don't append empty origin (#3335)

lib/web/fetch/util.js

@@ -260,10 +260,13 @@ function appendRequestOriginHeader (request) {
  // TODO: implement "byte-serializing a request origin"
  let serializedOrigin = request.origin
 
- // "'client' is changed to an origin during fetching."
- // This doesn't happen in undici (in most cases) because undici, by default,
- // has no concept of origin.
- if (serializedOrigin === 'client') {
+ // - "'client' is changed to an origin during fetching."
+ // This doesn't happen in undici (in most cases) because undici, by default,
+ // has no concept of origin.
+ // - request.origin can also be set to request.client.origin (client being
+ // an environment settings object), which is undefined without using
+ // setGlobalOrigin.
+ if (serializedOrigin === 'client' || serializedOrigin === undefined) {
  return
  }
 

test/fetch/issue-3334.js

@@ -0,0 +1,27 @@
+'use strict'
+
+const { test } = require('node:test')
+const { tspl } = require('@matteo.collina/tspl')
+const { once } = require('node:events')
+const { createServer } = require('node:http')
+const { fetch } = require('../..')
+
+test('a non-empty origin is not appended (issue #3334)', async (t) => {
+ const { strictEqual } = tspl(t, { plan: 1 })
+ const origin = 'https://origin.example.com'
+
+ const server = createServer((req, res) => {
+ strictEqual(req.headers.origin, origin)
+ res.end()
+ }).listen(0)
+
+ t.after(server.close.bind(server))
+ await once(server, 'listening')
+
+ await fetch(`http://localhost:${server.address().port}`, {
+ headers: { origin },
+ body: '',
+ method: 'POST',
+ redirect: 'error'
+ })
+})