ipfs / ipfs/gateway-conformance
CORS test sends non-CORS request
- Dominant language
- Go
- Stars
- 19
- Forks
- 15
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 5
Description
There's a [test](https://github.com/ipfs/gateway-conformance/blob/d855ec4fb9dac4a5aaecf3776037b005cc74c566/tests/path_gateway_cors_test.go#L18-L34):
> "GET Responses from Gateway should include CORS headers allowing JS from other origins to read the data cross-origin."
It makes a GET request to `"/ipfs/{{CID}}/"` and expects `Access-Control-Allow-Origin` etc in the response.
The test sends:
```
GET /ipfs/bafkqabtimvwgy3yk/ HTTP/1.1
Host: host.docker.internal:8080
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
```
The fetch spec [says](https://fetch.spec.whatwg.org/#http-requests):
> A CORS request is an HTTP request that includes an [Origin](https://fetch.spec.whatwg.org/#http-origin) header. It cannot be reliably identified as participating in the [CORS protocol](https://fetch.spec.whatwg.org/#cors-protocol) as the [Origin](https://fetch.spec.whatwg.org/#http-origin) header is also included for all [requests](https://fetch.spec.whatwg.org/#concept-request) whose [method](https://fetch.spec.whatwg.org/#concept-request-method) is neither `GET` nor `HEAD`.
There is no `Origin` header in the request, so this is not a CORS request.
Why does the test expect CORS headers in the response?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.