Safelist Content-Length header #626

benjamingr · 2017-11-06T15:32:56Z

Fixes: #622

annevk

Thanks, but this is a little wrong. Also, would you like to add your name to the Acknowledgments section?

annevk · 2017-11-07T09:11:14Z

fetch.bs

@@ -472,7 +473,6 @@ is a <a>byte-case-insensitive</a> match for one of
 <li>`<a http-header><code>Access-Control-Request-Headers</code></a>`
 <li>`<a http-header><code>Access-Control-Request-Method</code></a>`
 <li>`<code>Connection</code>`
- <li>`<code>Content-Length</code>`


Please don't remove this, it's still a forbidden header name.

annevk · 2017-11-07T09:16:57Z

For tests I suspect there are resources that need changes, fetch/api/cors/cors-filtering.js for sure. Not entirely sure what else. Fixing that, adding some tests, and noting in implementation bugs that there might be more fallout we haven't spotted is sufficient I think.

benjamingr · 2017-11-07T10:47:19Z

Just to be sure @annevk - that would be a separate PR changing https://github.com/w3c/web-platform-tests/blob/master/fetch/api/cors/cors-filtering.js#L59 ?

annevk · 2017-11-07T11:26:55Z

Yeah, for normative changes there also needs to be a PR against web-platform-tests ensuring the change is tested (and any existing tests that need to be modified are modified) and browser bugs need to be filed pointing to both PRs ensuring everyone is notified.

Let me know how much of that you're willing to take on. I can help.

annevk · 2017-11-07T11:27:52Z

At a high level this is documented at https://whatwg.org/working-mode#changes by the way, but perhaps we should also have a more concrete day-to-day guide.

benjamingr · 2017-11-07T12:08:24Z

Let me know how much of that you're willing to take on. I can help.

I'm looking at this as an opportunity to learn the process better - if this gets annoying feel free to go ahead and make changes. I'll try to follow up with the tests tomorrow morning.

annevk · 2018-01-06T11:58:42Z

@benjamingr did you get around to making tests?

benjamingr · 2018-01-06T18:17:15Z

@annevk sorry, not yet :(

related to whatwg/fetch#626

shacharz · 2018-05-09T14:47:55Z

Chrome - https://bugs.chromium.org/p/chromium/issues/detail?id=841308
Firefox - https://bugzilla.mozilla.org/show_bug.cgi?id=1460299
Edge - https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/17440391/
Webkit - https://bugs.webkit.org/show_bug.cgi?id=185473

annevk · 2018-05-09T15:05:36Z

@shacharz great, thanks! Could you file a bug against https://bugs.webkit.org/enter_bug.cgi?product=WebKit&component=HTML%20DOM too?

shacharz · 2018-05-09T15:10:22Z

@shacharz great, thanks! Could you file a bug against https://bugs.webkit.org/enter_bug.cgi?product=WebKit&component=HTML%20DOM too?

updated

annevk · 2018-05-09T15:17:47Z

Thanks @benjamingr and @shacharz; hopefully this small change is picked up quickly by everyone.

See whatwg/fetch#626 for details.

benjamingr · 2018-05-09T16:24:43Z

Awesome :) Thanks and thanks @shacharz

…by default, a=testonly Automatic update from web-platform-testsCORS: safelist Content-Length header See whatwg/fetch#626 for details. -- wpt-commits: 407ecdff87af8aeceaa07cbc71aac9ec355d4334 wpt-pr: 10930

…by default, a=testonly Automatic update from web-platform-testsCORS: safelist Content-Length header See whatwg/fetch#626 for details. -- wpt-commits: 407ecdff87af8aeceaa07cbc71aac9ec355d4334 wpt-pr: 10930 UltraBlame original commit: b784d4f3615eff3bc00f986fc460fd48454075a1

Content-Length was not part of the original set of safelisted response headers See Also whatwg/fetch#626

See [MDN](https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted_response_header) and [whatwg/fetch](whatwg/fetch#626).

Safelist Content-Length header

bef2bfa

Fixes: whatwg#622

annevk requested changes Nov 7, 2017

View reviewed changes

benjamingr added 2 commits November 7, 2017 12:28

re-add content-length

51b4bb1

Add self to acknowledgements, as requested

3908d31

annevk approved these changes Nov 25, 2017

View reviewed changes

annevk added security/privacy There are security or privacy implications needs tests Moving the issue forward requires someone to write tests labels Apr 12, 2018

shacharz added a commit to shacharz/web-platform-tests that referenced this pull request May 9, 2018

expose content-length on a cors request by default

aa5cc1c

related to whatwg/fetch#626

shacharz mentioned this pull request May 9, 2018

expose content-length on a cors request by default web-platform-tests/wpt#10930

Merged

annevk removed the needs tests Moving the issue forward requires someone to write tests label May 9, 2018

annevk merged commit 3a896ef into whatwg:master May 9, 2018

annevk pushed a commit to web-platform-tests/wpt that referenced this pull request May 9, 2018

CORS: safelist Content-Length header

407ecdf

See whatwg/fetch#626 for details.

benjamingr deleted the patch-1 branch May 9, 2018 16:24

mikoMK mentioned this pull request Oct 30, 2020

What's the default CORS-safelisted response headers？ mdn/sprints#2788

Closed

m-mohr mentioned this pull request Nov 20, 2020

Fix security-related CORS issues regarding to credentials #41 Open-EO/openeo-api#345

Merged

hamishwillee mentioned this pull request Mar 1, 2021

HTTP > Content Length : Added to safelisted response header in specific versions mdn/browser-compat-data#9300

Closed

Faless mentioned this pull request Apr 3, 2021

[HTML5] Disable body_size in fetch. godotengine/godot#47597

Merged

github-actions bot mentioned this pull request Apr 23, 2022

translate(ja): migrate Glossary/CORS-safelisted_response_header html to md & update translation mdn/translated-content#5226

Merged

lidel mentioned this pull request May 19, 2022

fix: JS caching via Access-Control-Expose-Headers ipfs/kubo#8984

Merged

rwv added a commit to rwv/translated-content that referenced this pull request Aug 23, 2022

Add Content-Length for Simple Response Header

12c4f72

Content-Length was not part of the original set of safelisted response headers See Also whatwg/fetch#626

rwv mentioned this pull request Aug 23, 2022

Add Content-Length for Simple Response Header mdn/translated-content#7960

Merged

github-actions bot mentioned this pull request Aug 23, 2022

Add Note for Content-Type in Access-Control-Expose-Headers mdn/translated-content#7959

Closed

github-actions bot mentioned this pull request Sep 12, 2022

fix: remove Glossary tag mdn/content#20582

Merged

github-actions bot mentioned this pull request Sep 30, 2022

glossary 以下の Note: Warning: Callout: を日本語に変換 mdn/translated-content#8923

Merged

wdscxsj mentioned this pull request Oct 11, 2022

Content-Length is now a CORS-safelisted response header javascript-tutorial/en.javascript.info#3231

Merged

github-actions bot mentioned this pull request Feb 21, 2023

Glossary - Remove tags all entries mdn/content#24717

Merged

github-actions bot mentioned this pull request Sep 12, 2023

[ko]: add index.md for web/glossary/cors-safelisted_response_header mdn/translated-content#15794

Merged

github-actions bot mentioned this pull request Nov 13, 2023

fr - Glossary - Initial translation for C entries mdn/translated-content#16940

Merged

This was referenced Apr 27, 2024

zh-cn: init the translation of glossary terms "CORS-safelisted header" mdn/translated-content#19775

Merged

[ru] add Glossary/CORS-safelisted_response_header translation mdn/translated-content#19989

Merged

This was referenced Jul 25, 2024

Convert noteblocks for glossary folder mdn/content#35067

Merged

zh-cn: convert noteblock in /glossary to GFM syntax mdn/translated-content#22617

Merged

fr: Convert noteblocks to GFM Alerts (part 1) mdn/translated-content#22674

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Safelist Content-Length header #626

Safelist Content-Length header #626

benjamingr commented Nov 6, 2017 •

edited by pr-preview bot

Loading

annevk left a comment

annevk Nov 7, 2017

annevk commented Nov 7, 2017

benjamingr commented Nov 7, 2017

annevk commented Nov 7, 2017

annevk commented Nov 7, 2017

benjamingr commented Nov 7, 2017

annevk commented Jan 6, 2018

benjamingr commented Jan 6, 2018

shacharz commented May 9, 2018 •

edited

Loading

annevk commented May 9, 2018

shacharz commented May 9, 2018

annevk commented May 9, 2018

benjamingr commented May 9, 2018

Safelist Content-Length header #626

Safelist Content-Length header #626

Conversation

benjamingr commented Nov 6, 2017 • edited by pr-preview bot Loading

annevk left a comment

Choose a reason for hiding this comment

annevk Nov 7, 2017

Choose a reason for hiding this comment

annevk commented Nov 7, 2017

benjamingr commented Nov 7, 2017

annevk commented Nov 7, 2017

annevk commented Nov 7, 2017

benjamingr commented Nov 7, 2017

annevk commented Jan 6, 2018

benjamingr commented Jan 6, 2018

shacharz commented May 9, 2018 • edited Loading

annevk commented May 9, 2018

shacharz commented May 9, 2018

annevk commented May 9, 2018

benjamingr commented May 9, 2018

benjamingr commented Nov 6, 2017 •

edited by pr-preview bot

Loading

shacharz commented May 9, 2018 •

edited

Loading