http.get does not complete in flutter web. (Works with android/mobile)

[pmah8]

I have some simple code to call this yahoo finance API:

`query = 'https://query1.finance.yahoo.com/v7/finance/quote?symbols=AAPL';

final http.Response response = await http.get(Uri.parse(query));

if (response.statusCode == 200) { // do stuff here }`

It works fine in android but when it is run in Flutter web (Chrome) it doesn't complete. After a few seconds I get a "XMLHttpRequest error" with no other details.

Here is the curl output

`$ curl -v "https://query1.finance.yahoo.com/v7/finance/quote?symbols=AAPL"

• Trying 69.147.80.15:443...
• TCP_NODELAY set
• Connected to query1.finance.yahoo.com (69.147.80.15) port 443 (#0)
• ALPN, offering h2
• ALPN, offering http/1.1
• successfully set certificate verify locations:
• CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
• TLSv1.3 (IN), TLS handshake, Certificate (11):
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
• TLSv1.3 (IN), TLS handshake, Finished (20):
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
• ALPN, server accepted to use h2
• Server certificate:
• subject: C=US; ST=California; L=Sunnyvale; O=Oath Inc; CN=*.yahoo.com
• start date: Jun 3 00:00:00 2021 GMT
• expire date: Jul 21 23:59:59 2021 GMT
• subjectAltName: host "query1.finance.yahoo.com" matched cert's "*.finance.yahoo.com"
• issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA
• SSL certificate verify ok.
• Using HTTP2, server supports multi-use
• Connection state changed (HTTP/2 confirmed)
• Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
• Using Stream ID: 1 (easy handle 0x561189de3e10)

  GET /v7/finance/quote?symbols=AAPL HTTP/2 Host: query1.finance.yahoo.com user-agent: curl/7.68.0 accept: /

• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• old SSL session ID is stale, removing
• Connection state changed (MAX_CONCURRENT_STREAMS == 100)! < HTTP/2 200 < content-type: application/json;charset=utf-8 < cache-control: public, max-age=1, stale-while-revalidate=9 < vary: Origin,Accept-Encoding < y-rid: 7046b05gcsp1d < x-yahoo-request-id: 7046b05gcsp1d < x-request-id: 592fa979-82ba-476b-a10d-f907e8665378 < content-length: 2183 < x-envoy-upstream-service-time: 8 < date: Sat, 19 Jun 2021 21:39:56 GMT < server: ATS < x-envoy-decorator-operation: finance-quote-api--mtls-production-gq1.finance-k8s.svc.yahoo.local:4080/ < age: 3 < strict-transport-security: max-age=15552000 < warning: 110 Response is stale < referrer-policy: no-referrer-when-downgrade < x-frame-options: SAMEORIGIN < expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" < x-xss-protection: 1; mode=block < x-content-type-options: nosniff < {"quoteResponse":{"result":[{"language":"en-US","region":"US","quoteType":"EQUITY","quoteSourceName":"Delayed Quote","triggerable":true,"currency":"USD","sharesOutstanding":16687599616,"bookValue":4.146,"fiftyDayAverage":127.190285,"fiftyDayAverageChange":3.269722,"fiftyDayAverageChangePercent":0.025707325,"twoHundredDayAverage":128.39493,"twoHundredDayAverageChange":2.0650787,"twoHundredDayAverageChangePercent":0.016083803,"marketCap":2177064370176,"forwardPE":24.385048,"priceToBook":31.466476,"sourceInterval":15,"exchangeDataDelayedBy":0,"averageAnalystRating":"2.0 - Buy","tradeable":false,"marketState":"CLOSED","postMarketChangePercent":-0.19930227,"postMarketTime":1624060795,"postMarketPrice":130.2,"postMarketChange":-0.26000977,"regularMarketChange":-1.3299866,"regularMarketTime":1624046402,"regularMarketPrice":130.46,"regularMarketDayHigh":131.51,"bid":130.18,"regularMarketDayRange":"130.25 - 131.51","regularMarketDayLow":130.25,"regularMarketVolume":108953309,"regularMarketPreviousClose":131.79,"ask":130.2,"bidSize":13,"askSize":9,"fullExchangeName":"NasdaqGS","financialCurrency":"USD","regularMarketOpen":130.71,"averageDailyVolume3Month":87864406,"averageDailyVolume10Day":79820437,"fiftyTwoWeekLowChange":42.67251,"fiftyTwoWeekLowChangePercent":0.48608866,"fiftyTwoWeekRange":"87.7875 - 145.09","fiftyTwoWeekHighChange":-14.62999,"dividendDate":1620864000,"regularMarketChangePercent":-1.0091711,"firstTradeDateMilliseconds":345479400000,"priceHint":2,"fiftyTwoWeekHighChangePercent":-0.10083389,"fiftyTwoWeekLow":87.7875,"fiftyTwoWeekHigh":145.09,"earningsTimestamp":1619627400,"earningsTimestampStart":1627469940,"earningsTimestampEnd":1627905600,"trailingAnnualDividendRate":0.82,"trailingPE":29.323446,"trailingAnnualDividendYield":0.0062220204,"epsTrailingTwelveMonths":4.449,"epsForward":5.35,"epsCurrentYear":5.19,"priceEpsCurrentYear":25.136803,"exchange":"NMS","shortName":"Apple Inc.","longName":"Apple Inc.","messageBoardId":"finmb_24937","exchangeTimezoneName":"America/New_York","exchangeTimezoneShortName":" Connection #0 to host query1.finance.yahoo.com left intact EDT","gmtOffSetMilliseconds":-14400000,"market":"us_market","esgPopulated":false,"displayName":"Apple","symbol":"AAPL"}],"error":null}}`

If I try with this endpoint:

query = 'https://jsonplaceholder.typicode.com/todos/1';

Here is the curl output:

`$ curl -v "https://jsonplaceholder.typicode.com/todos/1"

• Trying 104.21.49.88:443...
• TCP_NODELAY set
• Connected to jsonplaceholder.typicode.com (104.21.49.88) port 443 (#0)
• ALPN, offering h2
• ALPN, offering http/1.1
• successfully set certificate verify locations:
• CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
• TLSv1.3 (IN), TLS handshake, Certificate (11):
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
• TLSv1.3 (IN), TLS handshake, Finished (20):
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
• ALPN, server accepted to use h2
• Server certificate:
• subject: C=US; ST=CA; L=San Francisco; O=Cloudflare, Inc.; CN=sni.cloudflaressl.com
• start date: Jul 29 00:00:00 2020 GMT
• expire date: Jul 29 12:00:00 2021 GMT
• subjectAltName: host "jsonplaceholder.typicode.com" matched cert's "*.typicode.com"
• issuer: C=US; O=Cloudflare, Inc.; CN=Cloudflare Inc ECC CA-3
• SSL certificate verify ok.
• Using HTTP2, server supports multi-use
• Connection state changed (HTTP/2 confirmed)
• Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
• Using Stream ID: 1 (easy handle 0x564f23db9e10)

  GET /todos/1 HTTP/2 Host: jsonplaceholder.typicode.com user-agent: curl/7.68.0 accept: /

• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• old SSL session ID is stale, removing
• Connection state changed (MAX_CONCURRENT_STREAMS == 256)! < HTTP/2 200 < date: Sat, 19 Jun 2021 21:39:27 GMT < content-type: application/json; charset=utf-8 < content-length: 83 < x-powered-by: Express < x-ratelimit-limit: 1000 < x-ratelimit-remaining: 998 < x-ratelimit-reset: 1622159028 < vary: Origin, Accept-Encoding < access-control-allow-credentials: true < cache-control: max-age=43200 < pragma: no-cache < expires: -1 < x-content-type-options: nosniff < etag: W/"53-hfEnumeNh6YirfjyjaujcOPPT+s" < via: 1.1 vegur < cf-cache-status: HIT < age: 23576 < accept-ranges: bytes < cf-request-id: 0ac7cff3b60000f56dfaa2e000000001 < expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" < report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=234pK%2FpWwV1jUKqg5RzhntPzbnQiCl%2FEK8MNX%2BfDgyInR9ywb4xrVuW50khTLgQtOu38Nb3Jq40A28MuKqk1ZSBommcWbvqyN2J3J7vQRb42CVcWWSuueH13AeMwI6BDK6TODdurOkUSWw%3D%3D"}],"group":"cf-nel","max_age":604800} < nel: {"report_to":"cf-nel","max_age":604800} < server: cloudflare < cf-ray: 661fe8ff8952f56d-SEA < alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 < { "userId": 1, "id": 1, "title": "delectus aut autem", "completed": false
• Connection #0 to host jsonplaceholder.typicode.com left intact`

I get a response so it is something with the Yahoo API response. I don't know why it works on Android and not web though.

[pmah8]

Going to close this. Just another CORS case it seems. It works if I use the cors_anywhere proxy. I wasn't certain since I didn't get any details on the error message. I also didn't understand CORS enough to know that it doesn't apply to mobile which is why it worked there.