Access-Control-Expose-Headers does not handle stray spaces as Chrome does, breaking FCC pagination.

RESOLVED FIXED

Status

Tech Evangelism
Desktop
RESOLVED FIXED
a year ago
11 months ago

People

(Reporter: Thomas Wisniewski, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [webcompat], URL)

(Reporter)

Description

a year ago
The FCC page in the URL link has its pagination broken ("0 results") because they the pass the relevant information cross-domain in HTTP headers, but have a stray space in a header name in their CORS directive header (at the end):

>Access-Control-Expose-Headers:server,limit,offset,params,response-time,total,authorization,access-control-allow-origin,x-response- time

It seems that Firefox completely ignores the line because of that space (and thus disallows access to all the headers). Chrome and Safari still allow access to all the headers but that final malformed one. Edge allows access to all of them, as though it just ignores the space (found by setting up a quick test on my own server at http://thomas.tanrei.ca/moz/cors-header-test.html).
Flags: webcompat?

Comment 1

11 months ago
Hi Anne, do you think this parsing behaviour is something we'd consider to add or clarify in the spec?
Flags: needinfo?(annevk)

Comment 2

11 months ago
Per the standard this is a bug in the other browsers. The field-name production doesn't allow spaces. Unless this is widespread I suggest we add a test to web-platform-tests and file bugs against the other browsers. Does that sound reasonable?
Flags: needinfo?(annevk)
Is there an error Firefox surfaces that we can show in DevTools to help people discover this issue?

Comment 4

11 months ago
(In reply to Anne (:annevk) from comment #2)
> Per the standard this is a bug in the other browsers. The field-name
> production doesn't allow spaces. Unless this is widespread I suggest we add
> a test to web-platform-tests and file bugs against the other browsers. Does
> that sound reasonable?

Sounds good!

Hi Shawn, would you be able to help this out?
Flags: needinfo?(shuang)

Comment 5

11 months ago
https://github.com/w3c/web-platform-tests/pull/6000 (also has pointers to the bugs I filed on other browsers).
Flags: needinfo?(shuang)

Comment 6

11 months ago
(In reply to Anne (:annevk) from comment #5)
> https://github.com/w3c/web-platform-tests/pull/6000 (also has pointers to
> the bugs I filed on other browsers).

Yay, thanks Anne :D

Since the wpt is merged, looks this bug could be closed?

Comment 7

11 months ago
I guess I'll move it over to webcompat and let them decide.
Component: DOM → General
Product: Core → Web Compatibility
Version: Trunk → unspecified
Let's go ahead and close. We'll track the work of getting FCC to fix their bug over in https://webcompat.com/issues/6675. Thanks everyone!
Status: NEW → RESOLVED
Last Resolved: 11 months ago
Component: General → Desktop
Product: Web Compatibility → Tech Evangelism
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.