improved headers for xhr preflight requests

rbri · rbri · commit 9948cd5113af · 2026-07-25T11:07:10.000+02:00
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
@@ -8,6 +8,9 @@
 
     <body>
         <release version="5.4.0" date="August xx, 2026" description="Firefox 153, Bugfixes">
+            <action type="update" dev="rbri">
+                Improved headers for xhr preflight requests.
+            </action>
             <action type="update" dev="rbri">
                 Method innerText() for selects generates now the same output as the real browsers.
             </action>
diff --git a/src/main/java/org/htmlunit/BrowserVersionFeatures.java b/src/main/java/org/htmlunit/BrowserVersionFeatures.java
@@ -404,6 +404,10 @@ public enum BrowserVersionFeatures {
     @BrowserFeature({FF, FF_ESR})
     XHR_LOAD_ALWAYS_AFTER_DONE,
 
+    /** Indicates if the XMLHttpRequest preflight request includes the 'Sec-Fetch-Mode=cors' header. */
+    @BrowserFeature({CHROME, EDGE})
+    XHR_PREFLIGHT_CORS,
+
     /** If state unsent the response text is empty even if the response type is wrong. */
     @BrowserFeature({FF, FF_ESR})
     XHR_RESPONSE_TEXT_EMPTY_UNSENT,
diff --git a/src/main/java/org/htmlunit/HttpWebConnection.java b/src/main/java/org/htmlunit/HttpWebConnection.java
@@ -1116,7 +1116,8 @@ else if (HttpHeader.UPGRADE_INSECURE_REQUESTS.equals(header)) {
 
                 // Real browsers only send this for navigations (top-level, iframe, frame),
                 // never for subresource fetches (image/script/style/xhr/...).
-                else if (WebRequest.FetchMode.NAVIGATE.getValue().equals(secFetchMode)) {
+                else if (WebRequest.FetchMode.NAVIGATE.getValue().equals(secFetchMode)
+                            && HttpMethod.OPTIONS != webRequest.getHttpMethod()) {
                     list.add(new UpgradeInsecureRequestHeaderHttpRequestInterceptor("1"));
                 }
             }
diff --git a/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java b/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
@@ -17,6 +17,7 @@
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.htmlunit.BrowserVersionFeatures.XHR_HANDLE_SYNC_NETWORK_ERRORS;
 import static org.htmlunit.BrowserVersionFeatures.XHR_LOAD_ALWAYS_AFTER_DONE;
+import static org.htmlunit.BrowserVersionFeatures.XHR_PREFLIGHT_CORS;
 import static org.htmlunit.BrowserVersionFeatures.XHR_RESPONSE_TEXT_EMPTY_UNSENT;
 import static org.htmlunit.BrowserVersionFeatures.XHR_SEND_NETWORK_ERROR_IF_ABORTED;
 
@@ -942,7 +943,9 @@ else if (content instanceof Blob blob) {
      * Performs the actual send operation.
      */
     void doSend() {
-        final WebClient wc = getWindow().getWebWindow().getWebClient();
+        final Window window = getWindow();
+        final WebWindow webWindow = window.getWebWindow();
+        final WebClient wc = webWindow.getWebClient();
 
         // accessing to local resource is forbidden for security reason
         if (!wc.getOptions().isFileProtocolForXMLHttpRequestsAllowed()
@@ -960,7 +963,7 @@ void doSend() {
             }
             else {
                 throw JavaScriptEngine.asJavaScriptException(
-                        getWindow(),
+                        window,
                         "Not allowed to load local resource: " + webRequest_.getUrl(),
                         DOMException.NETWORK_ERR);
             }
@@ -970,6 +973,7 @@ void doSend() {
         try {
             if (!isSameOrigin_ && isPreflight()) {
                 final WebRequest preflightRequest = new WebRequest(webRequest_.getUrl(), HttpMethod.OPTIONS);
+                preflightRequest.setEncodingType(null);
 
                 // preflight request shouldn't have cookies
                 preflightRequest.addHint(HttpHint.BlockCookies);
@@ -1001,6 +1005,14 @@ void doSend() {
                     preflightRequest.setTimeout(timeout_);
                 }
 
+                if (getBrowserVersion().hasFeature(XHR_PREFLIGHT_CORS)) {
+                    // preflightRequest.setFetchModeOverride(FetchMode.CORS);
+                    preflightRequest.setAdditionalHeader(HttpHeader.SEC_FETCH_MODE, "cors");
+                }
+
+                final HtmlPage containingPage = (HtmlPage) webWindow.getEnclosedPage();
+                preflightRequest.setRefererHeader(containingPage.getUrl());
+
                 // do the preflight request
                 final WebResponse preflightResponse = wc.loadWebResponse(preflightRequest);
                 if (!preflightResponse.isSuccessOrUseProxyOrNotModified()
@@ -1016,7 +1028,7 @@ void doSend() {
                         LOG.debug("No permitted request for URL " + webRequest_.getUrl());
                     }
                     throw JavaScriptEngine.asJavaScriptException(
-                            getWindow(),
+                            window,
                             "No permitted \"Access-Control-Allow-Origin\" header.",
                             DOMException.NETWORK_ERR);
                 }
@@ -1139,7 +1151,7 @@ public Charset getContentCharset() {
                     fireJavascriptEvent(Event.TYPE_LOAD_END);
                 }
 
-                throw JavaScriptEngine.asJavaScriptException(getWindow(),
+                throw JavaScriptEngine.asJavaScriptException(window,
                         e.getMessage(), DOMException.NETWORK_ERR);
             }
         }
diff --git a/src/test/java/org/htmlunit/HttpWebConnection3Test.java b/src/test/java/org/htmlunit/HttpWebConnection3Test.java
@@ -3196,6 +3196,183 @@ public void xmlHttpRequestGet() throws Exception {
         }
     }
 
+    /**
+     * Tests the CORS preflight (OPTIONS) request triggered by a cross-origin XHR using a
+     * non-simple method (PUT) and a custom header. This is a structurally distinct request
+     * category from anything else in this file - no payload, Access-Control-Request-Method/
+     * Access-Control-Request-Headers instead of a body - and it's not yet known whether
+     * Sec-Fetch-* headers even apply to the preflight itself as opposed to only the actual
+     * follow-up request.
+     * <p>
+     * NOTE: needs two concurrent {@link PrimitiveWebServer} instances (one per origin), same
+     * as {@link #redirectToCrossSiteHost()} - unverified whether the constructor used here
+     * actually supports that; double check before relying on it.
+     *
+     * @throws Exception if the test fails
+     */
+    @Test
+    @Alerts(CHROME = {"OPTIONS /target HTTP/1.1",
+                      "Host: host1.htmlunit-dev.org:§§PORT§§",
+                      "Connection: keep-alive",
+                      "Accept: */*",
+                      "Access-Control-Request-Method: PUT",
+                      "Access-Control-Request-Headers: x-custom",
+                      "Origin: http://localhost:22225",
+                      "User-Agent: §§USER_AGENT§§",
+                      "Sec-Fetch-Mode: cors",
+                      "Referer: http://localhost:22225/",
+                      "Accept-Encoding: gzip, deflate",
+                      "Accept-Language: en-US,en;q=0.9"},
+            EDGE = {"OPTIONS /target HTTP/1.1",
+                    "Host: host1.htmlunit-dev.org:§§PORT§§",
+                    "Connection: keep-alive",
+                    "Accept: */*",
+                    "Access-Control-Request-Method: PUT",
+                    "Access-Control-Request-Headers: x-custom",
+                    "Origin: http://localhost:22225",
+                    "User-Agent: §§USER_AGENT§§",
+                    "Sec-Fetch-Mode: cors",
+                    "Referer: http://localhost:22225/",
+                    "Accept-Encoding: gzip, deflate",
+                    "Accept-Language: en-US,en;q=0.9"},
+            FF = {"OPTIONS /target HTTP/1.1",
+                  "Host: host1.htmlunit-dev.org:§§PORT§§",
+                  "User-Agent: §§USER_AGENT§§",
+                  "Accept: */*",
+                  "Accept-Language: en-US,en;q=0.9",
+                  "Accept-Encoding: gzip, deflate",
+                  "Access-Control-Request-Method: PUT",
+                  "Access-Control-Request-Headers: x-custom",
+                  "Referer: http://localhost:22225/",
+                  "Origin: http://localhost:22225",
+                  "Connection: keep-alive",
+                  "Priority: u=4"},
+            FF_ESR = {"OPTIONS /target HTTP/1.1",
+                      "Host: host1.htmlunit-dev.org:§§PORT§§",
+                      "User-Agent: §§USER_AGENT§§",
+                      "Accept: */*",
+                      "Accept-Language: en-US,en;q=0.5",
+                      "Accept-Encoding: gzip, deflate",
+                      "Access-Control-Request-Method: PUT",
+                      "Access-Control-Request-Headers: x-custom",
+                      "Referer: http://localhost:22225/",
+                      "Origin: http://localhost:22225",
+                      "Connection: keep-alive",
+                      "Priority: u=4"})
+    @HtmlUnitNYI(
+            CHROME = {"OPTIONS /target HTTP/1.1",
+                      "Host: host1.htmlunit-dev.org:§§PORT§§",
+                      "Connection: keep-alive",
+                      "User-Agent: §§USER_AGENT§§",
+                      "Accept: */*",
+                      "Sec-Fetch-Mode: cors",
+                      "Referer: http://localhost:22225/",
+                      "Accept-Encoding: gzip, deflate",
+                      "Accept-Language: en-US,en;q=0.9",
+                      "Origin: http://localhost:22225",
+                      "Access-Control-Request-Method: PUT",
+                      "Access-Control-Request-Headers: x-custom",
+                      "Content-Length: 0"}, // wrong
+            EDGE = {"OPTIONS /target HTTP/1.1",
+                    "Host: host1.htmlunit-dev.org:§§PORT§§",
+                    "Connection: keep-alive",
+                    "User-Agent: §§USER_AGENT§§",
+                    "Accept: */*",
+                    "Sec-Fetch-Mode: cors",
+                    "Referer: http://localhost:22225/",
+                    "Accept-Encoding: gzip, deflate",
+                    "Accept-Language: en-US,en;q=0.9",
+                    "Origin: http://localhost:22225",
+                    "Access-Control-Request-Method: PUT",
+                    "Access-Control-Request-Headers: x-custom",
+                    "Content-Length: 0"}, // wrong
+            FF = {"OPTIONS /target HTTP/1.1",
+                  "Host: host1.htmlunit-dev.org:§§PORT§§",
+                  "User-Agent: §§USER_AGENT§§",
+                  "Accept: */*",
+                  "Accept-Language: en-US,en;q=0.9",
+                  "Accept-Encoding: gzip, deflate",
+                  "Connection: keep-alive",
+                  "Referer: http://localhost:22225/",
+                  "Priority: u=0, i",
+                  "Origin: http://localhost:22225",
+                  "Access-Control-Request-Method: PUT",
+                  "Access-Control-Request-Headers: x-custom",
+                  "Content-Length: 0"}, // wrong
+            FF_ESR = {"OPTIONS /target HTTP/1.1",
+                      "Host: host1.htmlunit-dev.org:§§PORT§§",
+                      "User-Agent: §§USER_AGENT§§",
+                      "Accept: */*",
+                      "Accept-Language: en-US,en;q=0.5",
+                      "Accept-Encoding: gzip, deflate",
+                      "Connection: keep-alive",
+                      "Referer: http://localhost:22225/",
+                      "Priority: u=0, i",
+                      "Origin: http://localhost:22225",
+                      "Access-Control-Request-Method: PUT",
+                      "Access-Control-Request-Headers: x-custom",
+                      "Content-Length: 0"}) // wrong
+    public void xmlHttpRequestPreflight() throws Exception {
+        final String preflightResponse = "HTTP/1.1 200 OK\r\n"
+                + "Content-Length: 0\r\n"
+                + "Access-Control-Allow-Origin: *\r\n"
+                + "Access-Control-Allow-Methods: PUT\r\n"
+                + "Access-Control-Allow-Headers: X-Custom\r\n"
+                + "Connection: close\r\n"
+                + "\r\n";
+        final String actualResponse = "HTTP/1.1 200 OK\r\n"
+                + "Content-Length: 2\r\n"
+                + "Content-Type: text/plain\r\n"
+                + "Access-Control-Allow-Origin: *\r\n"
+                + "Connection: close\r\n"
+                + "\r\n"
+                + "Hi";
+
+        shutDownAll();
+        try (PrimitiveWebServer crossServer = new PrimitiveWebServer(PORT_PROXY_SERVER,
+                                                null, preflightResponse, actualResponse, actualResponse)) {
+            final String html = DOCTYPE_HTML
+                    + "<html><head><script>\n"
+                    + "  function doXhr() {\n"
+                    + "    var x = new XMLHttpRequest();\n"
+                    + "    x.open('PUT', 'http://host1.htmlunit-dev.org:" + crossServer.getPort() + "/target', true);\n"
+                    + "    x.setRequestHeader('X-Custom', 'value');\n"
+                    + "    x.send('body');\n"
+                    + "  }\n"
+                    + "</script></head>\n"
+                    + "<body onload='doXhr()'></body></html>";
+            final String htmlResponse = "HTTP/1.1 200 OK\r\n"
+                    + "Content-Length: " + html.length() + "\r\n"
+                    + "Content-Type: text/html\r\n"
+                    + "Connection: close\r\n"
+                    + "\r\n"
+                    + html;
+
+            try (PrimitiveWebServer originServer = new PrimitiveWebServer(null, htmlResponse, htmlResponse)) {
+                final WebDriver driver = getWebDriver();
+
+                driver.get("http://localhost:" + originServer.getPort());
+
+                final long endTime = System.currentTimeMillis() + Duration.ofSeconds(4).toMillis();
+                while (crossServer.getRequests().size() < 2
+                            && System.currentTimeMillis() < endTime) {
+                    Thread.sleep(100);
+                }
+
+                if (crossServer.getRequests().size() < 2) {
+                    Assertions.fail("Still no request / request count:" + crossServer.getRequests().size());
+                }
+
+                final String[] expectedHeaders = getExpectedAlertsWithHtmlReplacement(crossServer);
+
+                // request 0 = the OPTIONS preflight
+                final String request = crossServer.getRequests().get(0);
+                final String[] headers = request.split("\\r\\n");
+                assertEquals(Arrays.asList(expectedHeaders).toString(), Arrays.asList(headers).toString());
+            }
+        }
+    }
+
     /**
      * Tests a form submitted purely by script ({@code form.submit()}), as opposed to via
      * a click on a submit control. Real browsers do not consider this a user-activated

Original file line number	Diff line number	Diff line change
`@@ -1116,7 +1116,8 @@ else if (HttpHeader.UPGRADE_INSECURE_REQUESTS.equals(header)) {`
`1116`	`1116`
`1117`	`1117`	`// Real browsers only send this for navigations (top-level, iframe, frame),`
`1118`	`1118`	`// never for subresource fetches (image/script/style/xhr/...).`
`1119`		`- else if (WebRequest.FetchMode.NAVIGATE.getValue().equals(secFetchMode)) {`
	`1119`	`+ else if (WebRequest.FetchMode.NAVIGATE.getValue().equals(secFetchMode)`
	`1120`	`+ && HttpMethod.OPTIONS != webRequest.getHttpMethod()) {`
`1120`	`1121`	`list.add(new UpgradeInsecureRequestHeaderHttpRequestInterceptor("1"));`
`1121`	`1122`	`}`
`1122`	`1123`	`}`