No "referer" header when iframe url set with location.replace

[Arthur Schwaiger]

Created attachment 468188 [details]
result of the minimal reproducible example

Hi WebKit team,

When using location.replace to set the URL of an iframe (instead of the classic "src" attribute), the "referer" in the iframe request is not set.

All other major browsers (Chrome, Firefox, Edge) properly set the "referer" with both location.replace and src attribute.

This has major impact on our service where our providers *need* this referer header.

We have a minimal reproducible example here.
It's a simple iframe where the URL is set with location.replace, and a Node.js backend which returns the request's referer.

You can see the result in the screenshot: all browsers except Safari return the referer. For safari, it's undefined.

HTML:
```
<iframe id="myIframe"></iframe>
<script>
  var myIframe = document.getElementById("myIframe");
  myIframe.contentWindow.location.replace("http://localhost:3000");
</script>
```

Node.js Server (Express):
```
const express = require("express");
const app = express();

app.use((req, res) => {
  const referer = req.headers.referer;
  res.send(`Referer: ${referer}`);
});

app.listen(3000, () => {
  console.log("Server listening on port 3000");
});
```


I'm available if you need any more information.

Thank you for your help !

Best regards,

Arthur Schwaiger

[Ahmad Saleem]

Hi Arthur, can you attach simple reproducible test case or webpage for testing purposes?

[sideshowbarker]

I’ve written a WPT test for this and I can confirm that the test passes in Firefox and Chrome but fails in Safari. The test files are here:

- https://github.com/web-platform-tests/wpt/blob/sideshowbarker/location-replace-from-iframe/html/browsers/history/the-location-interface/location-replace-from-iframe.sub.html

- https://github.com/web-platform-tests/wpt/blob/sideshowbarker/location-replace-from-iframe/html/browsers/history/the-location-interface/resources/iframe-contents.sub.html

I’ll investigate today, and if I can find a fix, I’ll open a PR with a patch for the fix, and with the WPT tests.

[sideshowbarker]

Pull request: https://github.com/WebKit/WebKit/pull/19093

[Radar WebKit Bug Importer]

<rdar://problem/117205761>

[sideshowbarker]

Submitted web-platform-tests pull request: https://github.com/web-platform-tests/wpt/pull/42742

[sideshowbarker]

Submitted web-platform-tests pull request: https://github.com/web-platform-tests/wpt/pull/42877

[EWS]

Committed 270741@main (1350b5914d01): <https://commits.webkit.org/270741@main>

Reviewed commits have been landed. Closing PR #19093 and removing active labels.