[HtmlUnit] [htmlunit:bugs] #2015 Improperly sent Origin header upon Javascript-triggered reload

[RBRi <rb...@us...>]

Nice catch, great description and reproducible. I like this kind of error reports.
Should be fixed now in Git, will inform via twitter if a new snapshot build is available. I guess this will be tomorrow.

Thanks for the report (pull request are also welcome ;-) enjoy testing with HtmlUnit


---

** [bugs:#2015] Improperly sent Origin header upon Javascript-triggered reload**

**Status:** accepted
**Group:** 2.35.0
**Created:** Fri Apr 26, 2019 09:37 PM UTC by Luke Powell
**Last Updated:** Sat May 04, 2019 04:19 PM UTC
**Owner:** RBRi


I have a page that polls via an AJAX listener to know when a task is done and then refreshes the page after a brief delay, as the following:

~~~
            // If the status is no longer creating, then we are "done" and should refresh the page
            if( data.dvSaveSet.statusInt != DVSaveSet.STATUS_CREATING )
            {
            	// Set the status text
            	$("#dvSaveSet-status").html(data.dvSaveSet.statusString);

            	// Make the progress bar "done"
            	$("#dvSaveSet-progressBar").val("100");
            	$("#dvSaveSet-progressText").html("100%");

                // Reload page after 0.5 seconds
                window.setTimeout(function(){ window.location.reload(); }, 500);
            }
~~~

When the reload is perfomed, HTMLUnit is sending a request for the page update, but it also includes this header:

~~~
 Origin: https://[mydomain]/[pathtoriginalpage]
~~~

There are two problems with this. First, this is not properly formatted as the Origin header should only contain the domain name and possibly the port, as specified in https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin. Secondly, since the domain that is referring this request is obviously the same since it is exactly the same page, there is no need for an Origin header at all and if I examine the contents of the headers sent by an actual browser, there is no Origin header sent.

The presence of this improperly formatted Origin header is causing the server to refuse the connection asking for a refresh, and thus causing the test to fail.


---

Sent from sourceforge.net because htm...@li... is subscribed to https://sourceforge.net/p/htmlunit/bugs/

To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/htmlunit/admin/bugs/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.