<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Safari sends empty "Access-Control-Request-Headers" in preflight request"
href="https://bugs.webkit.org/show_bug.cgi?id=169851">169851</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Safari sends empty "Access-Control-Request-Headers" in preflight request
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>Safari Technology Preview
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>New Bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>nolan@nolanlawson.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=304878" name="attach_304878" title="Screenshot from WebInspector showing the empty Access-Control-Request-Headers being sent">attachment 304878</a> <a href="attachment.cgi?id=304878&action=edit" title="Screenshot from WebInspector showing the empty Access-Control-Request-Headers being sent">[details]</a></span>
Screenshot from WebInspector showing the empty Access-Control-Request-Headers being sent
Instead of omitting the "Access-Control-Request-Headers" header, Safari will send an empty value, which causes compatibility problems with CouchDB 1.6.1 and CouchDB 2.0.0.
I've filed the exact same bug on Chrome, and they've fixed it as of M57: <a href="https://bugs.chromium.org/p/chromium/issues/detail?id=633729">https://bugs.chromium.org/p/chromium/issues/detail?id=633729</a>
Neither Firefox nor Edge have this bug.
I've also filed this as a compat bug on CouchDB, but they haven't fixed it yet: <a href="https://issues.apache.org/jira/browse/COUCHDB-3090">https://issues.apache.org/jira/browse/COUCHDB-3090</a>
STR:
1. Install CouchDB, run it on <a href="http://localhost:5984">http://localhost:5984</a> (e.g. using `brew install couchdb`)
2. Run `npm install -g add-cors-to-couchdb`
3. Run `add-cors-to-couchdb`
4. Open the URL: <a href="http://bl.ocks.org/nolanlawson/raw/68f8117655fce45f9172d4f00a4ccaf4/">http://bl.ocks.org/nolanlawson/raw/68f8117655fce45f9172d4f00a4ccaf4/</a>
Expected result: Safari doesn't send the header at all if the value is empty
Actual result: Safari sends "Access-Control-Request-Headers: " which breaks CouchDB.
I've reproduced in Safari Technology Preview Release 25 (Safari 10.2, WebKit 12604.1.8.1.2) on macOS Sierra (10.12.4 Beta (16E191a)).</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>