Skip to content

Custom protocol on Linux sends empty Origin header #366

@Beanow

Description

@Beanow

Describe the bug

Using a custom protocol like wry:// from the examples, the browser will send Origin: (blank) to the server.
And any value for Access-Control-Allow-Origin doesn't work, except for *.

Steps To Reproduce

  1. Start a Caddy server with the below guide.
    https://gist.github.com/Beanow/ccb667d1d7ffc674dedd7e54a62800ec
  2. Start the custom protocol example cargo run --example custom_protocol.
  3. Open devtools and run in the console:
fetch('http://localhost:8080/wry').then(res => res.text()).then(console.log)

Notice how the network tab will claim "Origin: wry://examples"
And the server allows it with Access-Control-Allow-Origin: wry://examples.

However looking at the Caddy access logs, the actual origin header was blank.
And the browser blocks the request.

{
	"request": {
		"remote_addr": "172.17.0.1:41812",
		"proto": "HTTP/1.1",
		"method": "GET",
		"host": "localhost:8080",
		"uri": "/wry",
		"headers": {
			"Accept-Encoding": ["gzip, deflate"],
			"Accept-Language": ["en-US"],
			"Connection": ["Keep-Alive"],
			"Origin": [""],
			"Accept": ["*/*"],
			"User-Agent": [
				"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Safari/605.1.15"
			]
		}
	},
	"common_log": "172.17.0.1 - - [11/Aug/2021:19:15:56 +0000] \"GET /wry HTTP/1.1\" 200 27",
	"duration": 0.000135124,
	"size": 27,
	"status": 200,
	"resp_headers": {
		"Server": ["Caddy"],
		"Access-Control-Allow-Origin": ["wry://examples"],
		"Content-Type": []
	}
}

Expected behavior

  • Making a request from the wry://examples origin, sets the header Origin: wry://examples.
  • Given a Access-Control-Allow-Origin: wry://examples response header, the request is not blocked.

Screenshots

network
console

Platform and Versions (please complete the following information):
OS: Linux / Ubuntu 20.04 LTS
Rustc: 1.54.0

Would you assign yourself to resolve this bug?

  • Yes
  • No

Additional context

Possibly related to #348.
Downstream issue tauri-apps/tauri#2327

Other examples are included in the gist/server.

fetch('http://localhost:8080/anything').then(res => res.text()).then(console.log)

For instance does seem to work given the Access-Control-Allow-Origin: *.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions