http://w1.renfe.es It's the online ticket service for the spanish train company (renfe.es). It's a very important service for the people living on Spain. Just go to the left bottom below "Mi cuenta" and try to log in with user: X1111111 and password: test It's just a not valid user (valid users have a credit card assigned... hehe), but it's valid to see the bug. Just click to "Entrar" to validate our entries. Then Webkit shows this message: "Result of expression 'batch.req' [undefined] is not an object.", and you are not logged to the system. But it's really amazing, because if you try to do the same using a Firefox 3.0.5 - Windows user agent using the Develop menu of Webkit, you can correctly log to the system and to buy tickets. If you try to log with user X1111111 and password: test, a message on red colour like this "Usuario no valido (U005)" is shown below the "Mi cuenta" text. But if you log with a valid user, the user is correctly validated and loged. Why is it failing only with the webkit user agent and not using other user agents with the same browser?
If it works correctly in Safari when the user agent is spoofed then the likely cause is that the website is detecting which browser is accessing it and acting differently for different browsers. In the console I see: Safari GET support disabled. See http://getahead.ltd.uk/dwr/server/servlet and allowGetForSafariButMakeForgeryEasier. This suggests that they do have different behaviour for Safari for some reason. Does this website work in any previous version of Safari?
This is definitely a bug in the website. Inside the function dwr.engine._sendData in engine.js, it creates an XMLHttpRequest instance as a property of batch named req: batch.req = new XMLHttpRequest(); It then detects Safari and attempts to work around a POST bug in ancient versions of Safari (build number < 400). For newer versions it calls the following code, apparently to let you know that it's using the "normal" code path: dwr.engine._handleWarning(batch, { name:"dwr.engine.oldSafari", message:"Safari GET support disabled. See http://getahead.ltd.uk/dwr/server/servlet and allowGetForSafariButMakeForgeryEasier." }); This _handleWarning function has the side-effect of cleaning up "batch", including deleting batch.req. This leads to the following code throwing an exception when trying to use batch.req: batch.req.open(batch.httpMethod, request.url, batch.async); I'm marking this as evangelism, as the site is clearly doing the wrong thing here. Someone will need to get in contact with the developer of the site and communicate this problem to them.
Thank you for your analysis Mark. I will try to contact the developer of this site to communicate this problem.
Contacted the developers of this website, and recently they has changed what I explained them. Now it's ok to log into the system, and to buy train tickets. So, all is working now. Closing.