Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Dec 16, 2025

When forms redirect to external URLs without CORS headers, XMLHttpRequest.send() throws instead of gracefully degrading. This breaks legitimate use cases like redirecting to external authentication providers or payment gateways.

Changes:

  • Wrap request.send() calls in try-catch blocks to intercept CORS exceptions
  • Fall back to window.location.href redirect when AJAX fails
  • Handle both file upload and standard form submission paths
  • Introduce requestUrl variable to track the correct redirect target for GET (with query params) vs POST requests

Implementation:

try {
    request.send(parameters.join('&'));
} catch (e) {
    // CORS error - fall back to full page redirect
    window.location.href = requestUrl;
}

The change is transparent to same-origin requests while enabling external redirects that previously failed with console errors.


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

…tion

Co-authored-by: amitaibu <125707+amitaibu@users.noreply.github.com>
Copilot AI changed the title [WIP] Allow redirect to external sites if CORS isn't enabled Handle CORS errors in form submissions with fallback to full page redirect Dec 16, 2025
Copilot AI requested a review from amitaibu December 16, 2025 20:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants