RESOLVED FIXED247970
[SOUP] Can't make XHR request because of Content-Lenght header in GET request 
https://bugs.webkit.org/show_bug.cgi?id=247970
Summary [SOUP] Can't make XHR request because of Content-Lenght header in GET request
Martin Myhrman
Reported 2022-11-15 22:50:14 PST
When doing some get request a Content-Length header is present making some websites reject the request. Example: The specific service Im trying to sign into is https://figma.com/mirror using SAML SSO. In Figma Mirror select SAML SSO enter a valid account like mine: martin.myhrman@volvocars.com See error in console. Can only reproduce on Linux. Related bug: https://github.com/tauri-apps/wry/issues/717
Attachments
Add attachment proposed patch, testcase, etc.
Martin Myhrman
Comment 1 2022-11-15 22:51:08 PST
The request sen has a header that is Content-Length: 0. Looking here: https://www.rfc-editor.org/rfc/rfc7230 A user agent SHOULD NOT send a Content-Length header field when the request message does not contain a payload body and the method semantics do not anticipate such a body. Copying the request over into Postman and removing the Content-Length: 0 makes the request return a 200.
Michael Catanzaro
Comment 2 2022-11-16 08:22:30 PST
Heh, this might be one of those bug reports that explains a *lot* of broken websites... nice. I've been wondering why so many XHRs get blocked since 2015 or thereabouts.
Michael Catanzaro
Comment 3 2022-11-16 08:44:03 PST
(In reply to Michael Catanzaro from comment #2) > Heh, this might be one of those bug reports that explains a *lot* of broken > websites... nice. I've been wondering why so many XHRs get blocked since > 2015 or thereabouts. Good news: this is already fixed. The bug only occurs when using webkit2gtk-4.0 (builds made with -DUSE_SOUP2=ON), which uses libsoup 2. If you switch to webkit2gtk-4.1 (builds made with default build options), which uses libsoup 3, then the bug is gone. I'm not sure whether this was a bug in libsoup itself, or a bug in WebKit that's fixed in the libsoup 3 codepaths, but I don't think it's worth investigating: applications should migrate to -4.1 as soon as possible, and only use -4.0 if you have other dependencies on libsoup 2 that you haven't been able to remove yet. BTW I submitted about a dozen suspicious failed login attempts... hopefully Volvo does not decide to lock your account due to that. :P
Note You need to log in before you can comment on or make changes to this bug.