Tampermonkey / tampermonkey

Tampermonkey is the most popular userscript manager, with over 10 million users. It's available for Chrome, Microsoft Edge, Safari, Opera Next, and Firefox.
GNU General Public License v3.0
4.32k stars 426 forks source link

The Referer header is not preserved when a GM_xmlhttpRequest request is redirected #2179

Closed techmovie closed 1 month ago

techmovie commented 1 month ago

Expected Behavior

Referer header is preserved when a GM_xmlhttpRequest request is redirected

Actual Behavior

The Referer header is not preserved when a GM_xmlhttpRequest request is redirected.

Specifications

Script

// ==UserScript==
// @name referer header issue
// @version 1.0
// @description try to take over the world!
// @author Me
// @include *
// @grant GM_xmlhttpRequest
// ==/UserScript==

const fetch = (url, options) => {
  return new Promise((resolve, reject) => {
    GM_xmlhttpRequest({
      method: 'GET',
      url,
      responseType: 'json',
      ...options,
      onload: (res) => {
        const { statusText, status, response } = res;
        if (status !== 200) {
          reject(new Error(statusText || `${status}`));
        } else {
          resolve(response);
        }
      },
      ontimeout: () => {
        reject(new Error('timeout'));
      },
      onerror: (error) => {
        reject(error);
      },

    });
  });
};

const url = 'https://m.douban.com/rexxar/api/v2/movie/36205404/?for_mobile=1';
const options = {
    headers: {
        Referer: 'https://m.douban.com/movie/subject/36205404',
    },
};

fetch(url, options).then((res) => {
    console.log(res);
}).catch((error) => {
    console.error(error);
});
derjanb commented 1 month ago

At the moment I think that this is a Chrome bug. Will add a workaround though.

derjanb commented 1 month ago

Should be fixed at 5.3.6212 (crx|xpi in review)

Please download the crx file linked above and drag and drop it to the extensions page chrome://extensions (after you've enabled 'Developer Mode').

For a quick fix please export your settings and scripts as zip or (JSON) file at the "Utilities" tab and import it back at the fixed BETA version.