Allow redirect to external sites if CORS isn't enabled

[amitaibu]

fixes #1889

[mpscholten]

This won't work for forms that are submitted via POST. I don't think this can be really fixed at all except by disabling the JS form submission in those forms

[amitaibu]

Ok, I'll share my example code soon to show my use case

[amitaibu]

Here's the example: amitaibu/ihp-cms-starter#35

If you navigate to http://localhost:8000 without the PR it will result with console error. With the PR you'll be redirected to the repo of one of the best Haskell frameworks! 😄

[amitaibu]

@mpscholten ^^

[amitaibu]

@copilot can you resolve conflicts with master?

[Copilot]

@amitaibu I've opened a new pull request, #2196, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

Pull request overview

This PR attempts to fix issue #1889 by allowing form submissions to redirect to external sites when CORS is not enabled. The implementation adds a try-catch block around the request.send() call to catch potential exceptions and fallback to a standard page redirect.

Key Changes:

• Wraps request.send() in a try-catch block to handle potential errors
• Falls back to window.location.href redirect if an exception is caught

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The variable url is only defined in the GET method branch (line 279), but this catch block can be reached in both GET and POST cases. For POST requests, url will be undefined, causing a potential error. Use formAction instead, which is available in both branches.

Suggested change

	window.location.href = url;
	window.location.href = formAction;

[Copilot]

XMLHttpRequest.send() typically does not throw exceptions for CORS errors. CORS failures are asynchronous and trigger the 'onerror' event handler instead. The try-catch block may not catch CORS-related issues as intended. Consider adding a request.onerror handler or a timeout mechanism to detect when AJAX submission fails and fallback to a regular form submission.

Suggested change

	try {
	request.send(parameters.join('&'));
	} catch (e) {
	// If the send method throws an exception, redirect to the form action URL.
	// This can happen for example if redirecting to an external site, which doesn't have CORS enabled,
	// so we can't use Ajax.
	window.location.href = url;
	// Fallback handler to ensure redirect only happens once
	var hasFallenBack = false;
	function fallbackToRegularSubmission() {
	if (!hasFallenBack) {
	hasFallenBack = true;
	window.location.href = url;
	}
	}
	request.onerror = fallbackToRegularSubmission;
	request.ontimeout = fallbackToRegularSubmission;
	// Set a timeout (e.g., 10 seconds)
	request.timeout = 10000;
	try {
	request.send(parameters.join('&'));
	} catch (e) {
	// If the send method throws an exception, redirect to the form action URL.
	// This can happen for example if redirecting to an external site, which doesn't have CORS enabled,
	// so we can't use Ajax.
	fallbackToRegularSubmission();