Error 401 - Authorization header is not passed in the redirected url after upgrading Chrome to version 119 #1208

laurent-inqom · 2023-11-07T07:22:17Z

Describe your issue?

Authorization header disapear from request headers when using replace string http rules. We identified that this issue happens after Chrome upgrade from 118 to 119 version. The http 'replace string' rules are used to redirect from my dev server to my localhost. We found a workaround that is using edge, but someone in the team has edge on version 119 and has the problem with Authorization header disapearing.

Repro steps

Open the Requestly app.
Create redirect rule (with a replace string rule).
Use any http request with an authorization header that will trigger the replace string rule
The Authorization header has vanished (resulting in 401 error for us).

What Requestly tool were you using?

Extension
Desktop-App
Android SDK
Selenium

Your Environment

Chrome (version 119) on Windows

Requestly Version

23.10.22

Error screenshot###

Error case, executed on chrome v119.0.6045.106

Ok case, on Edge v116.0.1938.69

As you can see, the Authorization header is automatically removed on our error case, as opposed to the OK case where everything is working as intended. Both set of screens were taken on the same environment, with the only diference being the browsers and its version (both being chromium am I right ?)
Thanks in advance for reading and for any help :visage_légèrement_souriant: !

The text was updated successfully, but these errors were encountered:

RLSilveira · 2023-11-07T19:02:07Z

I have the same issue after upgrading Microsoft Edge to version 119.0.2151.44.

brunomendeslima · 2023-11-07T19:57:55Z

I'm experiencing this issue in Chrome Version 119.0.6045.106.

golfyos · 2023-11-08T06:11:03Z

I'm facing this issue as well after upgrading Chrome to the latest version (119.0.6045.105)

Authorization header is always missing.

I'm using Requestly via Chrome extension.

sachinjain024 · 2023-11-08T10:09:07Z

Thank you @laurent-inqom @golfyos @RLSilveira @golfyos for informing us about this issue. This looks like a recent change from the Chrome side.

We will follow up with the Chrome team about this. In the meantime, here is a work around :-

Create a new HTTP Rule
Select Modify HTTP Headers
Add Request Header - Authorization and value should be copied from your other API request
Save the Rule

I have created a SharedList for you here - https://app.requestly.io/rules#sharedList/1699438081127-Add-Authorization-to-localhost

I know it is not convenient (as it used to be earlier) but this should fix the issue for you temporarily.

sachinjain024 · 2023-11-08T10:13:29Z

We don't see anything suspicious in the Chrome 119 change log - https://developer.chrome.com/blog/new-in-devtools-119/ as well.

alphafast · 2023-11-08T11:26:46Z

FYI, I work around by install an older version. It works as normal (I install version 117.0.5938.89)

sagarsoni7 · 2023-11-08T12:27:02Z

Chrome Enterprise release notes mentions this

Remove Authorization header upon cross-origin redirect back to top

The Fetch standard has been updated to remove Authorization header on cross origin redirects. Chrome 119 implements this change to the specification. Prior to Chrome 119, when a cross origin redirect, such as from foo.test to bar.test, happened with an Authorization header, Chrome preserved the Authorization header and bar.test could receive the header. Starting Chrome 119, Chrome removes Authorization headers when cross origin redirects happen, meaning that bar.test no longer receives the Authorization header.

Chrome 119 on ChromeOS, Windows, Mac, Linux, Android

sachinjain024 · 2023-11-08T13:02:31Z

I have created a simple Loom Video describing the issue - https://www.loom.com/share/f3af3e10154a4c9dae296dd3b7b62ea1

Steps to reproduce

Install Requestly
Import - https://app.requestly.io/rules#sharedList/1699448492370-Echo-Headers-from-Redirected-request
Open API Client - https://app.requestly.io/api-client and Hit www.example.com

In Chrome v118 Authorization header is being passed while in Chrome v119 Authorization header is not passed.

sachinjain024 · 2023-11-08T13:20:38Z

Chrome Enterprise release notes mentions this

Remove Authorization header upon cross-origin redirect back to top
The Fetch standard has been updated to remove Authorization header on cross origin redirects. Chrome 119 implements this change to the specification. Prior to Chrome 119, when a cross origin redirect, such as from foo.test to bar.test, happened with an Authorization header, Chrome preserved the Authorization header and bar.test could receive the header. Starting Chrome 119, Chrome removes Authorization headers when cross origin redirects happen, meaning that bar.test no longer receives the Authorization header.
Chrome 119 on ChromeOS, Windows, Mac, Linux, Android

@sagarsoni7 In this case, this is by design. We should check with the Chrome Extension team on how to handle this.

PS - Initiated a conversation - https://groups.google.com/a/chromium.org/g/chromium-extensions/c/jdHOIfz-hfQ/m/Mrxip6NHAgAJ

masterminh219 · 2023-11-13T10:33:06Z

It seems that Firefox has the same behavior,

https://support.mozilla.org/pt-PT/questions/1405907

nodkrot · 2023-11-16T18:54:09Z

Same here, started happening like a week ago

* #1208 Relay auth header to redirected request * fix: init responseRuleHandler and removing temporary header * fix: compatibility check for auth header banner --------- Co-authored-by: Nafees Nehar <[email protected]>

Sheikh566 · 2023-12-11T14:04:07Z

Any idea when this fix will be live? @sachinjain024

nafees87n · 2023-12-11T14:08:16Z

Hey @Sheikh566
We have released a fix for this. We'll notify you once the new version is available in the chrome store.

This reverts commit 3516bb5.

nafees87n · 2024-01-04T15:28:10Z

🚀 We have released the fix in v24.1.3. Make sure to update the extension.

Sheikh566 · 2024-01-05T13:08:42Z

Using the latest version of Chrome, Firefox, and Requestly. But the header is still not forwarded.

golfyos · 2024-01-05T15:23:45Z

It's still not working. The header is not being forwarded as it was previously.

Chrome version: v120.0.6099.129 (Official Build) (arm64)
Requestly version: v24.1.3

nafees87n · 2024-01-05T15:38:55Z

Hi @Sheikh566 @golfyos
Do you still get 401 error? Can you please share the logs and rule you are using?

golfyos · 2024-01-06T08:36:59Z

@nafees87n

rule:

the request header when the rule is active

the partial request header when the rule is not active

response:

my server log:
UnauthorizedError: Authorization required in header payload.

nafees87n · 2024-01-07T13:19:52Z

@golfyos Can you please invoke the same fetch request (when the rule is active) once again after the page has loaded? I want to check if we have any race condition when the scripts are loaded and when the fetch request is fired.

golfyos · 2024-01-08T09:26:51Z

@nafees87n I've tried invoking the same fetch request after the page has loaded. Still not working

Postremus · 2024-01-24T10:00:54Z

@golfyos Any update? FTR. Authorization Header is still not forwarded.

sachinjain024 · 2024-01-24T12:22:21Z

Thanks, @Postremus, for bumping this up. We will investigate what could be happening here. Could you share a website where we can replicate this?

nafees87n · 2024-02-14T17:48:43Z

Hi
If anyone is available for a quick call to help us debug this issue, it would really help us in resolving it.
You can use this link to schedule a call with me. A debug build of the extension will be used in the call.
Thank you.

nafees87n · 2024-02-18T15:29:14Z

Thanks @Postremus and @Sheikh566 for joining the call. It helped us identify the issue. We wouldn't have been able to do it without your help.
It seems that Authorization header is not forward in case of XHR cross origin redirects as well. We will fix this in the next release.

Postremus · 2024-02-26T09:25:22Z

@nafees87n Any update on getting this fix released?

nafees87n · 2024-02-26T10:48:10Z

Hey @Postremus
Currently, we have our last release rolled out partially. Once that is released to 100% users, we plan to release this fix for all users by Friday.

gerardog · 2024-03-01T18:20:57Z

Awesome tool guys! please comment when this fix will be available! I am using the desktop version.

Postremus · 2024-03-07T06:52:15Z

Any updates? I am on version "24.2.17" of the chrome extension, still getting a 401.

nafees87n · 2024-03-07T18:34:48Z

Hey @Postremus
The fix will be released in v24.3.5
We'll notify once it is available in the chrome store

sachinjain024 · 2024-03-11T10:44:16Z

We have rolled out this in v24.3.5, which is at the 50% rollout stage. If no issues are reported further, we will make a 100% rollout by tomorrow.

totoberg123 · 2024-03-11T15:02:53Z

@nafees87n @sachinjain024 I am having the same issue on the Desktop App (Windows 11). I am logging traffic using the built-in proxy server. When using a Redirect or Modify URL Rule the 'Authorization' header is not being passed.

Edit:
I created an issue: requestly/requestly-desktop-app#71

Postremus · 2024-03-12T07:26:26Z

I can confirm I am no longer getting the 401 with v24.3.5

nafees87n · 2024-03-12T07:56:57Z

Thanks for the confirmation @Postremus . Glad to know that it works

sachinjain024 · 2024-03-15T00:45:39Z

This has been rolled out to 100% now.

sachinjain024 · 2024-03-15T00:47:20Z

@nafees87n @sachinjain024 I am having the same issue on the Desktop App (Windows 11). I am logging traffic using the built-in proxy server. When using a Redirect or Modify URL Rule the 'Authorization' header is not being passed.

Edit: I created an issue: requestly/requestly-desktop-app#71

Thanks for reporting this. We will pick this up soon in the upcoming week. cc @nsrCodes

sachinjain024 · 2024-03-20T08:01:34Z

Closing this issue as this has been rolled out completely. We will work on separate ticket for solving this in the desktop app.

vitolrosario · 2024-06-14T16:23:14Z

Hey, i started getting this issue a few weeks ago and recently discovered that the extension is the cause.

I'm runnng 126.0.6478.62 on chrome and 24.5.27 on requestly.

Weird thing is, it happens even if no rules are active, only by having the extension activated. if i deactivate it, it works.

nafees87n · 2024-06-14T17:21:38Z

Hey @vitolrosario
What error are you getting?

This issue is about authorization header not getting forwarded in case of cross-origin redirects using Requestly redirect rule. Feel free to open a new issue here if you are encountering any issue.

sachinjain024 assigned nafees87n Nov 8, 2023

sachinjain024 changed the title ~~Error 401 when upgrading Chrome to version 119~~ Error 401 - Authorization header is not passed in the redirected url after upgrading Chrome to version 119 Nov 8, 2023

sachinjain024 pinned this issue Nov 8, 2023

sachinjain024 added type: bug feat:redirect_rule browser_extension labels Nov 8, 2023

sachinjain024 assigned sachinjain024 and unassigned nafees87n Nov 8, 2023

sagarsoni7 mentioned this issue Nov 20, 2023

bug: Unable to use requestly rules in new google chrome browser version 119.x.x.x #1220

Closed

4 tasks

rohanmathur91 unpinned this issue Nov 30, 2023

sachinjain024 mentioned this issue Dec 4, 2023

Auth Header in Fetch Redirects (Chrome v119+) w3c/webextensions#502

Open

lazyvab added a commit that referenced this issue Dec 4, 2023

#1208 Relay auth header to redirected request

bc74d42

lazyvab mentioned this issue Dec 4, 2023

#1208 [RQ-1145] Relay auth header to redirected request #1253

Merged

8 tasks

sachinjain024 added the released label Dec 11, 2023

sachinjain024 mentioned this issue Dec 12, 2023

bug: X-Rq-Authorization was added to the request header for unknown reasons #1269

Closed

4 tasks

wrongsahil added a commit that referenced this issue Dec 12, 2023

Revert "#1208 [RQ-1145] Relay auth header to redirected request (#1253)"

671d0b7

This reverts commit 3516bb5.

nafees87n removed the released label Feb 18, 2024

nafees87n mentioned this issue Feb 19, 2024

[RQ-1327] fix: relay authorization header in case of cross origin XHR redirects #1432

Merged

8 tasks

totoberg123 mentioned this issue Mar 11, 2024

Authorization header is not passed with Redirect Request or Replace String requestly/requestly-desktop-app#71

Open

1 task

sachinjain024 closed this as completed Mar 20, 2024

sachinjain024 unpinned this issue Apr 3, 2024

Error 401 - Authorization header is not passed in the redirected url after upgrading Chrome to version 119 #1208

Error 401 - Authorization header is not passed in the redirected url after upgrading Chrome to version 119 #1208

Comments

laurent-inqom commented Nov 7, 2023 • edited

Describe your issue?

Repro steps

What Requestly tool were you using?

Your Environment

Requestly Version

Error screenshot###

Error case, executed on chrome v119.0.6045.106

Ok case, on Edge v116.0.1938.69

RLSilveira commented Nov 7, 2023

brunomendeslima commented Nov 7, 2023

golfyos commented Nov 8, 2023

sachinjain024 commented Nov 8, 2023

sachinjain024 commented Nov 8, 2023

alphafast commented Nov 8, 2023

sagarsoni7 commented Nov 8, 2023

sachinjain024 commented Nov 8, 2023

Steps to reproduce

sachinjain024 commented Nov 8, 2023 • edited

masterminh219 commented Nov 13, 2023

nodkrot commented Nov 16, 2023

Sheikh566 commented Dec 11, 2023

nafees87n commented Dec 11, 2023

nafees87n commented Jan 4, 2024

Sheikh566 commented Jan 5, 2024

golfyos commented Jan 5, 2024

nafees87n commented Jan 5, 2024

golfyos commented Jan 6, 2024

nafees87n commented Jan 7, 2024

golfyos commented Jan 8, 2024

Postremus commented Jan 24, 2024

sachinjain024 commented Jan 24, 2024

nafees87n commented Feb 14, 2024 • edited

nafees87n commented Feb 18, 2024

Postremus commented Feb 26, 2024

nafees87n commented Feb 26, 2024

gerardog commented Mar 1, 2024

Postremus commented Mar 7, 2024

nafees87n commented Mar 7, 2024

sachinjain024 commented Mar 11, 2024

totoberg123 commented Mar 11, 2024 • edited

Postremus commented Mar 12, 2024

nafees87n commented Mar 12, 2024

sachinjain024 commented Mar 15, 2024

sachinjain024 commented Mar 15, 2024

sachinjain024 commented Mar 20, 2024

vitolrosario commented Jun 14, 2024

nafees87n commented Jun 14, 2024

laurent-inqom commented Nov 7, 2023 •

edited

sachinjain024 commented Nov 8, 2023 •

edited

nafees87n commented Feb 14, 2024 •

edited

totoberg123 commented Mar 11, 2024 •

edited