Origin header set to null when using custom scheme handler

[Czarek]

I've modified the "scheme_test.cc" file [1] and changed form action to http://xhaus.com/headers , so that I can see the headers sent. However I can see that "Origin" header is set to "null". In scheme_test_common.cc [2] I can see that the "is_cors_enabled" parameter is set to true, so according to docs [3] this should enable the Origin header. Is this a bug or am I doing something wrong?

In Electron project, in this comment [4], I can see that Origin is set to "app://" when using app:// scheme handler.

Ref:
[1] https://github.com/chromiumembedded/cef ... est.cc#L54
[2] https://github.com/chromiumembedded/cef ... mon.cc#L14
[3] https://github.com/chromiumembedded/cef ... eme.h#L126
[4] https://github.com/electron/electron/is ... -246335171

[ndesktop]

Maybe CORS does not apply to non-http schemes (and you are using a http:// one)?

[Czarek]

I've set the "is_cors_enabled" option when registering scheme. Link to docs in my previous post. It works in Electron, so I guess it should work in CEF as well.

[ndesktop]

Electron guys seems to overcome this by removing the (null?) Origin in onBeforeSendHeaders.
I'm not sure what will be the equivalent in libcef, perhaps OnBeforeResourceLoad + CefBeforeResourceLoadCallback or by patching GetRequestHandler and call a patch overridden method in CefRequestImpl::Set.

[Czarek]

Thanks! Good to know. I've set Origin header in OnBeforeResourceLoad when sending a POST request to a http:// from a file:// protocol and it works fine.

[ndesktop]

I've noticed sometimes (yes, I know...) that setting a header DCHECKs because the request object has been SetReadOnly.
I could not find the time to investigate deeper - only use IsReadOnly() to verify if the CefRequest::SetReadOnly underlying object has been called.

[Czarek]

Do you recall in which method of request handler did that happen? Setting header doesn't e.g. work in OnBeforeBrowse. Docs for OnBeforeResourceLoad state that request object can be modified.

[Czarek]

The issue you referenced earlier in Electron was about making a POST request to a http:// from file:// protocol. I only noticed this now. In this case it is expected for Origin header to be null, because it is a 'local' scheme. The issue I report here is different. It is about a custom scheme handler that is standard, not local and with cors enabled. In such case the Origin header should be set automatically according to WHATWG specification and CEF docs. In Electron Origin header is set properly when using a custom scheme.

[ndesktop]

Do you recall in which method of request handler did that happen? Setting header doesn't e.g. work in OnBeforeBrowse. Docs for OnBeforeResourceLoad state that request object can be modified.

I'm not 100% sure, but yes, I think OnBeforeBrowse.