fetch() ignores RequestInit.referrer

[jcayzac]

Version: Deno 1.43.2

Simple repro with the CLI:

Deno 1.43.2
exit using ctrl+d, ctrl+c, or close()
REPL is running with all permissions allowed.
To specify permissions, run `deno repl` with allow flags.
> void Deno.serve((req) => new Response(JSON.stringify([...req.headers], null, 2)))
Listening on http://localhost:8000/
undefined
> await (await fetch(`http://localhost:8000/`, { referrer: `http://localhost:8000/foo` })).json()
[
  [ "accept", "*/*" ],
  [ "accept-encoding", "gzip, br" ],
  [ "accept-language", "*" ],
  [ "host", "localhost:8000" ],
  [ "user-agent", "Deno/1.43.2" ]
]
>

Current Behavior

Although I passed a value for referrer, it was ignored and fetch() didn't set the referer header on the request.

Adding any value for referrerPolicy makes no difference.

Expected Behavior

I should be getting a referer header.

[jcayzac]

It seems something is missing around here, maybe? Request(input, init) never references the field.

deno/ext/fetch/23_request.js

Lines 395 to 409 in 19c0633

	// 33.
	if (init.headers || ObjectKeys(init).length > 0) {
	const headerList = headerListFromHeaders(this[_headers]);
	const headers = init.headers ?? ArrayPrototypeSlice(
	headerList,
	0,
	headerList.length,
	);
	if (headerList.length !== 0) {
	ArrayPrototypeSplice(headerList, 0, headerList.length);
	}
	fillHeaders(this[_headers], headers);
	}
	// 34.

The ObjectKeys(init).length > 0 test suggests someone intended on looking at the init object for other header-generating fields, but maybe forgot to do so later on.

[jcayzac]

The workaround for now is to use the referer request header, although it's forbidden even in WinterCG's spec for fetch() (and ignores any referrer policy, so you have to compute it manually):

> await (await fetch(`http://localhost:8000/`, { headers: { referer: `http://localhost:8000/foo` }})).json()
[
  [ "accept", "*/*" ],
  [ "accept-encoding", "gzip, br" ],
  [ "accept-language", "*" ],
  [ "host", "localhost:8000" ],
  [ "referer", "http://localhost:8000/foo" ],
  [ "user-agent", "Deno/1.43.2" ]
]

[bartlomieju]

CC @lucacasonato, I recall there's a reason for this but I can't recall what's the particular reason.