[HtmlUnit] [htmlunit:bugs] #2015 Improperly sent Origin header upon Javascript-triggered reload

This is a multi-part message in MIME format.
--===============3685597631446406761==
Content-Type: multipart/related;
 boundary="===============6447165691884997121=="

This is a multi-part message in MIME format.
--===============6447165691884997121==
Content-Type: multipart/alternative;
 boundary="===============5817712929367868297=="
MIME-Version: 1.0

--===============5817712929367868297==
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

- **status**: accepted --> closed



---

** [bugs:#2015] Improperly sent Origin header upon Javascript-triggered reload**

**Status:** closed
**Group:** 2.35.0
**Created:** Fri Apr 26, 2019 09:37 PM UTC by Luke Powell
**Last Updated:** Sat May 04, 2019 05:22 PM UTC
**Owner:** RBRi


I have a page that polls via an AJAX listener to know when a task is done and then refreshes the page after a brief delay, as the following:

~~~
            // If the status is no longer creating, then we are "done" and should refresh the page
            if( data.dvSaveSet.statusInt != DVSaveSet.STATUS_CREATING )
            {
            	// Set the status text
            	$("#dvSaveSet-status").html(data.dvSaveSet.statusString);

            	// Make the progress bar "done"
            	$("#dvSaveSet-progressBar").val("100");
            	$("#dvSaveSet-progressText").html("100%");

                // Reload page after 0.5 seconds
                window.setTimeout(function(){ window.location.reload(); }, 500);
            }
~~~

When the reload is perfomed, HTMLUnit is sending a request for the page update, but it also includes this header:

~~~
 Origin: https://[mydomain]/[pathtoriginalpage]
~~~

There are two problems with this. First, this is not properly formatted as the Origin header should only contain the domain name and possibly the port, as specified in https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin. Secondly, since the domain that is referring this request is obviously the same since it is exactly the same page, there is no need for an Origin header at all and if I examine the contents of the headers sent by an actual browser, there is no Origin header sent.

The presence of this improperly formatted Origin header is causing the server to refuse the connection asking for a refresh, and thus causing the test to fail.


---

Sent from sourceforge.net because [email protected] is subscribed to https://sourceforge.net/p/htmlunit/bugs/

To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/htmlunit/admin/bugs/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.
--===============5817712929367868297==
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

<div class="markdown_content"><ul>
<li><strong>status</strong>: accepted --&gt; closed</li>
</ul>
<hr/>
<p><strong> <a class="alink strikethrough" href="https://sourceforge.net/p/htmlunit/bugs/2015/">[bugs:#2015]</a> Improperly sent Origin header upon Javascript-triggered reload</strong></p>
<p><strong>Status:</strong> closed<br/>
<strong>Group:</strong> 2.35.0<br/>
<strong>Created:</strong> Fri Apr 26, 2019 09:37 PM UTC by Luke Powell<br/>
<strong>Last Updated:</strong> Sat May 04, 2019 05:22 PM UTC<br/>
<strong>Owner:</strong> RBRi</p>
<p>I have a page that polls via an AJAX listener to know when a task is done and then refreshes the page after a brief delay, as the following:</p>
<div class="codehilite"><pre><span></span>            // If the status is no longer creating, then we are "done" and should refresh the page
            if( data.dvSaveSet.statusInt != DVSaveSet.STATUS_CREATING )
            {
                // Set the status text
                $("#dvSaveSet-status").html(data.dvSaveSet.statusString);

                // Make the progress bar "done"
                $("#dvSaveSet-progressBar").val("100");
                $("#dvSaveSet-progressText").html("100%");

                // Reload page after 0.5 seconds
                window.setTimeout(function(){ window.location.reload(); }, 500);
            }
</pre></div>


<p>When the reload is perfomed, HTMLUnit is sending a request for the page update, but it also includes this header:</p>
<div class="codehilite"><pre><span></span> Origin: https://[mydomain]/[pathtoriginalpage]
</pre></div>


<p>There are two problems with this. First, this is not properly formatted as the Origin header should only contain the domain name and possibly the port, as specified in <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin." rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin.</a> Secondly, since the domain that is referring this request is obviously the same since it is exactly the same page, there is no need for an Origin header at all and if I examine the contents of the headers sent by an actual browser, there is no Origin header sent.</p>
<p>The presence of this improperly formatted Origin header is causing the server to refuse the connection asking for a refresh, and thus causing the test to fail.</p>
<hr/>
<p>Sent from sourceforge.net because [email protected] is subscribed to <a href="https://sourceforge.net/p/htmlunit/bugs/">https://sourceforge.net/p/htmlunit/bugs/</a></p>
<p>To unsubscribe from further messages, a project admin can change settings at <a href="https://sourceforge.net/p/htmlunit/admin/bugs/options.">https://sourceforge.net/p/htmlunit/admin/bugs/options.</a>  Or, if this is a mailing list, you can unsubscribe from the mailing list.</p></div>
--===============5817712929367868297==--
--===============6447165691884997121==--


--===============3685597631446406761==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============3685597631446406761==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
HtmlUnit-develop mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/htmlunit-develop

--===============3685597631446406761==--