Detect cross-origin visit request attempts #325
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The core
turbo.js
library does not permit cross-origin visit requests (i.e. a link that redirects to an external domain). These requests call the adapter methodvisitRequestFailedWithStatusCode(visit, statusCode)
for all platforms.To handle this in the browser adapter, non-HTTP status code failures update the
window.location
so the browser can handle the top-level redirect. The browser adapter does not actually know whether a cross-origin redirect was attempted, since the CORS policy restricts requests to thesame-origin
, but updating thewindow.location
directly bypasses needing this knowledge.The mobile adapters, however, can't just update the
window.location
— a new visit needs to be proposed so the native app can decide how to handle the external url request. This PR finds any potential cross-origin redirect locations when a visit request fails with a non-HTTP status code and proposes the external redirect location as a new visit.Fixes #320