Fuel: Fail to pass request header `Origin`

[leo7]

Issue Report

Description

• Set header Origin in request, but no value found on server-side
• Fuel version: 2.1.0

client
                .post(path = ENDPOINT_OAUTH, parameters = listOf("grant_type" to "client_credentials"))
                .authentication()
                .basic(username = apiUsername(), password = apiPassword())
                .header(Headers.CONTENT_TYPE, APPLICATION_FORM_URLENCODED)
                .header(Headers.ACCEPT, APPLICATION_JSON)
                .header("Origin", "http://xxx")

Expected behavior

http request header Origin should be passed

[SleeplessByte]

Are you certain it's not _sent_ and not just (lack of) CORS settings on the server?

[leo7]

Hi @SleeplessByte , thanks for your reply!
I have tested it:

• it works well when using curl, Postman or invoking from other services (like nodejs).
• I changed to allow "*" for "Access-Control-Allow-Origin" and "Access-Control-Allow-Headers", and this couldn't fix the issue - the header value origin can not be passed into server
• I am sure the Origin value has been sent to com.github.kittinunf.fuel.toolbox.HttpClient (debuging screenshot will be attached)
• I tested with with other dummy headers, all passed in. Looks like only "origin" doesn't work

[SleeplessByte]

Thank you very much! That is very helpful :)

[leo7]

cool thanks

[ryutoyasugi]

This article may be helpful
https://stackoverflow.com/questions/8335501/does-httpurlconnection-censor-some-headers-notably-origin

[SleeplessByte]

That is exactly what I expected.

This also means that _fuel_ can not fix this. But you can follow the steps to allow restricted headers. Thanks @ryutoyasugi .

[leo7]

Thanks guys! Yeah, a quick fix is System.setProperty("sun.net.http.allowRestrictedHeaders", "true"); or -Dsun.net.http.allowRestrictedHeaders=true

[kittinunf]

Is there anything from us (Fuel side) to help users? Should we create an FAQs or something?