1031630 - Origin header not sent when a form is submitted via javascript

Status: RESOLVED DUPLICATE of bug 446344

(Core :: General, defect)

Description

[Wesley Aptekar-Cassels]

Attachment: originpoc.html

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:32.0) Gecko/20100101 Firefox/32.0 (Beta/Release)
Build ID: 20140619004025

Steps to reproduce:

Create a html page that creates a form and sends it via javascript.  An example is attached to this bug report.


Actual results:

The example code shown sends a POST request "https://example.com/postpage" without the Origin header.


Expected results:

The example code should have sent a POST request with an Origin header as defined in RFC 6454.

This is noted in this comment (https://bugzilla.mozilla.org/show_bug.cgi?id=446344#c53), but has not received a response.  This is a problem, because it makes Origin a broken solution for CSRF protection, as the site must make a choice to deny requests without the Origin header, and risk excluding some users, or accept the request, and thus be open to CSRF.

Comment 1

[Jason Duell]

This doesn't smell like a necko bug to me, but I'm not sure which component to put it in.

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is an exact duplicate of bug 446344, no?  I mean, form posts are what bug 446344 comment 0 is about.