eclipse-ee4j / eclipse-ee4j/tyrus
Origin header should not be sent by client in handshake
Open
- Dominant language
- Java
- Stars
- 128
- Forks
- 49
- PR merge metrics
- No merged PRs in 30d
Description
Tyrus client is sending an origin header in the upgrade request. The value of the header is the host part of the websocket URL with scheme "http://". This does not really make sense and would say it's in fact misleading. Non-browser clients do not operate in a context where origin matters IMHO. According to the spec, the origin header is optional.
The main reason for me reporting this issue is a problem I ran into with the Qlik Sense websocket based API which fails to handle the handshake with the Tyrus client due to the origin header value. I had to manually change the header value to get the handshake working.
Contributor guide
Assessment
This issue has not been assessed yet.