fix: Chrome browser console warning about unsafe header `access-control-expose-headers` when calling Cloud Function #2095

mortenmo · 2024-03-17T16:01:51Z

Pull Request

Report security issues confidentially.
Any contribution is under this license.
Link this pull request to an issue.

Issue

#2059

Closes: #2059

Approach

Based on https://trackjs.com/blog/refused-unsafe-header/

Chrome shows a console error when accessing a non-existant header. Checking if header is available before calling that method.

…o avoid Chrome console warning

parse-github-assistant · 2024-03-17T16:01:54Z

Thanks for opening this pull request!

parse-github-assistant · 2024-03-17T16:03:02Z

I will reformat the title to use the proper commit message syntax.

codecov · 2024-03-17T16:57:29Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (72bc9ac) to head (ac3e1dd).
Report is 11 commits behind head on alpha.

Additional details and impacted files

@@             Coverage Diff             @@
##            alpha     #2095      +/-   ##
===========================================
+ Coverage   99.98%   100.00%   +0.01%     
===========================================
  Files          61        64       +3     
  Lines        6185      6198      +13     
  Branches     1499      1503       +4     
===========================================
+ Hits         6184      6198      +14     
+ Misses          1         0       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

src/__tests__/test_helpers/mockXHR.js

src/RESTController.js

onpix · 2024-04-04T12:48:54Z

Looking forward to seeing this error fixed!

lortonx · 2024-04-04T13:23:07Z

bump

dplewis · 2024-04-11T12:43:55Z

@mortenmo any updates?

…iring it.

mortenmo · 2024-04-13T14:28:28Z

Thanks for the reminder it fell off my mind. Should be updated with your suggestions.

src/RESTController.js

Co-authored-by: Diamond Lewis <[email protected]> Signed-off-by: Manuel <[email protected]>

REPTILEHAUS · 2024-04-17T20:39:36Z

Really looking forward to this being merged

mtrezza

Is it possible to add a test for this change?

mortenmo · 2024-04-18T01:51:11Z

I wrote some tests. One mimicking the Chrome issue causing the log error. It fails if you revert RESTController and succeeds in this branch.

src/__tests__/RESTController-test.js

Signed-off-by: Manuel <[email protected]>

src/__tests__/RESTController-test.js

Signed-off-by: Manuel <[email protected]>

mtrezza

Looks good, waiting for CI to pass...

mtrezza · 2024-04-18T14:40:44Z

Could you just fix the lint errors?

mtrezza · 2024-04-19T19:25:26Z

There are still 2 open conversations, could you please reply there to see whether they can be closed?

mortenmo · 2024-04-22T19:32:32Z

There are still 2 open conversations, could you please reply there to see whether they can be closed?

Done

mtrezza · 2024-04-22T20:02:12Z

Thanks for closing the conversations.

# [5.1.0-alpha.5](5.1.0-alpha.4...5.1.0-alpha.5) (2024-04-22) ### Bug Fixes * Chrome browser console warning about unsafe header `access-control-expose-headers` when calling Cloud Function ([#2095](#2095)) ([7b73c03](7b73c03))

parseplatformorg · 2024-04-22T20:04:32Z

🎉 This change has been released in version 5.1.0-alpha.5

# [5.1.0-beta.1](5.0.0...5.1.0-beta.1) (2024-05-16) ### Bug Fixes * `Parse.GeoPoint.current` returns `undefined` ([#2127](#2127)) ([3860535](3860535)) * Chrome browser console warning about unsafe header `access-control-expose-headers` when calling Cloud Function ([#2095](#2095)) ([7b73c03](7b73c03)) * Live Query not working on Expo React Native ([#2109](#2109)) ([7a89665](7a89665)) * Local datastore throws error when `Parse.Query.notEqualTo` is set to `null` ([#2102](#2102)) ([6afd32a](6afd32a)) * Multiple object updates of nested keys overwrite each other ([#1451](#1451)) ([fa4341a](fa4341a)) * Pending updates to nested field causes `ParseObject.toJSON()` to return incorrect object ([#1453](#1453)) ([23cc573](23cc573)) * Remove circular dependencies ([#2125](#2125)) ([b415165](b415165)) ### Features * Add password validation for user with unverified email via `Parse.User.verifyPassword` using master key and option `ignoreEmailVerification: true` ([#2076](#2076)) ([b0adf7e](b0adf7e)) * Add support for setting `Parse.ACL` from json ([#2097](#2097)) ([72bc9ac](72bc9ac)) * Allow setting custom queue for handling offline operations via `Parse.EventuallyQueue` ([#2106](#2106)) ([f92e4d4](f92e4d4)) * Improve installation object `Parse.Installation.currentInstallation` to support web push notifications ([#2119](#2119)) ([4fc62ce](4fc62ce)) * Lazy load `Parse.CoreManager` controllers to add support for swappable `CryptoController`, `LocalDatastoreController`, `StorageController`, `WebSocketController`, `ParseLiveQuery` ([#2100](#2100)) ([fbd0ab1](fbd0ab1))

parseplatformorg · 2024-05-16T12:27:00Z

🎉 This change has been released in version 5.1.0-beta.1

# [5.1.0](5.0.0...5.1.0) (2024-05-16) ### Bug Fixes * `Parse.GeoPoint.current` returns `undefined` ([#2127](#2127)) ([3860535](3860535)) * Chrome browser console warning about unsafe header `access-control-expose-headers` when calling Cloud Function ([#2095](#2095)) ([7b73c03](7b73c03)) * Live Query not working on Expo React Native ([#2109](#2109)) ([7a89665](7a89665)) * Local datastore throws error when `Parse.Query.notEqualTo` is set to `null` ([#2102](#2102)) ([6afd32a](6afd32a)) * Multiple object updates of nested keys overwrite each other ([#1451](#1451)) ([fa4341a](fa4341a)) * Pending updates to nested field causes `ParseObject.toJSON()` to return incorrect object ([#1453](#1453)) ([23cc573](23cc573)) * Remove circular dependencies ([#2125](#2125)) ([b415165](b415165)) ### Features * Add password validation for user with unverified email via `Parse.User.verifyPassword` using master key and option `ignoreEmailVerification: true` ([#2076](#2076)) ([b0adf7e](b0adf7e)) * Add support for setting `Parse.ACL` from json ([#2097](#2097)) ([72bc9ac](72bc9ac)) * Allow setting custom queue for handling offline operations via `Parse.EventuallyQueue` ([#2106](#2106)) ([f92e4d4](f92e4d4)) * Improve installation object `Parse.Installation.currentInstallation` to support web push notifications ([#2119](#2119)) ([4fc62ce](4fc62ce)) * Lazy load `Parse.CoreManager` controllers to add support for swappable `CryptoController`, `LocalDatastoreController`, `StorageController`, `WebSocketController`, `ParseLiveQuery` ([#2100](#2100)) ([fbd0ab1](fbd0ab1))

parseplatformorg · 2024-05-16T13:23:52Z

🎉 This change has been released in version 5.1.0

check if header is available before calling xhr.getResponseHeader t…

0f5f317

…o avoid Chrome console warning

mortenmo changed the title ~~Fix: check if header is available before calling xhr.getResponseHeader to avoid Chrome console warning~~ fix: check if header is available before calling xhr.getResponseHeader to avoid Chrome console warning Mar 17, 2024

parse-github-assistant bot changed the title ~~fix: check if header is available before calling xhr.getResponseHeader to avoid Chrome console warning~~ fix: Check if header is available before calling xhr.getResponseHeader to avoid Chrome console warning Mar 17, 2024

Merge branch 'alpha' into fix-chrome-console-error

ac39725

mtrezza changed the title ~~fix: Check if header is available before calling xhr.getResponseHeader to avoid Chrome console warning~~ fix: Chrome console warning Refused to get unsafe header "access-control-expose-headers" when calling Cloud Function Mar 17, 2024

mtrezza reviewed Mar 17, 2024

View reviewed changes

src/__tests__/test_helpers/mockXHR.js Outdated Show resolved Hide resolved

dplewis suggested changes Mar 20, 2024

View reviewed changes

src/RESTController.js Outdated Show resolved Hide resolved

avoid requiring getAllResponseHeaders on xhr. Clean tests from requ…

7360318

…iring it.

mortenmo requested review from dplewis and mtrezza April 14, 2024 01:48

dplewis suggested changes Apr 14, 2024

View reviewed changes

src/RESTController.js Outdated Show resolved Hide resolved

mtrezza and others added 2 commits April 15, 2024 19:14

Merge branch 'alpha' into fix-chrome-console-error

4e01e58

Update RESTController.js

535e2f7

Co-authored-by: Diamond Lewis <[email protected]> Signed-off-by: Manuel <[email protected]>

mtrezza reviewed Apr 17, 2024

View reviewed changes

Test for Chrome issue

b27155b

mortenmo requested a review from mtrezza April 18, 2024 14:09

mtrezza requested changes Apr 18, 2024

View reviewed changes

src/__tests__/RESTController-test.js Outdated Show resolved Hide resolved

src/__tests__/RESTController-test.js Outdated Show resolved Hide resolved

mtrezza added 2 commits April 18, 2024 16:36

Update src/__tests__/RESTController-test.js

b777ded

Signed-off-by: Manuel <[email protected]>

Update src/__tests__/RESTController-test.js

50f087d

Signed-off-by: Manuel <[email protected]>

mtrezza requested changes Apr 18, 2024

View reviewed changes

src/__tests__/RESTController-test.js Outdated Show resolved Hide resolved

Update src/__tests__/RESTController-test.js

43dc7b9

Signed-off-by: Manuel <[email protected]>

mtrezza changed the title ~~fix: Chrome console warning Refused to get unsafe header "access-control-expose-headers" when calling Cloud Function~~ fix: Chrome console warning about unsafe header access-control-expose-headers when calling Cloud Function Apr 18, 2024

mtrezza approved these changes Apr 18, 2024

View reviewed changes

mtrezza changed the title ~~fix: Chrome console warning about unsafe header access-control-expose-headers when calling Cloud Function~~ fix: Chrome browser console warning about unsafe header access-control-expose-headers when calling Cloud Function Apr 18, 2024

Lint issues

ac3e1dd

mtrezza merged commit 7b73c03 into parse-community:alpha Apr 22, 2024

parseplatformorg added the state:released-alpha Released as alpha version label Apr 22, 2024

parseplatformorg added the state:released-beta Released as beta version label May 16, 2024

parseplatformorg added the state:released Released as stable version label May 16, 2024

parseplatformorg mentioned this pull request Jun 6, 2024

refactor: Upgrade parse from 5.0.0 to 5.1.0 parse-community/parse-server-push-adapter#252

Merged

Uh oh!

fix: Chrome browser console warning about unsafe header access-control-expose-headers when calling Cloud Function #2095

fix: Chrome browser console warning about unsafe header access-control-expose-headers when calling Cloud Function #2095

Uh oh!

Conversation

mortenmo commented Mar 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Issue

Approach

Uh oh!

parse-github-assistant bot commented Mar 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Thanks for opening this pull request!

Uh oh!

parse-github-assistant bot commented Mar 17, 2024

Uh oh!

codecov bot commented Mar 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

onpix commented Apr 4, 2024

Uh oh!

lortonx commented Apr 4, 2024

Uh oh!

dplewis commented Apr 11, 2024

Uh oh!

mortenmo commented Apr 13, 2024

Uh oh!

Uh oh!

REPTILEHAUS commented Apr 17, 2024

Uh oh!

mtrezza left a comment

Choose a reason for hiding this comment

Uh oh!

mortenmo commented Apr 18, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mtrezza left a comment

Choose a reason for hiding this comment

Uh oh!

mtrezza commented Apr 18, 2024

Uh oh!

mtrezza commented Apr 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mortenmo commented Apr 22, 2024

Uh oh!

mtrezza commented Apr 22, 2024

Uh oh!

parseplatformorg commented Apr 22, 2024

Uh oh!

parseplatformorg commented May 16, 2024

Uh oh!

parseplatformorg commented May 16, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

fix: Chrome browser console warning about unsafe header `access-control-expose-headers` when calling Cloud Function #2095

fix: Chrome browser console warning about unsafe header `access-control-expose-headers` when calling Cloud Function #2095

mortenmo commented Mar 17, 2024 •

edited

Loading

parse-github-assistant bot commented Mar 17, 2024 •

edited

Loading

codecov bot commented Mar 17, 2024 •

edited

Loading

mtrezza commented Apr 19, 2024 •

edited

Loading