Bug 247970
| Summary: | [SOUP] Can't make XHR request because of Content-Lenght header in GET request | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Martin Myhrman <martin.myhrman> |
| Component: | WebKitGTK | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | bugs-noreply, mcatanzaro |
| Priority: | P2 | ||
| Version: | Other | ||
| Hardware: | All | ||
| OS: | Linux | ||
Martin Myhrman
When doing some get request a Content-Length header is present making some websites reject the request.
Example:
The specific service Im trying to sign into is https://figma.com/mirror using SAML SSO.
In Figma Mirror select SAML SSO enter a valid account like mine: martin.myhrman@volvocars.com
See error in console.
Can only reproduce on Linux.
Related bug:
https://github.com/tauri-apps/wry/issues/717
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Martin Myhrman
The request sen has a header that is Content-Length: 0.
Looking here:
https://www.rfc-editor.org/rfc/rfc7230
A user agent SHOULD NOT send a Content-Length header field when the request message does not contain a payload body and the method semantics do not anticipate such a body.
Copying the request over into Postman and removing the Content-Length: 0 makes the request return a 200.
Michael Catanzaro
Heh, this might be one of those bug reports that explains a *lot* of broken websites... nice. I've been wondering why so many XHRs get blocked since 2015 or thereabouts.
Michael Catanzaro
(In reply to Michael Catanzaro from comment #2)
> Heh, this might be one of those bug reports that explains a *lot* of broken
> websites... nice. I've been wondering why so many XHRs get blocked since
> 2015 or thereabouts.
Good news: this is already fixed. The bug only occurs when using webkit2gtk-4.0 (builds made with -DUSE_SOUP2=ON), which uses libsoup 2. If you switch to webkit2gtk-4.1 (builds made with default build options), which uses libsoup 3, then the bug is gone. I'm not sure whether this was a bug in libsoup itself, or a bug in WebKit that's fixed in the libsoup 3 codepaths, but I don't think it's worth investigating: applications should migrate to -4.1 as soon as possible, and only use -4.0 if you have other dependencies on libsoup 2 that you haven't been able to remove yet.
BTW I submitted about a dozen suspicious failed login attempts... hopefully Volvo does not decide to lock your account due to that. :P