Problem sending restricted headers

[vladvino]

Specifically Origin header. Installed and turned on the interceptor extension. "Postman-" prefix is added to the header but never stripped. See attached.

Thanks,

-Vlad

[a85]

Thanks for reporting this Vlad. I am not able to replicate this issue. Just to make sure, do you have any chrome://flags on?

[vladvino]

Any particular flag?

On April 14, 2014 at 10:50:10 AM, Abhinav Asthana (notifications@github.com) wrote:

Thanks for reporting this Vlad. I am not able to replicate this issue. Just to make sure, do you have any chrome://flags on?

—
Reply to this email directly or view it on GitHub.

[gingerlime]

I noticed somehow different behaviour, but it might be related:

Without the interceptor when I send the request with a Origin header, I don't get back the Access-Control-Allow-Origin response header from the server. If I turn interceptor on, with the exact same request, I can see this header coming back from the server...

[gingerlime]

I tested this with requestb.in - and can confirm that without inspector, the Origin header isn't being sent to the server

with inspector on:

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Postman-Token: 5522cb1c-d158-f2f9-59b7-03165e5ab6f6
Connection: close
Accept: */*
Host: requestb.in
Cache-Control: no-cache
X-Request-Id: afb3a7e6-a82c-41da-ac3a-88fd7a2c8837
Origin: https://test-app.testuff.com

with inspector off:

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Postman-Token: a3466fc2-5408-2e31-2eff-9480d19a4ac1
Connection: close
Accept: */*
Host: requestb.in
Cache-Control: no-cache
X-Request-Id: 25a23b71-af6e-4a70-a81a-06f4f34f435a

[a85]

@gingerlime Looking into this in more detail. Seems to have started at the same time as Chrome 34 was introduced.

[a85]

@gingerlime You do need the Interceptor for sending the origin header. It's a Chrome restriction. Interceptor gets around this issue as it's an extension and has somewhat higher privileges.

[a85]

@vladvino Unable to replicate. Screenshot:

[gingerlime]

@a85 - ok, I figured this much out by myself :-)

then perhaps it shouldn't allow to add this header unless interceptor is on? or show a warning / info about this? (just a suggestion. I'm normally using httpie / curl anyway, just took a quick look at POSTMan out of curiosity)

[a85]

The dropdown does say that it's a Restricted header and you need the Interceptor for that. Interceptor does a lot of stuff other than sending restricted headers though. Sends cookies as well as capture requests from the browser. You might want to check it out.

[gingerlime]

Yeah, I did. Briefly. Why isn't it installed / on by default then?

[a85]

@gingerlime Can't install apps from within Postman. Interceptor has special privileges.

[a85]

I think this issue has been fixed. Related to another issue. Will be pushed to the Web Store soon!