Navid EMAD 9b101a7009 websocket: send Origin header on upgrade requests ...

The WebSocket opening handshake must carry the document's origin in an
Origin header when initiated from a browser client (RFC 6455 §4.1), and
origin-checking endpoints (CSRF protection on WS servers) reject
upgrades that arrive without it. WebSocket.init already assembles extra
upgrade headers (Sec-WebSocket-Protocol, Cookie) but never added Origin.

Serialize the executing document's origin via URL.getOrigin next to the
existing header setup — "null" for opaque origins (about:blank, data:),
matching what Chrome sends. The TestWSServer captures the upgrade's
Origin header and exposes it via a new get-origin command; an
origin_on_upgrade fixture in websocket.html asserts the served page's
origin arrives on the upgrade.

Closes #2709

2026-06-12 00:27:25 +02:00

14 KiB

Raw Blame History

View Raw