Bug 98838 - XHR CORS on 302 Redirect sets Origin to "null" in request
Summary: XHR CORS on 302 Redirect sets Origin to "null" in request
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Major
Assignee: Nobody
Keywords: InRadar
Depends on:
Reported: 2012-10-09 18:00 PDT by Terin Stock
Modified: 2017-09-18 09:34 PDT (History)
10 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Terin Stock 2012-10-09 18:00:39 PDT
Chrome Version       : 24.0.1284.2 dev
Safari Version       : 6.0.1 (8536.26.14)
Other browsers tested:
  Add OK or FAIL after other browsers where you have tested this issue:
 Firefox 15.x: OK
         IE 8: OK

What steps will reproduce the problem?
0. Be on one domain (host: http://example.test)
1. Initiate a XHR CORS request to a resource. (host: http://test1.example.org)
2. The resource issues a 302 redirect to another resource on another domain (host: http://test2.example.org)

What is the expected result?
The second request (to test2.example.org) would have set the Origin to "example.test" in the request

What happens instead?
During the second request the Origin is set to "null"
Comment 2 Bill Budge 2013-02-25 12:46:57 PST
Here is a web page that demonstrates the problem. The second test causes a cross-origin redirect, and the new request has no 'Origin' header.

Comment 3 Alexey Proskuryakov 2013-03-18 22:04:42 PDT
See also: bug 112471.
Comment 4 Brent Royal-Gordon 2017-09-15 23:51:45 PDT
I've experienced this behavior with a 303 redirect as well. My site was using the S3 "Browser-Based Uploads Using POST" feature, which can optionally emit a 303 redirect once the upload is complete.
Comment 5 youenn fablet 2017-09-18 09:34:19 PDT
http://origin-a.sigusrone.com/cors-redirect-accept-header is now working properly.

Brent, have you tried recent Safari versions, like Safari Tech Preview?
Would you be able to provide a reduced test case?