The response of the CORS POST request is empty when using webRequest

[vladimiry]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Issue Details

The response of the CORS POST request is empty.

• Electron Version: 7.x, 8.x
• Operating System: Linux (at least)
• Last Known Working Electron version: 6.1.3

Expected Behavior

The response of the CORS POST request is not empty.

Actual Behavior

The response of the CORS POST request is empty.

To Reproduce

https://github.com/vladimiry-playground/electron-quick-start-custom-prtocol-cors-issue

Screenshots

Additional Information

In v7 and v8, the access-control-allow-origin and origin headers are not shown as modified in the dev console. It shows https://mail.protonmail.com value but should be showing scheme123://index.html as v6 does.

[vladimiry]

Just tried electron@7.1.0, the problem is still there.

[nornagon]

@vladimiry it looks like you're issuing the request from a page served on a custom domain, and additionally modifying the request with webRequest. Are you also seeing the issue for CORS requests when not using those features? If not, please update the issue title and details to reflect your findings.

[vladimiry]

@nornagon that's correct, in the original repro repository a custom protocol is used but the problem is also reproducible for the regular/https scheme, the respective repro repo is here https://github.com/vladimiry-playground/electron-quick-start-cors-issue

See some visual description below

Notice that "access-control-allow-origin" header is shown defferently on dev console for 6.x and 7.x (it's related to the `Additional Information` section of the original message)

The expected value here is *, see https://github.com/vladimiry-playground/electron-quick-start-cors-issue/blob/5eea2e715d24101cbf9ed9142f4c00ba168a30fd/main.js#L90

[nornagon]

Your new repro also uses webRequest, so it seems like that's critical to this issue, yes? cc @zcbenz who worked on migrating webRequest to the network service.

[vladimiry]

Your new repro also uses webRequest, so it seems like that's critical to this issue, yes?

Correct, it's all about the onBeforeSendHeaders/onHeadersReceived webRequest handlers.

[deepak1556]

@zcbenz it might be related to the OOR-CORS feature that was enabled https://groups.google.com/a/chromium.org/d/msg/network-service-dev/zph9qQsu91I/yE2-Pw8BAQAJ

[zcbenz]

Currently webRequest in Electron uses the extraHeaders: false code path in Chromium, we should use the extraHeaders: true code path to keep compatibility with old versions. It is on my TODO list but I thought no app would be hit by the behavior, I'll have a fix for this.

[vladimiry]

Can confirm the issue got resolved with 7.1.2 release.

[jalanga]

For me is not working on electron 7.1.2, on OSX, onBeforeSendHeaders is not called.
I am updating my app from electron 1.7.12

[vladimiry]

@jalanga did you try running the https://github.com/vladimiry-playground/electron-quick-start-cors-issue repo (initially provided here #20923 (comment))? If it works for you on OSX then the issue is probably in your code (1.7.12 => 7.1.2 is a major update that might require restructuring the exisitng code).

[jalanga]

@vladimiry Thank you for your time, your example is working, the headers are set, de single difference is that I do initSession after createWindow, if I do it before it, is stuck at splash screen. I will figure it out.

[jalanga]

Fir parameter filter for onBeforeSendHeaders it was http://localhost:8000 which was bad, because, now needs to be http://localhost:8000/*