Incorrect content-type parsing in actions

[SylvainGarrigues]

Describe the bug

When using a simple fetch to an endpoint like so:

fetch('/login', {method: "POST", body: new URLSearchParams('key', 'value')})

This is sent by Chrome and Safari as a POST request with the following content-type header:

Content-Type: application/x-www-form-urlencoded;charset=UTF-8

But https://github.com/sveltejs/kit/blob/master/packages/kit/src/runtime/server/page/actions.js checks the content-type value by splitting on ; (note the space).

Therefore I cannot use the above fetch call because the endpoint returns:

Actions expect form-encoded data (received application/x-www-form-urlencoded;charset=UTF-8)

I think this is a bug and that you should instead split on ; (without space).

Reproduction

Use a simple fetch to an endpoint (/login/+page.server.js) like so:

fetch('/login', {method: "POST", body: new URLSearchParams('key', 'value')})

Logs

No response

System Info

any system

Severity

serious, but I can work around it

Additional Information

No response

[SylvainGarrigues]

https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1 says the preferred type specification is:
text/html;charset=utf-8

i.e. with no space

[tcc-sejohnson]

I'll fix this. The easy solution would be to split on ; and trim the results. Any objections?

[repsac-by]

Any objections?

It would be nice to add tests

[Conduitry]

Whatever we do here, we should probably also do for the content type check that's part of the CSRF protection, if appropriate.

[eikaramba]

is this also related to #7112 ? i guess not right?

[SylvainGarrigues]

Thanks for such a quick fix, great job.