ipfs / ipfs/gateway-conformance

CORS test sends non-CORS request

Open
#217 2 comments 0 reactions 0 assignees View on GitHub
help wanted P2
Dominant language
Go
Stars
19
Forks
15
Avg merge
1d 4h
Merged PRs (30d)
5

Description

There's a [test](https://github.com/ipfs/gateway-conformance/blob/d855ec4fb9dac4a5aaecf3776037b005cc74c566/tests/path_gateway_cors_test.go#L18-L34):

> "GET Responses from Gateway should include CORS headers allowing JS from other origins to read the data cross-origin."

It makes a GET request to `"/ipfs/{{CID}}/"` and expects `Access-Control-Allow-Origin` etc in the response.

The test sends:

```
GET /ipfs/bafkqabtimvwgy3yk/ HTTP/1.1
Host: host.docker.internal:8080
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
```

The fetch spec [says](https://fetch.spec.whatwg.org/#http-requests):

> A CORS request is an HTTP request that includes an [Origin](https://fetch.spec.whatwg.org/#http-origin) header. It cannot be reliably identified as participating in the [CORS protocol](https://fetch.spec.whatwg.org/#cors-protocol) as the [Origin](https://fetch.spec.whatwg.org/#http-origin) header is also included for all [requests](https://fetch.spec.whatwg.org/#concept-request) whose [method](https://fetch.spec.whatwg.org/#concept-request-method) is neither `GET` nor `HEAD`.

There is no `Origin` header in the request, so this is not a CORS request.

Why does the test expect CORS headers in the response?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.