Internet Explorer 11 does not add the Origin header on a CORS request?

Question

My issue depends on a couple of assumptions I hold true.

Assumption nr 1: The Origin Header

The Origin header is required by the browser to be put on a CORS (Cross Origin Resource Sharing) request.

Wikipedia:

To initiate a cross-origin request, a browser sends the request with an Origin HTTP header.

HTML5 Rocks:

The first thing to note is that a valid CORS request always contains an Origin header. This Origin header is added by the browser, and can not be controlled by the user.

W3:

If the request URL origin is not same origin with the original URL origin, set source origin to a globally unique identifier [..].

Assumption nr 2: Internet Explorer 10+ support CORS

See caniuse.com and use google for a couple of hundreds more sources of different kinds claiming the support.

Assumption nr 3: Different ports is a different origin

Resources using different port numbers is considered to be of different origins:

Wikipedia

Two resources are considered to be of the same origin if and only if all these values are exactly the same. [..] Failure - Same protocol and host but different port.

Mozilla Developer Network

Two pages have the same origin if the protocol, port (if one is specified), and host are the same for both pages.

The problem:

Internet Explorer 11 does not send the Origin header when making a CORS request to the same domain "localhost" but using different ports (from 8411 to 8080). Opera, FireFox and Chrome do send the Origin header. Yet everybody keeps saying CORS is supported in Internet Explorer 10+?

Vittoria

I am facing similar issue. #24405205 Can someone help please. – Shackle

With IE's team now over here at SO, this really needs to be fixed. – Shipowner

Answer 1

Internet Explorer's definition of the "same origin" differs to the other browsers. See the IE Exceptions section of the MDN documentation on the same-origin policy:

Internet Explorer has two major exceptions when it comes to same origin policy:

• Trust Zones: if both domains are in highly trusted zone e.g, corporate domains, then the same origin limitations are not applied
• Port: IE doesn't include port into Same Origin components, therefore http://company.com:81/index.html and http://company.com/index.html are considered from same origin and no restrictions are applied.

Therefore if your cross-origin request occurs across different ports, or within one of IE's trusted zones, IE will not treat the request as cross-origin and will see no need to add the Origin: header.

Dibbuk

The one problem with your source is that it doesn't come from a Microsoft site. My findings on a Microsoft associated site said it was a bug that will possibly be "fixed". Strange. It might be that your source reflects subject views as someone has "concluded" that is must be in a particular way? – Vittoria

I was also a little confused about the words used by the Microsoft rep in your link. They referred to a "fix", but they also described the problem as "a long-standing interoperability difference with other browsers where we treat different ports as same-origin whereas other browsers treat them as cross-origin." The MDN documentation points out that this "interoperability difference" also applies to sites within trusted zones, which was the cause of the behaviour I experienced. – Dibbuk

They're referring to a 'fix' because IE currently doesn't adhere to the RFC6454 spec which says that the port (whether specified explicitly or implicitly) does form part of the Origin identity. The other problem that Microsoft has is that for a long time, Microsoft has considered Origins differently (i.e. not including ports). So if they 'fix' the behaviour to adhere to the spec, they'll break the code of anybody expecting the previous behaviour. (And then somebody will raise a bug about that... It's an age-old debate.) – Oligoclase

Answer 2

I just happened to stumble across a reported bug over at a Microsoft associated site that clearly describes my issue. Microsoft staff quickly concluded that:

There is insufficient information to reproduce the behavior you are observing.

Since their first comment and their first attempt (?), they have actually managed to run two different web servers on different ports and reproduced the problem. Latest comment from Microsoft says that they "consider targetting a fix in the future".

Vittoria