Search generating too long URLs for large API keys

[BootsByDre]

Note: This problem seems to be specific to the most recent release, 3.24.8. Less recent versions, including 3.24.7, don't seem to have this behavior. See below comment

We've found what appears to be a bug with the current release version. In cases where an API key is considerably long, performing a search will include it in the URL and cause Algolia's DSN server to throw a 414.

This seems to be very similar to an issue that was patched before: #319

While the JS client code seems to be doing a POST and putting our API key in the body, for some reason it is still including it as a query parameter as well, which is what causes the 414. Simply replaying the url and removing the API key from the query works fine (tested by copying as cURL command from Chrome's network tab).

It's also worth noting that this appears to have happened after release 3.22.1. We were able to get this older version of your vended JS by requesting the un-minified version for a time (<script src="//cdn.jsdelivr.net/algoliasearch/3/algoliasearch.js"></script>) and confirmed it did not have the problem we are seeing. I took some screenshots of my Chrome dev tools to help show this.

Version 3.22.1

Sources

Network

Version 3.24.8

Sources

Network

[BootsByDre]

Quick update on this, we tried playing around with different versions of algoliasearch.min.js and it appears to be an issue specific to 3.24.8. Reverting to 3.24.7 fixes this for us:
<script src="//cdn.jsdelivr.net/algoliasearch/3.24.7/algoliasearch.min.js"></script>

[Haroenv]

Thanks for reporting this, I’ll try to find the origin

[Haroenv]

This is fixed in 3.24.9, thanks again!

[BootsByDre]

@Haroenv Thanks for the quick turn around! Really appreciate it.

Given this issue has cropped up before as well, is there any way we could add testing around having long API keys in the url, or just long urls in general?

[Haroenv]

Yes, I’ll add tests early next year, but was more concerned about making sure this shipped now, there was a lot of plumbing needed to allow for a test like that in the current test setup

[BootsByDre]

Understood, thanks again!