fix(http): preserve empty referrer option in HttpRequest · angular/angular@bcb1b7e · GitHub

angular / angular Public

• Notifications You must be signed in to change notification settings
• Fork 27.4k
• Star 101k

• Code
• Issues 988
• Pull requests 162
• Discussions
• Actions
• Projects
• Security and quality 32
• Insights

Additional navigation options

Commit bcb1b7e

Browse filesBrowse the repository at this point in the historyBrowse files

SkyZeroZx

authored and

atscott

committed

fix(http): preserve empty referrer option in HttpRequest

Preserve `referrer: ''` when constructing and cloning HttpRequest. An empty string is a valid Fetch referrer value and is documented by Angular as the way to omit referrer information for sensitive requests. The previous truthy checks treated it as if the option was not provided, causing requests to fall back to the browser default referrer behavior. (cherry picked from commit 1e54b8f)

1 parent b9d2938 commit bcb1b7e
Copy full SHA for bcb1b7e

2 files changed

+14-2Lines changed: 14 additions & 2 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• packages/common/http
  • src
    • request.ts
  • test
    • request_spec.ts

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎packages/common/http/src/request.ts‎

Copy file name to clipboardExpand all lines: packages/common/http/src/request.ts

+3-2Lines changed: 3 additions & 2 deletions

Original file line number	Diff line number	Diff line change
@@ -523,7 +523,7 @@ export class HttpRequest<T> {
523	523	this.integrity = options.integrity;
524	524	}
525	525
526		- if (options.referrer) {
	526	+ if (options.referrer !== undefined) {
527	527	this.referrer = options.referrer;
528	528	}
529	529
@@ -734,7 +734,8 @@ export class HttpRequest<T> {
734	734	const mode = update.mode || this.mode;
735	735	const redirect = update.redirect || this.redirect;
736	736	const credentials = update.credentials || this.credentials;
737		- const referrer = update.referrer || this.referrer;
	737	+
	738	+ const referrer = update.referrer ?? this.referrer;
738	739	const integrity = update.integrity || this.integrity;
739	740	const referrerPolicy = update.referrerPolicy || this.referrerPolicy;
740	741	// Carefully handle the transferCache to differentiate between

Collapse file

‎packages/common/http/test/request_spec.ts‎

Copy file name to clipboardExpand all lines: packages/common/http/test/request_spec.ts

+11Lines changed: 11 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -95,6 +95,10 @@ describe('HttpRequest', () => {
95	95	const req = new HttpRequest('GET', '/test', {referrer: 'about:client'});
96	96	expect(req.referrer).toBe('about:client');
97	97	});
	98	+ it('should preserve an empty string referrer (used to suppress the Referer header)', () => {
	99	+ const req = new HttpRequest('GET', '/test', {referrer: ''});
	100	+ expect(req.referrer).toBe('');
	101	+ });
98	102	it('should allow setting referrerPolicy option', () => {
99	103	const req = new HttpRequest('GET', '/test', {referrerPolicy: 'no-referrer'});
100	104	expect(req.referrerPolicy).toBe('no-referrer');
@@ -175,6 +179,13 @@ describe('HttpRequest', () => {
175	179	it('and updates the referrer', () => {
176	180	expect(req.clone({referrer: 'https://example.com'}).referrer).toBe('https://example.com');
177	181	});
	182	+ it('and preserves an existing empty string referrer when the update omits it', () => {
	183	+ const emptyReferrerReq = new HttpRequest('GET', '/test', {referrer: ''});
	184	+ expect(emptyReferrerReq.clone().referrer).toBe('');
	185	+ });
	186	+ it('and can update the referrer to an empty string', () => {
	187	+ expect(req.clone({referrer: ''}).referrer).toBe('');
	188	+ });
178	189	it('and updates the integrity', () => {
179	190	expect(req.clone({integrity: 'sha512-...'}).integrity).toBe('sha512-...');
180	191	});

0 commit comments

Comments

0 (0)