diff --git a/.changeset/forty-crabs-hang.md b/.changeset/forty-crabs-hang.md new file mode 100644 index 000000000000..55204a1ada41 --- /dev/null +++ b/.changeset/forty-crabs-hang.md @@ -0,0 +1,5 @@ +--- +'@sveltejs/kit': patch +--- + +fix: avoid simulated CORS errors with non-HTTP URLs diff --git a/packages/kit/src/runtime/server/page/load_data.js b/packages/kit/src/runtime/server/page/load_data.js index 42446393ad83..313dac721ed0 100644 --- a/packages/kit/src/runtime/server/page/load_data.js +++ b/packages/kit/src/runtime/server/page/load_data.js @@ -242,7 +242,7 @@ export function create_universal_fetch(event, state, fetched, csr, resolve_opts) dependency = { response, body: null }; state.prerendering.dependencies.set(url.pathname, dependency); } - } else { + } else if (url.protocol === 'https:' || url.protocol === 'http:') { // simulate CORS errors and "no access to body in no-cors mode" server-side for consistency with client-side behaviour const mode = input instanceof Request ? input.mode : (init?.mode ?? 'cors'); if (mode === 'no-cors') { diff --git a/packages/kit/src/runtime/server/page/load_data.spec.js b/packages/kit/src/runtime/server/page/load_data.spec.js index da5cc0b17203..dddddc2aaf0e 100644 --- a/packages/kit/src/runtime/server/page/load_data.spec.js +++ b/packages/kit/src/runtime/server/page/load_data.spec.js @@ -58,6 +58,13 @@ test('errors when no acao header present on cors', async () => { ); }); +test('succeeds when fetching from local scheme', async () => { + const fetch = create_fetch({}); + const response = await fetch('data:text/plain;foo'); + const text = await response.text(); + assert.equal(text, 'foo'); +}); + test('errors when trying to access non-serialized request headers on the server', async () => { const fetch = create_fetch({}); const response = await fetch('https://domain-a.com');