If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

AJAX with CORS and progress handler always uses OPTIONS HTTP method

RESOLVED INVALID

Status

()

Core
General
RESOLVED INVALID
5 years ago
5 years ago

People

(Reporter: Michael Müller, Unassigned)

Tracking

10 Branch
x86_64
Windows 7
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0.3) Gecko/20100101 Firefox/10.0.3
Build ID: 20120309135702

Steps to reproduce:

1. Open the web console and the scratchpad.
2. Execute the following code:

var xhr = new XMLHttpRequest();
xhr.upload.addEventListener('progress', function () {}, false);
xhr.withCredentials = true;
xhr.open('POST', 'http://example.org', true);
xhr.send();


Actual results:

An OPTIONS request is logged.
If you change the URL to some server that will accept your CORS request, it will probably tell you, only GET and POST are allowed.
This happens both in Firefox 10 and 16. I didn't test other browsers.


Expected results:

Instead a POST request should be sent.

This happens when I remove either the line to add the event listener or when I don't use CORS.
http://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#cross-origin-request-steps says:

  force preflight flag
    Set if the upload events flag is set. 

http://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#upload-events-flag says:

  Set when event listeners are registered on the XMLHttpRequestUpload object to determine
  whether a preflight request is needed. Initially unset.

And the per http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html if the force preflight flag is set, an OPTIONS request is performed before the real request to make sure it's OK to make the real request.  See http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#cross-origin-request-with-preflight in particular.

> it will probably tell you, only GET and POST are allowed.

Then it's pretty buggy...

> I didn't test other browsers.

You probably should.  ;)
Status: UNCONFIRMED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.