How to make a GET fetch request with Origin header

[hseeberger]

In the docs for Request::method is written: "Note that the Origin header is not set on Fetch requests with a method of HEAD or GET.". Now I wonder how to make a GET request which carries an Origin header.

[ranile]

Sorry, it look me a little while to answer this. I believe it is set by the browser itself. If it's not, you can try to set header. It is possible that there may be a mistake in a documentation. If you could test and submit a PR to fix it (if it's there), that would be great.

[hseeberger]

No worries, your answer came pretty quickly.

In the meantime I found out that the Origin header indeed is set (presumably by the browser). The issue I was facing was a different one (wrong URL) and only accidentally showed up as a response without CORS headers. So all is good ;-)

I think the documentation of the method function in the http module is misleading: "Note that the Origin header is not set on Fetch requests with a method of HEAD or GET.".

The Fetch specification (https://fetch.spec.whatwg.org/#origin-header) defines: "The Origin header is a version of the Referer [sic] header that does not reveal a path. It is used for all HTTP fetches whose request’s response tainting is "cors", as well as those where request’s method is neither GET nor HEAD.". Hence as long as the response tainting is CORS, even GET and HEAD requests carry the Origin header.

I suggest to just delete that line in the docs.

[ranile]

Would you like PR a fix?

[hseeberger]

Sure.

[hseeberger]

See #211 and #212.