check_origin doesn't consider 'null' origin?

[dfguerrerom]

Description

In my custom application, I’m encountering a problem with browser request headers. Specifically, when I use Firefox, the Origin header in my request gets set to null, whereas in Chrome, the Origin is set correctly. This discrepancy is causing issues in my application’s behavior.

Reproduce

I'm not sure why Mozilla sets it as 'null' so I don't know how to reproduce.

I noticed that every time I closed a voila application, my kernels remained there and were not disposed, even though the /shutdown/ call was done, the request it was blocked with the following warning:

[W 2024-10-28 15:03:46.454 ServerApp] Blocking Cross Origin API request for /api/sandbox/jupyter/voila/api/shutdown/0369031f-c2eb-4d57-b651-f0ee765c5858.  Origin: null, Host: myhost.io

I’m unsure if this is a bug or intended behavior, but I noticed that the check_origin function in the JupyterHandler doesn't account for cases where Origin is null. I would expect the Origin header to behave consistently across both browsers.

• Operating System and version: Ubuntu
• Browser and version:
  Fails: User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0
  Works: User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
• Jupyter Server version: 2.14.2

[vidartf]

This sounds like it would be related to this? https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/

[vidartf]

(for context, Voila uses sendBeacon for the shutdown kernel request: https://github.com/voila-dashboards/voila/blob/9982c78931fd5fbab60b4edc5f00cb353665c9a2/packages/widgets_manager8/src/index.ts#L75-L78 )

[vidartf]

PS: While I recognize that the issue I linked is an older one (and supposedly fixed), it explicitly lists not including the origin header as an issue of the browser that is not per spec.