Repository navigation
Retry a signed GET/HEAD unsigned when it fails before a response (#33) - #34
Open
melvincarvalho wants to merge 1 commit into
Open
melvincarvalho wants to merge 1 commit into
melvincarvalho wants to merge 1 commit into
Conversation
Podkey's Authorization header turns a cross-origin GET into a non-simple request, so the browser sends a CORS preflight. Static hosts such as GitHub Pages don't answer it, the fetch rejects with a TypeError, and public files stop loading once the user is logged in. The fetch wrapper now tries once more without its own header when Podkey signed the request, the method is GET or HEAD, and the failure is a TypeError rather than an abort. Page-set auth, writes and the 401 retry are unchanged. XHR is left as it is: its errors are asynchronous. The helpers live in auth-header-utils.js with a copy in the interceptor, as for the existing ones (#7).
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #33.
Podkey's
Authorizationheader turns a cross-origin GET into a non-simple request, so the browser sends a CORS preflight. Static hosts such as GitHub Pages don't answer it, the fetch rejects with a TypeError, and public files stop loading once the user is logged in (seen on mindstr.org loading a map from github.io).Change
The fetch wrapper tries once more without its own header when all of these hold:
Authorization)Writes and the existing 401 retry are unchanged. If the caller passed no
headers, the retry drops the key again, so aRequestinput keeps its own headers.shouldRetryUnsignedandwithoutAuthorizationlive insrc/auth-header-utils.js, with a copy in the interceptor as for the existing helpers (#7). XHR is left as it is: its errors arrive asynchronously, so it would need a different approach.Tests
test/unsigned-retry.test.js: 13 tests, covering the helpers and the real interceptor in a vm sandbox whose fake network rejects any request carryingAuthorization. The two interceptor retry tests fail without the fix.npm test: 242 of 242 pass, andeslint src/is clean.Not yet checked in a real browser with the extension loaded.