fix(telemetry-dashboard): accept Origin: null on login — no-referrer policy locked Chromium out (CG-16) - #1498
Open
colbymchenry wants to merge 1 commit into
Open
fix(telemetry-dashboard): accept Origin: null on login — no-referrer policy locked Chromium out (CG-16)#1498colbymchenry wants to merge 1 commit into
colbymchenry wants to merge 1 commit into
Conversation
…eferrer policy locked Chromium out (CG-16) The dashboard sends Referrer-Policy: no-referrer, and Chromium's behavior on a same-origin form submit from such a page is to send Origin: null. isSameOriginPost() fed "null" to new URL(), which throws → false → 400 "bad request" for every Chromium user typing the correct password. Treat a null Origin like an absent one: it is an unattributed origin, not a foreign one — curl (no Origin at all) was always allowed, the login POST carries no session to ride, and the password is the credential. Real foreign origins stay rejected. The regression net now posts the way Chromium actually does: the smoke-auth sign-in and logout carry Origin: null, and cross-origin logout gets its own rejection case (54 → 56 assertions). The suites missed this because every passing login came from curl or Node fetch — neither sends an Origin header — while render-check injects its cookie past the form. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Maintainer hit a plain 400 "bad request" submitting the correct password at stats.getcodegraph.com minutes after the cutover.
Root cause: the dashboard sends
Referrer-Policy: no-referreron every response, and Chromium's behavior on a same-origin form submit from such a page is to sendOrigin: null.isSameOriginPost()fed"null"tonew URL()→ throw → caught →false→ 400. Every Chromium-family browser was locked out of the login form.Why 231 assertions missed it: every passing login in the suites came from curl or Node
fetch— neither sends an Origin header — and render-check injects its session cookie past the form. No test submitted the real form from a real browser page.Fix: treat
Origin: nullas an unattributed origin (allow), same as the already-allowed absent header. The login POST carries no session to ride and the password is the credential; real foreign origins (https://evil.example) remain rejected — covered by tests. smoke-auth's sign-in and logout now post exactly as Chromium does (Origin: null), plus a new cross-origin logout rejection: 54 → 56 assertions, all green.Already deployed to production (dashboard version
5154a826) and verified live:Origin: null+ wrong password → 401, foreign origin → 400, browser login works.🤖 Generated with Claude Code