grpc-web, XhrClientConnection sets certain headers twice

[yiransheng]

XhrClientConnection's implementation may set these http headers twice:

• Content-Type
• X-User-Agent
• X-Grpc-Web

This is problematic, for instance, when running flutter web (in browser platform). I believe it is expected for grpc-web to have this header:

X-Grpc-Web: 1

However, if this is set twice via underlying XHttpRequest api (calling request.setRequestHeader('X-Grpc-Web', '1'); twice) would produce the following instead (in latest Chrome browser):

X-Grpc-Web: 1, 1

...thus breaking the protocol.

Repro steps

1. Initialize GrpcWebClientChannel client
2. Make any grpc-web api calls, leave CallOptions.metadata's Content-Type empty

Expected result: grpc-web requests successful

Actual result: indeterminate errors, usually timeout (in my case the api call was interpreted as a native grpc call by envoy proxy)

Details

The offending code:

1. grpc-dart/lib/src/client/transport/xhr_transport.dart

   Line 188 in cb1c0ea

   if (_getContentTypeHeader(metadata) == null) {

When content type metadata from CallOptions is null, XhrClientConnection will fill in some defaults.

2. sometime later:
   

   grpc-dart/lib/src/client/transport/xhr_transport.dart

   Line 169 in cb1c0ea

   for (final header in metadata.keys) {

It copies metadata into http request headers.

3. however, immediately after:
   

   grpc-dart/lib/src/client/transport/xhr_transport.dart

   Line 174 in cb1c0ea

   request.setRequestHeader('X-Grpc-Web', '1');

The same header is set again, introducing the erroneous header values described above.

Equivalent compiled javaScript code:

function setHeadersTwice() {
  const xhr = new XMLHttpRequest();
  xhr.open('POST', 'https://example.com');
  xhr.setRequestHeader('X-Grpc-Web', '1');
  xhr.setRequestHeader('X-Grpc-Web', '1');
  xhr.send();
}

Reference form MDN:

Each time you call setRequestHeader() after the first time you call it, the specified text is appended to the end of the existing header's content.

https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/setRequestHeader

[mraleph]

Duplicate of #380

[mraleph]

Thanks for the report.

We are going to revert offending change and publish a fixed version of the package, but most likely this is not going to happen earlier than next week.