Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Should referer header be included in fetchEvent request object? #1723

Open
jcubic opened this issue Jul 27, 2024 · 0 comments
Open

Should referer header be included in fetchEvent request object? #1723

jcubic opened this issue Jul 27, 2024 · 0 comments

Comments

@jcubic
Copy link

jcubic commented Jul 27, 2024

Are there any reason why referer is not included wit fetchEvent in the Service Worker?

I have this use case where I wanted to block all requests that originated from specific page.

This is actual code that used my library called Wayne, that I was hoping it would work:

importScripts('https://cdn.jsdelivr.net/npm/@jcubic/[email protected]/index.umd.min.js');

const app = new wayne.Wayne();

app.get('https://*/*', (req, res) => {
    const referer = req.headers.get("Referer");
    const url = new URL(referer);
    if (url.host === 'localhost' && url.pathname == '/') {
        res.fetch(req);
    } else {
        res.json({error: 'Forbidden'}, { status: 403 });
    }
});

I should block every request that was not sent from the home page of localhost. But unfortunately, Referer is not included, so something like this is not possible. At least in Chrome and Firefox.

I was looking at the spec and was not able to find a list of headers or referer.

Was this written somewhere that it should not be allowed to read the referer?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant