1521953 - Firefox stripping CORS headers from cached requests

Status: UNCONFIRMED

(Core :: Networking: Cache, defect, P2)

Description

[tapitman11]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0

Steps to reproduce:

Request a file which requires CORS headers. Request the same file again.

Actual results:

The first request works. The second request fails if the file is served from the cache, because the CORS headers are missing.

Expected results:

I would expect either a) the file is served properly from the cache with all the headers included with the original request or b) the entire request is redone, for example if Access-Control-Max-Age has expired.

Comment 1

[Kershaw Chang [:kershaw]]

Hi reporter,

Do you know if therer is a public url that we can use to reproduce this issue?

Thanks.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:selenamarie, could you have a look please?

Comment 3

[tapitman11]

Sorry, I lost track of this. I will see if I can find a suitable example.

Comment 4

[Honza Bambas (:mayhemer)]

I'm on triage this week, will look soon.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:selenamarie, could you have a look please?

Comment 6

[Selena Deckelmann :selenamarie :selena]

Hi! Have you been able to find an example of this bug? Thank you!

Comment 7

[Serge]

Steps to reproduce

1. Create a simple API that returns value from the querystring 'name' field.
2. Configure API CORS to allow requests from 'http://Domain1.WebsiteHost1' and 'http://Domain2.WebsiteHost1'.
3. Configure API to include 'cache-control' response header.
4. Deploy API to 'http://ApiHost/api'.
5. Create a simple web page that submits an XHR request to the API, eg when a user clicks a button.
6. Deploy web page to 'http://Domain1.WebsiteHost1' and 'http://Domain2.WebsiteHost1'.
7. Open http://Domain1.WebsiteHost1 and http://Domain2.WebsiteHost1 in different browser tabs.
8. Trigger XHR request in 1st tab.
9. Trigger XHR request in 2nd tab.

Expected result

At step 8, in http://Domain1.WebsiteHost1 tab, XHR request completes successfully and JavaScript can access response from the API.
At step 9, in http://Domain2.WebsiteHost1 tab, XHR request completes successfully and JavaScript can access response from the API.

Actual result

At step 8, in http://Domain1.WebsiteHost1 tab, XHR request completes successfully and JavaScript can access response from the API.
At step 9, in http://Domain2.WebsiteHost1 tab, XHR request response is retrieved from cache. Console displays CORS error:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://ApiHost/api/HttpTrigger1?name=World
(Reason: CORS header 'Access-Control-Allow-Origin' does not match 'http://Domain1.WebsiteHost1')

Actual example

Web pages

• http://domain1.binarystore.com/
• http://domain2.binarystore.com/

Each domain contains only a home page. Home pages are identical.

API end-point

• https://mozcorscachetestfunc.azurewebsites.net/api/HttpTrigger1

End-point reads 'name' querystring field and responds with "Hello, {name}". For example, GET https://mozcorscachetestfunc.azurewebsites.net/api/HttpTrigger1?name=World will return Hello, World.
HTTP response includes the cache-control=public, max-age=600 header.

Browser version:
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:dragana, since the bug has high priority, could you have a look please?

For more information, please visit auto_nag documentation.