PR updated, comments addressed

Same issue in 2.8

@kroshp All fixes will be merged up to all maintained branches after being merged into the lowest affected branch.

is there a way in JS to check whether a header can be accessed according to the CORS rules, to be able to fallback ? It would be great to avoid this configuration setting entirely, and just remove it from the display (or display it in a special way) when the token cannot be retrieved due to CORS restrictions

btw, a try/catch around the statement reading the header might be an acceptable way to implement the fallback if there is no better one.

I just tried to detect if we had access to these headers in CORS usingAccess-Control-Expose-Headers, but a security warning is still issued when accessing this header.

Please note that these are not exception but Browser security warnings. You can try/catch these warnings but they still appear in the console.

I'm not in favor of adding a new configuration, so this PR is stalled while we found something better :/

I'm a bit stuck with this here...
If anybody's got an idea on how to solve this problem without a config option, help is welcome :)

@romainneutron have to tried to ask on SO to get some help from the JS community ?

Could why just avoid checking the headers entirely (and therefore showing the profiler link) when the AJAX request is for another domain? As nice as it is to show a profiler link that's coming from another Symfony app on some other domain, I'm not sure it's necessary - I'd expect the profiler link only for AJAX requests that are coming fromthis application.

I like@weaverryan 's idea, WDYT?

@weaverryan But that would mean that AJAX requests to the same application but with another domain also wouldn't be displayed, right? If so this is a BC break to me as someone might already rely on it (you could serve your internal API with a different domain for whatever reason for example).

@weaverryan this would not be very convenient if you have an app hitting your API hosted on a different domain.
This is why we should first try to get input from the community of JS devs/browsers to know whether there is a way to know that we are allowed (or not allowed) to read a header. But@romainneutron has not replied to my question above

@romainneutron can you try usinggetAllResponseHeaders() which will give you all headers ? AFAIU, this should always be allowed by CORS (but giving you only the headers you are allowed to see). You could then check in this object whether there is the profiler header

@romainneutron I confirm you thatxhr.getAllResponseHeaders() does not trigger a security warning in chromium

though it returns a string representation of HTTP headers, so you will need to extract the header from it.

or simpler: use the regex only to know whether the Symfony headers are exposed, and then usegetResponseHeader to get their value when exposed (avoiding to parse headers manually)

@stof thanks for the hint! I'll try this asap

PR has been updated, ready for review

👍

Thank you@romainneutron.