CORS request is preflighted, but it seems like it should not be

by

I ended up checking out the Webkit source code in an attempt to figure this out (after Google did not yield any helpful hits). It turns out that Webkit will force any cross-origin request to be preflighted simply if you register an onprogress event handler. I’m not entirely sure, even after reading the code comments, why this logic was applied.

In XMLHttpRequest.cpp: 

void XMLHttpRequest::createRequest(ExceptionCode& ec)
{
    ...

    options.preflightPolicy = uploadEvents ? ForcePreflight : ConsiderPreflight;

    ...

    // The presence of upload event listeners forces us to use preflighting because POSTing to an URL that does not
    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all.
    // Also, only async requests support upload progress events.
    bool uploadEvents = false;
    if (m_async) {
        m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
        if (m_requestEntityBody && m_upload) {
            uploadEvents = m_upload->hasEventListeners();
            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
        }
    }

    ...
}

UPDATE: Firefox applies the same logic as Webkit, it appears. Here is the relevant code from nsXMLHttpRequest.cpp:

nsresult
nsXMLHttpRequest::CheckChannelForCrossSiteRequest(nsIChannel* aChannel)
{
    ...

    // Check if we need to do a preflight request.
    nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(aChannel);
    NS_ENSURE_TRUE(httpChannel, NS_ERROR_DOM_BAD_URI);

    nsAutoCString method;
    httpChannel->GetRequestMethod(method);
    if (!mCORSUnsafeHeaders.IsEmpty() ||
        (mUpload && mUpload->HasListeners()) ||
        (!method.LowerCaseEqualsLiteral("get") &&
         !method.LowerCaseEqualsLiteral("post") &&
         !method.LowerCaseEqualsLiteral("head"))) {
      mState |= XML_HTTP_REQUEST_NEED_AC_PREFLIGHT;
    }

    ...
}

Notice the mUpload && mUpload->HasListeners() portion of the conditional.

Seems like Webkit and Firefox (and possibly others) have inserted some logic into their preflight-determination code that is not sanctioned by the W3C spec. If I’m missing something in the spec, please comment.

More Related Contents:

  1. Why does my http://localhost CORS origin not work?
  2. “Origin null is not allowed by Access-Control-Allow-Origin” error for request made by application running from a file:// URL
  3. Origin is not allowed by Access-Control-Allow-Origin
  4. Cross-Origin Request Headers(CORS) with PHP headers
  5. Access-Control-Allow-Origin Multiple Origin Domains?
  6. How to enable CORS in AngularJs
  7. Origin null is not allowed by Access-Control-Allow-Origin
  8. XMLHttpRequest Origin null is not allowed Access-Control-Allow-Origin for file:/// to file:/// (Serverless)
  9. enabling cross-origin resource sharing on IIS7
  10. No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘…’ is therefore not allowed access
  11. Why am I seeing an “origin is not allowed by Access-Control-Allow-Origin” error here? [duplicate]
  12. A CORS POST request works from plain JavaScript, but why not with jQuery?
  13. Google Maps API: No ‘Access-Control-Allow-Origin’ header is present on the requested resource
  14. AngularJS: No “Access-Control-Allow-Origin” header is present on the requested resource [duplicate]
  15. xmlhttprequest for local files
  16. Why am I seeing an “origin is not allowed by Access-Control-Allow-Origin” error here? [duplicate]
  17. Understanding XMLHttpRequest over CORS (responseText)
  18. Catching an Access-Control-Allow-Origin error in JavaScript
  19. Access denied in IE 10 and 11 when ajax target is localhost
  20. CORS request not working in Safari
  21. Chrome cancels CORS XHR upon HTTP 302 redirect
  22. How do you send a custom header in a CORS preflight OPTIONS request?
  23. What is the boundary parameter in an HTTP multi-part (POST) Request?
  24. How to Detect Cross Origin (CORS) Error vs. Other Types of Errors for XMLHttpRequest() in Javascript
  25. Internet Explorer 11 does not add the Origin header on a CORS request?
  26. Microsoft Edge blocked cross-domain requests sent to IPs in same private network CIDR
  27. How to make XMLHttpRequest cross-domain withCredentials, HTTP Authorization (CORS)?
  28. jQuery CORS Content-type OPTIONS
  29. WebKit “Refused to set unsafe header ‘content-length'”
  30. socket.io, ‘Access-Control-Allow-Origin’ error

Leave a Comment