Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(service-worker): only consider GET requests as navigation requests #47263

Closed
wants to merge 1 commit into from

Conversation

gkalpak
Copy link
Member

@gkalpak gkalpak commented Aug 25, 2022

Previously, the criteria for determining if a request was a navigation request did not account for the request method. This incorrectly identified HTML form submit POST requests as navigation requests and served index.html instead of passing them through to the server, thus breaking the form submission.

This commit fixes this by ensuring that only GET requests are considered navigation requests.

Note
HTML forms with their method set to GET will still be affected by the issue. This is not a big concern, because using GET for form submission is quite uncommon and generally discouraged (due to limitations and security considerations).

Fixes #36368.

Previously, the criteria for determining if a request was a
[navigation request][1] did not account for the request method. This
incorrectly identified HTML form submit POST requests as navigation
requests and served `index.html` instead of passing them through to the
server, thus breaking the form submission.

This commit fixes this by ensuring that only GET requests are considered
navigation requests.

> **Note**
> HTML forms with their method set to `GET` will still be affected by
> the issue. This is not a big concern, because using `GET` for form
> submission is quite uncommon and generally discouraged (due to
> limitations and security considerations).

[1]: https://angular.io/guide/service-worker-config#handling-navigation-requests

Fixes angular#36368
@gkalpak gkalpak added type: bug/fix action: review The PR is still awaiting reviews from at least one requested reviewer target: patch This PR is targeted for the next patch release area: service-worker Issues related to the @angular/service-worker package labels Aug 25, 2022
@ngbot ngbot bot modified the milestone: Backlog Aug 25, 2022
@gkalpak gkalpak requested a review from alxhub August 25, 2022 19:55
@gkalpak gkalpak marked this pull request as ready for review August 25, 2022 19:55
@mary-poppins
Copy link

You can preview ac023f7 at https://pr47263-ac023f7.ngbuilds.io/.

Copy link
Member

@josephperrott josephperrott left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@gkalpak gkalpak removed the request for review from alxhub August 26, 2022 18:15
@gkalpak gkalpak added action: merge The PR is ready for merge by the caretaker and removed action: review The PR is still awaiting reviews from at least one requested reviewer labels Aug 26, 2022
@AndrewKushnir
Copy link
Contributor

This PR was merged into the repository by commit a0c3326.

AndrewKushnir pushed a commit that referenced this pull request Sep 6, 2022
#47263)

Previously, the criteria for determining if a request was a
[navigation request][1] did not account for the request method. This
incorrectly identified HTML form submit POST requests as navigation
requests and served `index.html` instead of passing them through to the
server, thus breaking the form submission.

This commit fixes this by ensuring that only GET requests are considered
navigation requests.

> **Note**
> HTML forms with their method set to `GET` will still be affected by
> the issue. This is not a big concern, because using `GET` for form
> submission is quite uncommon and generally discouraged (due to
> limitations and security considerations).

[1]: https://angular.io/guide/service-worker-config#handling-navigation-requests

Fixes #36368

PR Close #47263
@gkalpak gkalpak deleted the fix-sw-navigation-get branch September 6, 2022 19:08
sbrshkappa pushed a commit to sbrshkappa/angular that referenced this pull request Sep 8, 2022
angular#47263)

Previously, the criteria for determining if a request was a
[navigation request][1] did not account for the request method. This
incorrectly identified HTML form submit POST requests as navigation
requests and served `index.html` instead of passing them through to the
server, thus breaking the form submission.

This commit fixes this by ensuring that only GET requests are considered
navigation requests.

> **Note**
> HTML forms with their method set to `GET` will still be affected by
> the issue. This is not a big concern, because using `GET` for form
> submission is quite uncommon and generally discouraged (due to
> limitations and security considerations).

[1]: https://angular.io/guide/service-worker-config#handling-navigation-requests

Fixes angular#36368

PR Close angular#47263
crapStone pushed a commit to Calciumdibromid/CaBr2 that referenced this pull request Sep 11, 2022
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@angular/animations](https://github.com/angular/angular) | dependencies | patch | [`14.2.0` -> `14.2.1`](https://renovatebot.com/diffs/npm/@angular%2fanimations/14.2.0/14.2.1) |
| [@angular/common](https://github.com/angular/angular) | dependencies | patch | [`14.2.0` -> `14.2.1`](https://renovatebot.com/diffs/npm/@angular%2fcommon/14.2.0/14.2.1) |
| [@angular/compiler](https://github.com/angular/angular) | dependencies | patch | [`14.2.0` -> `14.2.1`](https://renovatebot.com/diffs/npm/@angular%2fcompiler/14.2.0/14.2.1) |
| [@angular/compiler-cli](https://github.com/angular/angular/tree/main/packages/compiler-cli) ([source](https://github.com/angular/angular)) | devDependencies | patch | [`14.2.0` -> `14.2.1`](https://renovatebot.com/diffs/npm/@angular%2fcompiler-cli/14.2.0/14.2.1) |
| [@angular/core](https://github.com/angular/angular) | dependencies | patch | [`14.2.0` -> `14.2.1`](https://renovatebot.com/diffs/npm/@angular%2fcore/14.2.0/14.2.1) |
| [@angular/forms](https://github.com/angular/angular) | dependencies | patch | [`14.2.0` -> `14.2.1`](https://renovatebot.com/diffs/npm/@angular%2fforms/14.2.0/14.2.1) |
| [@angular/platform-browser](https://github.com/angular/angular) | dependencies | patch | [`14.2.0` -> `14.2.1`](https://renovatebot.com/diffs/npm/@angular%2fplatform-browser/14.2.0/14.2.1) |
| [@angular/platform-browser-dynamic](https://github.com/angular/angular) | dependencies | patch | [`14.2.0` -> `14.2.1`](https://renovatebot.com/diffs/npm/@angular%2fplatform-browser-dynamic/14.2.0/14.2.1) |

---

### Release Notes

<details>
<summary>angular/angular</summary>

### [`v14.2.1`](https://github.com/angular/angular/blob/HEAD/CHANGELOG.md#&#8203;1421-2022-09-07)

[Compare Source](angular/angular@14.2.0...14.2.1)

##### common

| Commit | Type | Description |
| -- | -- | -- |
| [c0d7ac9ec2](angular/angular@c0d7ac9) | fix | improve formatting of image warnings ([#&#8203;47299](angular/angular#47299)) |
| [1875ce520a](angular/angular@1875ce5) | fix | use DOCUMENT token to query for preconnect links ([#&#8203;47353](angular/angular#47353)) |

##### compiler

| Commit | Type | Description |
| -- | -- | -- |
| [0e35829580](angular/angular@0e35829) | fix | avoid errors for inputs with Object-builtin names ([#&#8203;47220](angular/angular#47220)) |

##### service-worker

| Commit | Type | Description |
| -- | -- | -- |
| [6091786696](angular/angular@6091786) | fix | include headers in requests for assets ([#&#8203;47260](angular/angular#47260)) |
| [28d33505fd](angular/angular@28d3350) | fix | only consider GET requests as navigation requests ([#&#8203;47263](angular/angular#47263)) |

#### Special Thanks

Aristeidis Bampakos, Asaf M, Bingo's Code, Bob Watson, Daniel Ostrovsky, George Kalpakas, Giovanni Alberto Rivas, Jeremy Elbourn, Jobayer Hossain, Joe Martin (Crowdstaffing), Joey Perrott, JoostK, Kara Erickson, Kristiyan Kostadinov, Maina Wycliffe, Sabareesh Kappagantu, Simona Cotin, Sonu Sindhu, Yann Provoost, abergquist, jaybell and vyom1611

<!-- CHANGELOG SPLIT MARKER -->

##### router

| Commit | Type | Description |
| -- | -- | -- |
| [5163e3d876](angular/angular@5163e3d) | feat | Add UrlTree constructor to public API ([#&#8203;47186](angular/angular#47186)) |

#### Special Thanks

Alan Agius, Alex Rickabaugh, Andrew Scott, Joey Perrott, Kara Erickson, Kristiyan Kostadinov and Pawel Kozlowski

<!-- CHANGELOG SPLIT MARKER -->

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzMi4xOTIuMyIsInVwZGF0ZWRJblZlciI6IjMyLjE5Mi4zIn0=-->

Co-authored-by: cabr2-bot <cabr2.help@gmail.com>
Reviewed-on: https://codeberg.org/Calciumdibromid/CaBr2/pulls/1538
Reviewed-by: Epsilon_02 <epsilon_02@noreply.codeberg.org>
Co-authored-by: Calciumdibromid Bot <cabr2_bot@noreply.codeberg.org>
Co-committed-by: Calciumdibromid Bot <cabr2_bot@noreply.codeberg.org>
@angular-automatic-lock-bot
Copy link

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot bot locked and limited conversation to collaborators Oct 7, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
action: merge The PR is ready for merge by the caretaker area: service-worker Issues related to the @angular/service-worker package target: patch This PR is targeted for the next patch release type: bug/fix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Angular Service Worker breaks HTML forms POST submit
4 participants