[Webkit-unassigned] [Bug 169851] New: Safari sends empty "Access-Control-Request-Headers" in preflight request

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=169851

            Bug ID: 169851
           Summary: Safari sends empty "Access-Control-Request-Headers" in
                    preflight request
    Classification: Unclassified
           Product: WebKit
           Version: Safari Technology Preview
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: nolan at nolanlawson.com

Created attachment 304878
  --> https://bugs.webkit.org/attachment.cgi?id=304878&action=review
Screenshot from WebInspector showing the empty Access-Control-Request-Headers being sent

Instead of omitting the "Access-Control-Request-Headers" header, Safari will send an empty value, which causes compatibility problems with CouchDB 1.6.1 and CouchDB 2.0.0.

I've filed the exact same bug on Chrome, and they've fixed it as of M57: https://bugs.chromium.org/p/chromium/issues/detail?id=633729

Neither Firefox nor Edge have this bug.

I've also filed this as a compat bug on CouchDB, but they haven't fixed it yet: https://issues.apache.org/jira/browse/COUCHDB-3090

STR:

1. Install CouchDB, run it on http://localhost:5984 (e.g. using `brew install couchdb`)
2. Run `npm install -g add-cors-to-couchdb`
3. Run `add-cors-to-couchdb`
4. Open the URL: http://bl.ocks.org/nolanlawson/raw/68f8117655fce45f9172d4f00a4ccaf4/

Expected result: Safari doesn't send the header at all if the value is empty

Actual result: Safari sends "Access-Control-Request-Headers: " which breaks CouchDB.

I've reproduced in Safari Technology Preview Release 25 (Safari 10.2, WebKit 12604.1.8.1.2) on macOS Sierra (10.12.4 Beta (16E191a)).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170318/e5b2f7d9/attachment.html>