mapbox / mapbox/mapbox-gl-js

transformRequest headers ignored for Model resources

Open Beginner friendly
#13,723 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auto-triaged bug :lady_beetle:
Dominant language
TypeScript
Stars
12.4k
Forks
2.4k
PR merge metrics
No merged PRs in 30d

Description

### mapbox-gl-js version

v3.29.0

### Browser and version

All browsers (Chrome, Firefox, Safari) - tested on Chrome 151.0.7922.175

### Expected behavior

The `transformRequest` callback should apply custom headers to Model (GLTF/GLB) resource requests, just like it does for all other resource types (tiles, images, sprites, glyphs, etc.).

When a user returns headers from `transformRequest` for a Model resource, those headers should be included in the HTTP request.

### Actual behavior

The `transformRequest` callback IS called for Model resources, but the returned headers are completely ignored. Only the URL is used, and the request is made without any custom headers.

This is inconsistent with how all other resource types behave, where headers are correctly applied.

### Link to the demonstration

N/A - Bug is in library internals (loadGLTF function). Code analysis and reproduction steps provided below.

### Steps to trigger the unexpected behavior

1. Create a map with a transformRequest callback that adds authentication headers:

```javascript
const map = new mapboxgl.Map({
container: 'map',
style: 'mapbox://styles/mapbox/standard',
transformRequest: (url, resourceType) => {
console.log('Transform request:', resourceType, url);

if (resourceType === 'Model') {
return {
url: url,
headers: { 'Authorization': 'Bearer my-secret-token' }
};
}
return { url };
}
});
```

2. Add a model layer that loads from a server requiring authentication:

```javascript
map.on('style.load', () => {
map.addSource('my-model', {
type: 'model',
models: {
'my-model-id': 'https://my-server.com/model.glb'
}
});

map.addLayer({
id: 'model-layer',
type: 'model',
source: 'my-model',
paint: { 'model-id': 'my-model-id' }
});
});
```

3. Check the network request in DevTools - the Authorization header will be missing despite being returned from transformRequest

## Root Cause

Bug is in `loadGLTFFromURI` (line ~53548 in dist/mapbox-gl-dev.js):

```javascript
async loadGLTFFromURI(uri, signal) {
const request = await this.map._requestManager.transformRequest(uri, ResourceType.Model, signal);
return loadGLTF(request.url, signal); // Only passes URL, discards headers
}
```

And `loadGLTF` (line ~38356):

```javascript
async function loadGLTF(url, signal) {
const { data: buffer } = await getArrayBuffer({ url }, signal); // Creates new object with only URL
return decodeGLTF(buffer, 0, url, signal);
}
```

Compare with correct implementation for Images:

```javascript
const request = await this._requestManager.transformRequest(url, ResourceType.Image);
const { data } = await getImage(request); // Passes full request object with headers
```

## Proposed Fix

```javascript
async loadGLTFFromURI(uri, signal) {
const request = await this.map._requestManager.transformRequest(uri, ResourceType.Model, signal);
return loadGLTF(request, signal); // Pass full request object
}

async function loadGLTF(requestParameters, signal) {
const { data: buffer } = await getArrayBuffer(requestParameters, signal); // Use full request
return decodeGLTF(buffer, 0, requestParameters.url, signal);
}
```

### Relevant log output

```shell
Console output shows transformRequest is called:
Transform request: Model https://my-server.com/model.glb

Network tab in DevTools shows the request is made WITHOUT the Authorization header:

Request URL: https://my-server.com/model.glb
Request Method: GET
Status: 401 Unauthorized (if server requires auth)

Expected header is missing:
Authorization: Bearer my-secret-token
```

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with loadGLTFFromURI in dist/mapbox-gl-dev.js around line 53548 and loadGLTF around line 38356, then compare the image-loading path that passes the full request object. Verify that model requests preserve headers returned by transformRequest, and reproduce the authenticated request to confirm the Authorization header is sent.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend, web-dev
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.