8000 feat: allow setting the Origin header and Sec-Fetch-* headers in net.request() by zeeker999 · Pull Request #26135 · electron/electron · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

feat: allow setting the Origin header and Sec-Fetch-* headers in net.request() #26135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 5 commits into from
Nov 17, 2020
Merged

feat: allow setting the Origin header and Sec-Fetch-* headers in net.request() #26135

merged 5 commits into from
Nov 17, 2020

Conversation

zeeker999
Copy link
Contributor
@zeeker999 zeeker999 commented Oct 23, 2020 •
edited
Loading

Description of Change

This pull request is based on #26134. It's possible to reproduce a request send by Chrome Browser with #26134 and this pull request.

Is ok to backport this PR to stable branches, such as 10-x-y?

Checklist

Release Notes

Notes: Allowed setting the 'Origin' header and Sec-Fetch-* headers in net.request().

@electron-cation electron-cation bot added 8000 the new-pr 🌱 PR opened recently label Oct 23, 2020
@zeeker999 zeeker999 force-pushed the net-request-fetch-metadata branch 2 times, most recently from 004fd74 to e1b1a7a Compare October 23, 2020 16:17
@zeeker999 zeeker999 changed the title net.request: Respect the fetch metadata for request fix: Don't ignore the fetch metadata of request Oct 23, 2020
@zeeker999 zeeker999 changed the title fix: Don't ignore the fetch metadata of request fix: Don't ignore the fetch metadata of ClientRequest Oct 23, 2020
@deepak1556 deepak1556 requested review from nornagon and zcbenz October 23, 2020 21:29
@nornagon nornagon changed the title fix: Don't ignore the fetch metadata of ClientRequest feat: allow setting the Origin header in net.request() Oct 23, 2020
nornagon
nornagon suggested changes Oct 23, 2020
View reviewed changes
Copy link
Contributor
@nornagon nornagon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mostly lgtm! just want clarity on the (possibly) new sec-fetch-user behavior.

spec-main/api-net-spec.ts Outdated
});

['navigate', 'cors', 'no-cors', 'same-origin'].forEach((mode) => {
it('should set sec-fetch-mode if requested', async () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
it('should set sec-fetch-mode if requested', async () => {
it(`should set sec-fetch-mode to ${mode} if requested`, async () => {

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

spec-main/api-net-spec.ts Outdated
'report', 'script', 'serviceworker', 'style', 'track', 'video',
'worker', 'xslt'
].forEach((dest) => {
it('should set sec-fetch-dest if requested', async () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

8000
Suggested change
it('should set sec-fetch-dest if requested', async () => {
it(`should set sec-fetch-dest to ${dest} if requested`, async () => {

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

@nornagon nornagon changed the title feat: allow setting the Origin header in net.request() feat: allow setting the Origin header and Sec-Fetch-* headers in net.request() Oct 23, 2020
nornagon
nornagon reviewed Oct 23, 2020
View reviewed changes
@zeeker999 zeeker999 force-pushed the net-request-fetch-metadata branch from e1b1a7a to 3703749 Compare October 23, 2020 23:50
@electron-cation electron-cation bot removed the new-pr 🌱 PR opened recently label Oct 24, 2020
@zeeker999 zeeker999 requested a review from nornagon October 25, 2020 02:39
@zeeker999 zeeker999 force-pushed the net-request-fetch-metadata branch 3 times, most recently from dc93a03 to 26de6bd Compare October 25, 2020 10:38
@zcbenz
Copy link
Contributor
zcbenz commented Oct 26, 2020

Is ok to backport this PR to stable branches, such as 10-x-y?

Once this API is approved by wg-api, we can ask wg-releases for approval of backport.

@zcbenz zcbenz requested a review from a team October 26, 2020 02:42
nornagon
nornagon approved these changes Oct 26, 2020
View reviewed changes
Copy link
Contributor
@nornagon nornagon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally speaking we don't backport new features to stable branches unless there's a specific need. Backporting a new feature to a stable branch requires a minor version bump, and it's up to @electron/wg-releases to decide on a case-by-case basis whether to accept a feature backport.

In my opinion (as a non-member of the Releases WG), this feature presents a non-zero but quite small stability risk. Code paths are changed by this PR, but in such a way that it seems quite unlikely to cause any observable behavior change unless the caller is using the added features.

@zeeker999 zeeker999 force-pushed the net-request-fetch-metadata branch from 26de6bd to 709bf03 Compare October 27, 2020 11:12
@zeeker999
Copy link
Contributor Author

Hi, the cors request always fail with net error -2 and cors error kPreflightWildcardOriginNotAllowed. Do you have any idea what happens for this case?

Response of preflight request:

HTTP/1.1 200 
date	Wed, 28 Oct 2020 00:49:47 GMT
access-control-allow-origin	*
access-control-allow-methods	GET, POST, OPTIONS
access-control-expose-headers	
access-control-max-age	3000
access-control-allow-headers	content-type,x-csrf-token
Content-Security-Policy	frame-ancestors 'self'
strict-transport-security	max-age=31536000; includeSubDomains
Transfer-Encoding	chunked
Connection	keep-alive

@zeeker999
Copy link
Contributor Author
zeeker999 commented Nov 4, 2020 •
edited
Loading

Hi, the cors request always fail with net error -2 and cors error kPreflightWildcardOriginNotAllowed. Do you have any idea what happens for this case?

Response of preflight request:

HTTP/1.1 200 
date	Wed, 28 Oct 2020 00:49:47 GMT
access-control-allow-origin	*
access-control-allow-methods	GET, POST, OPTIONS
access-control-expose-headers	
access-control-max-age	3000
access-control-allow-headers	content-type,x-csrf-token
Content-Security-Policy	frame-ancestors 'self'
strict-transport-security	max-age=31536000; includeSubDomains
Transfer-Encoding	chunked
Connection	keep-alive

Ok, figured out this finally. We need backport 0e7d59d(#25284) too to fix this issue for stable branches.

@zeeker999 zeeker999 force-pushed the net-request-fetch-metadata branch from 709bf03 to 2bacdc0 Compare November 5, 2020 10:53
MarshallOfSound
MarshallOfSound reviewed Nov 10, 2020
View reviewed changes
lib/browser/api/net.ts Outdated
@@ -409,6 +410,10 @@ export class ClientRequest extends Writable implements Electron.ClientRequest {
return ret;
};
this._urlLoaderOptions.referrer = this._urlLoaderOptions.extraHeaders.referer || '';
this._urlLoaderOptions.origin = this._urlLoaderOptions.origin || this._urlLoaderOptions.extraHeaders.origin || '';
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Headers are case insensitive when read by the networking stack but this assumes that origin is lowercase here. To be accurate this should somehow pull origin in a case insensitive way right?

Copy link
Contributor Author
@zeeker999 zeeker999 Nov 10, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The header names are stored in lowercase internally. This is another issue we may fix in the future.

  setHeader (name: string, value: string) {
    ...
    const key = name.toLowerCase();
    this._urlLoaderOptions.extraHeaders[key] = value;
  }

Copy link
Contributor Author
@zeeker999 zeeker999 Nov 13, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just go ahead and fixed this issue too.

@jkleinsc
Copy link
Member

The API WG approved this PR at our Nov 9, 2020 meeting

@zeeker999 zeeker999 force-pushed the net-request-fetch-metadata branch 2 times, most recently from e4e0598 to 48c37d8 Compare November 13, 2020 03:42
nornagon
nornagon reviewed Nov 13, 2020
View reviewed changes
@zeeker999 zeeker999 force-pushed the net-request-fetch-metadata branch from 48c37d8 to b8da31e Compare November 14, 2020 03:55
@nornagon nornagon merged commit e1cc78f into electron:master Nov 17, 2020
@release-clerk
Copy link
release-clerk bot commented Nov 17, 2020

Release Notes Persisted

Allowed setting the 'Origin' header and Sec-Fetch-* headers in net.request().

@zeeker999 zeeker999 mentioned this pull request Nov 18, 2020
Closed
zeeker999 added a commit to zeeker999/electron that referenced this pull request Mar 13, 2021
@zeeker999
feat: allow setting the Origin header and Sec-Fetch-* headers in net.…
37f9c66 
…request() (electron#26135)
zeeker999 added a commit to zeeker999/electron that referenced this pull request Mar 13, 2021
@zeeker999
feat: allow setting the Origin header and Sec-Fetch-* headers in net.…
9eb4a43 
…request() (electron#26135)
zeeker999 added a commit to zeeker999/electron that referenced this pull request Apr 9, 2021
@zeeker999
feat: allow setting the Origin header and Sec-Fetch-* headers in net.…
cf345bd 
…request() (electron#26135)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nornagon nornagon nornagon approved these changes

@zcbenz zcbenz zcbenz approved these changes

@MarshallOfSound MarshallOfSound Awaiting requested review from MarshallOfSound

Assignees
No one assigned
Labels
api-review/approved ✅
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@zeeker999 @zcbenz @jkleinsc @nornagon @MarshallOfSound
0