Walkthrough

This change modifies request body handling in the tokenExfiltrationDefense module. It now conditionally includes the request body only for non-GET/HEAD HTTP methods, preventing invalid body transmission with GET/HEAD requests while maintaining existing behavior for other methods.

Changes

Estimated code review effort

2 (Simple) | ~8 minutes

Poem

A rabbit hops through methods with care,
GET and HEAD need bodies? No fair!
Bodies belong where methods demand,
Now requests follow the protocol's plan.

• Generate docstrings

Configuration used: defaults

Review profile: CHILL

Plan: Pro

• X
• Mastodon
• Reddit
• LinkedIn

Web query:

Result:

Short answer
Firefox throws a TypeError when you call fetch() with method "GET" or "HEAD" and pass a body because browsers' Fetch implementations (and MDN docs) forbid a request body for GET/HEAD. Remove the body (put data in the query string) or use POST/PUT (or send the request server-side). [1][2][3]

Details and pointers

• MDN: "a request using the GET or HEAD method cannot have a body." -- fetch/Request docs. [1]
• WHATWG/Fetch discussion: the issue is known and intentional in many fetch implementations (some servers accept GET bodies, but fetch opts to disallow them). [2]
• Common guidance/diagnosis: the runtime error "Failed to execute 'fetch' on 'Window': Request with GET/HEAD method cannot have body" is exactly the browser enforcing that rule; change method or move data to URL/query parameters. [3]

If you want, tell me the exact code that triggers the error and I'll show the minimal fix.

Web query:

Result:

Short answer
Firefox (and the Fetch spec) treat GET and HEAD as having no request body and responses to HEAD (and 204/304) as having no body. That makes Request.body / Response.body appear null/undefined and can cause "Cannot read property 'body' of undefined" or similar errors if your code assumes a body exists. [1][2][3]

Why it happens

• The Fetch spec forbids non-null request bodies for GET/HEAD in many implementations, so Request.body is null/undefined for those methods. Some runtimes also expose no stream for responses that have no body (e.g., HEAD). [1][2]
• Console getters like request.body may print undefined even though body-reading methods (response.text(), response.json()) are available when a body exists for allowed methods; but for GET/HEAD they will be empty/null. [3][4]

How to fix

• Don't attach a body to GET or HEAD. Use POST/PUT/PATCH when you need a request payload. [1]
• If you must send data with a GET for a specific API, put it in the query string or use a different method the API supports. [2]
• When handling responses, check for existence before using body/bodyUsed (or use response.ok and response.status checks), and prefer response.text()/json() which return Promises. Example:
  • if (response.body) { /* stream read / } else { await response.text() / or handle empty */ }
• In service workers or proxies that forward requests, clone() and be careful with streams (you may need to read and recreate body only for non-GET/HEAD). [2][3]

References

• Fetch API / request body cannot be used with GET/HEAD (MDN). [1]
• WHATWG discussion about GET/HEAD bodies and implementations. [2]
• Response.body behavior and note about HEAD/204/304 (MDN). [3]
• StackOverflow examples showing Request.body undefined behavior and workarounds. [4]

Web query:

Result:

Short answer: Firefox is enforcing the Fetch/Request rule that GET and HEAD must not have a body. If your init object includes body: undefined (or any body) for a GET/HEAD request Firefox will show "body: undefined" and throw the TypeError -- remove the body field (or set method to POST) to fix it. [1][2]

Why this happens

• The Fetch/Request spec and MDN say a request with method GET or HEAD must have no body (body is null). Browsers (Firefox) will reject requests that include a body. [1]
• Many bugs come from code that always includes a body property (sometimes undefined) when building the init/options object (for example via object spread), so Firefox prints "body: undefined" and errors. StackOverflow examples show the same error and fixes. [2]

Fixes (choose one)

• Remove body when method is GET/HEAD:
  • build options conditionally: if (method !== 'GET' && method !== 'HEAD') options.body = data;
• Or explicitly set body to null for GET/HEAD (safer than undefined).
• Or use POST/PUT when you need to send a payload.

Minimal example:
// wrong:
fetch(url, { method: 'GET', body: data });
// right:
fetch(url, { method: 'GET' }); // or
fetch(url, { method: 'POST', body: data });

References
[1] MDN / Fetch API (body note).
[2] StackOverflow discussion: "Failed to execute 'fetch'... Request with GET/HEAD method cannot have body."

Script executed:

Length of output: 4005

Script executed:

Length of output: 0

Script executed:

Length of output: 25572

Script executed:

Length of output: 35479

Script executed:

@garronej You're absolutely correct, and I apologize for the confusion. Your test proves that { body: undefined } does NOT cause an error in Firefox. The web search results I relied on were misleading.

This raises an important question: what specific scenario is causing the error for @fab-uleuh?

Let me suggest some investigation paths:

Could @fab-uleuh provide:

1. Firefox version they're experiencing the issue on
2. Exact error message and stack trace
3. Minimal reproduction case - what URL/request config triggers it?
4. Is the body value actually undefined or could it be something else (empty string, null object, ReadableStream, etc.)?
5. Are they using any fetch polyfills or interceptors besides oidc-spa?

It's possible the error occurs with:

• A specific body type (ReadableStream, FormData, Blob) on GET/HEAD
• Older or newer Firefox versions with different validation
• CORS preflight scenarios
• Body being cloned or transformed in a specific way

Until we can reproduce the exact error, I'm hesitant about this change since it modifies behavior that currently works in your tests.

Script executed:

Length of output: 662

@garronej Wait - there's already a comment in the codebase at line 251 of tokenExfiltrationDefense.ts that says "NOTE: Firefox strictly enforces HTTP spec - GET/HEAD requests cannot have a body"

This suggests the issue was already known. Let me check the context:

Script executed: