[wasm] HttpResponseMessage.Headers is empty

[pavelsavara]

Failing unit test System.Net.Http.Functional.Tests.HttpClientHandler_RemoteServerTest.SendAsync_SendRequestUsingMethodToEchoServerWithContent_Success for POST Echo.ashx

Caused by lack of CORS on server side, fix in progress.

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Failing unit test System.Net.Http.Functional.Tests.HttpClientHandler_RemoteServerTest.SendAsync_SendRequestUsingMethodToEchoServerWithContent_Success for POST Echo.ashx

Author:	pavelsavara
Assignees:	-
Labels:	arch-wasm, area-System.Net.Http
Milestone:	-

[pavelsavara]

This is most likely caused by lack of Access-Control-Expose-Headers: *
See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers

Way to do this is add .WithExposedHeaders() to server startup.
See dotnet/xharness#624

[mdh1418]

What was the failure log? Do we have a specific determined set of header names that we can set Access-Control-Expose-Headers?
I noticed that * will only work for requests without credentials, would this negatively impact the requests with credentials?

[pavelsavara]

The list of specific header is dependent on the unit tests and the middleware. There could be many.
We could expose the list via CLI parameter, but this is localhost only, so security is not interesting here.

Credentials are not currently in scope for WASM as far as I could tell.

It may be more interesting for mobile unit tests which have different underlying http component.
Perhaps it doesn't send the Origin header and doesn't trigger CORS at all, as opposed to browser.

To make credentials work, you have to state host name explicitly and avoid AllowAnyOrigin AFAIK.
I would prefer to solve it in mobile related PR if necessary, not in this PR.

[pavelsavara]

The specific log is not interesting, it just throws exception when looking for response header.
For example here https://github.com/dotnet/runtime/pull/52923/files#diff-46af1cf2c6e9ba436654ffec5d624c82dbb101aaf4ddde3e7154025370a8f668R78