Bug 24957 – REGRESSION (r41547): Google calendar widget no longer shows upcoming events

• Status: VERIFIED
• Resolution: FIXED
• Component: XML

[Ismail Donmez]

How to reproduce;

- Add some upcoming events in your Google calendar
- Enable Google calendar widget in GMail Lab settings

Expected behaviour:

Calendar widget shows upcoming events.

Current behaviour:

Upcoming event list is empty.


Used to work in older WebKit revisions (Safari 4 Beta works fine), so this is a regression.

[Cameron Zwarich (cpst)]

This regressed between the r41545 and r41698 nightlies. I'll try to find the exact point of regression by bisecting local builds.

[Cameron Zwarich (cpst)]

This regressed in r41547:

http://trac.webkit.org/changeset/41547

This is probably not our bug, so I'll put it in the Evangelism component.

[Cameron Zwarich (cpst)]

You can see the console spam from attempts to set headers that are no longer allowed by the XHR spec.

[Cameron Zwarich (cpst)]

Marking this P2 because it's an evangelism bug.

[Cameron Zwarich (cpst)]

The headers that give messages in the console are the Authorization and Connection headers. Since the Connection header was already disallowed before r41547, it must be the Authorization header that is causing problems. I also get the following message:

Unsafe JavaScript attempt to access frame with URL http://mail.google.com/mail/?ui=2&view=bsp&ver=1qygpcgurkovy from frame with URL https://www.google.com/calendar/mgadget?container=gm&v=48f45299de1a1e3b68bad2f5c3c6a20&lang=en&country=CA&view=default&rpctoken=w4ie8s41p89w&libs=js%2Fdynamic-height%3Agoogle.waitforload%3Arpc%3Asetprefs.js%3Aauth-refresh&parent=http%3A%2F%2Fmail.google.com%2Fmail%2Fhtml&pid=&up_calendarColors=(%23A32929)&up_calendarFeeds=(cwzwarich%2540gmail.com)&up_dateFormat=0&up_firstDay=0&up_hideAgenda=0&up_showDatepicker=false&up_showEmptyDays=0&up_showExpiredEvents=true&up_timeFormat=1%3A00pm&mid=0#st=e%3DAA6WCYaIzsKw7izCIrnHKw5hc1jwPTFciJoWcejS8SSVvhuWd2HrcK7TPIdwENlQSnoKyDBn2FW90sH95htVajbKNmqLdQckrjis6UL%252B3k1Vt1G2GGHPLBjf%252BfsGovdPU8Sgk0%252F67HqV%26c%3Dgm. Domains, protocols and ports must match.

[Alexey Proskuryakov]

I am not aware of any real reason to block the Authorization header, other than following the spec. Anne, are you?

Undoing this part of the change may be a better solution than evangelizing Google.

[Eric Seidel (no email)]

I've filed a Google bug on the issue:  http://b/1749893

[Jon@Chromium]

Also reported to the public Chromium bug tracker at http://code.google.com/p/chromium/issues/detail?id=8935

[Alexey Proskuryakov]

Created attachment 29160 [details]
proposed fix

So far, there seems to be no resistance to the idea of removing Authorization from the list of forbidden headers on public-webapps mailing list.

[Maciej Stachowiak]

Fix looks good to me.

[Maciej Stachowiak]

Comment on attachment 29160 [details]
proposed fix

r=me

[Alexey Proskuryakov]

Committed <http://trac.webkit.org/changeset/42314>.

Please verify that this actually fixes the calendar widget - I don't use it, so I didn't attempt to.

[Ismail Donmez]

Verified.