don't append empty origin (#3335)

KhafraDev · web-flow · commit 1573f693db99 · 2024-06-17T20:43:02.000+02:00
diff --git a/lib/web/fetch/util.js b/lib/web/fetch/util.js
@@ -260,10 +260,13 @@ function appendRequestOriginHeader (request) {
   // TODO: implement "byte-serializing a request origin"
   let serializedOrigin = request.origin
 
-  // "'client' is changed to an origin during fetching."
-  // This doesn't happen in undici (in most cases) because undici, by default,
-  // has no concept of origin.
-  if (serializedOrigin === 'client') {
+  // - "'client' is changed to an origin during fetching."
+  //   This doesn't happen in undici (in most cases) because undici, by default,
+  //   has no concept of origin.
+  // - request.origin can also be set to request.client.origin (client being
+  //   an environment settings object), which is undefined without using
+  //   setGlobalOrigin.
+  if (serializedOrigin === 'client' || serializedOrigin === undefined) {
     return
   }
 
diff --git a/test/fetch/issue-3334.js b/test/fetch/issue-3334.js
@@ -0,0 +1,27 @@
+'use strict'
+
+const { test } = require('node:test')
+const { tspl } = require('@matteo.collina/tspl')
+const { once } = require('node:events')
+const { createServer } = require('node:http')
+const { fetch } = require('../..')
+
+test('a non-empty origin is not appended (issue #3334)', async (t) => {
+  const { strictEqual } = tspl(t, { plan: 1 })
+  const origin = 'https://origin.example.com'
+
+  const server = createServer((req, res) => {
+    strictEqual(req.headers.origin, origin)
+    res.end()
+  }).listen(0)
+
+  t.after(server.close.bind(server))
+  await once(server, 'listening')
+
+  await fetch(`http://localhost:${server.address().port}`, {
+    headers: { origin },
+    body: '',
+    method: 'POST',
+    redirect: 'error'
+  })
+})
