storage: refused to set unsafe header "user-agent", "content-length"

[johnpryan]

using the StorageApi client with a package:http BrowserClient can result in unsafe headers like "user-agent" and "content-length" getting set. XHRs aren't allowed to set these headers (ref)

Steps to reproduce:

1. clone https://github.com/johnpryan/dart_sdk_archive
2. run pub global activate webdev && webdev serve
3. open http://localhost:8080
4. open dev tools
5. observe console warnings

[StorminGorman]

I found that this bug resides within https://github.com/dart-lang/discoveryapis_commons/blob/master/lib/src/clients.dart

So, this issue probably needs to move over to https://github.com/dart-lang/discoveryapis_commons .

        headers = {
          'user-agent': _userAgent,
          'content-type': CONTENT_TYPE_JSON_UTF8,
          'content-length': '$length',
        };

The offending code in this case: https://github.com/dart-lang/discoveryapis_commons/blob/53552b470e5827fb1cd5ceaec4b4253b477cbe43/lib/src/clients.dart#L203

I'm sure this works great for non-web clients. I guess a PR would be needed to pass in a boolean or have a new subclass that gets instantiated in the case of the request coming from a web client in order to drop the flags.

[jonasfj]

@StorminGorman, nice catch, I filed dart-archive/discoveryapis_commons#30

[jonasfj]

Fixed in _discoveryapis_commons version 0.1.8+2.

If you do a pub upgrade it should get into your project.