaged)
Tests arrives in https://chromium-review.googlesource.com/1052427.

Comment 8 by shac...@peer5.com, May 10 2018

lukasza@, You're right this issue is about adding Content-Length to the list of safe listed headers in a CORS request - As the spec has changed
The NextAction date has arrived: 2018-05-11
Status: Started (was: Assigned)
WIP CL @ https://chromium-review.googlesource.com/1066469
Ugh... quite a few legacy / non-WPT layout tests need to be updated...
Cc: lukasza@chromium.org mkwst@chromium.org
Owner: ----
Status: Available (was: Started)
mkwst@: I wonder if somebody more familiar with CORS tests could take this over.  

At any rate, since I am not actively working on this at the moment, let me change the status from Started to Available.

PS. This is not really related to CORB (especially after r581035 landed).
Cc: domfarolino@gmail.com
cc-ing domfarolino@: Feel free to take this one.

Sign in to add a comment