Here's what the request and response look like in curl:
```
> curl --dump-header - 'https://helka.helsinki.fi/primaws/suprimaExtLogin?institution=358UOH_INST&lang=en&target-url=https%3A%2F%2Fhel
ka.helsinki.fi%2Fdiscovery%2Fsearch%3Fvid%3D358UOH_INST%3AVU1%26lang%3Den&authenticationProfile=SAML&idpCode=SAML&auth=SAML&view=358UOH_INST%3AVU1&isSilent=fa
lse'
HTTP/1.1 200
X-Request-ID: 8b4uwmaLlw
Set-Cookie: JSESSIONID=276D251CCF73C509108B337EA736F6A7.apd06.eu03.prod.alma.dc06.hosted.exlibrisgroup.com:1801; Path=/; HttpOnly; SameSite=None; Secure
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Set-Cookie: urm_st=1734697817414; Path=/; SameSite=None; Secure
Set-Cookie: urm_se=1734698717414; Path=/; SameSite=None; Secure
Set-Cookie: institute=358UOH_INST; Path=/; HttpOnly; SameSite=None; Secure
Set-Cookie: digitalDoc=#####----######; Path=/; HttpOnly; SameSite=None; Secure
Set-Cookie: auth=SAML; Path=/; SameSite=None; Secure
Set-Cookie: idpCode=SAML; Path=/; SameSite=None; Secure
Set-Cookie: institute=358UOH_INST; Path=/; HttpOnly; SameSite=None; Secure
Set-Cookie: productCode=alma; Path=/; HttpOnly; SameSite=None; Secure
Set-Cookie: idpCode=SAML; Path=/; SameSite=None; Secure
Content-Security-Policy: frame-ancestors 'self' https://*.exlibrisgroup.com https://*.exlibrisgroup.com.cn helka.helsinki.fi; object-src blob: 'self' *.exlibrisgroup.com *.exlibrisgroup.com.cn www.google-analytics.com stats.g.doubleclick.net s3.amazonaws.com www.youtube.com youtube.com artic.contentdm.oclc.org helka.helsinki.fi ;worker-src blob: 'self' *.exlibrisgroup.com *.exlibrisgroup.com.cn www.google-analytics.com stats.g.doubleclick.net s3.amazonaws.com www.youtube.com youtube.com artic.contentdm.oclc.org helka.helsinki.fi ;upgrade-insecure-requests; report-uri /infra/CSPReportEndpoint.jsp; report-to csp-report-endpoint;
Report-To: {"max_age":10886400,"endpoints":[{"url":"https://eu03.alma.exlibrisgroup.com/infra/CSPReportEndpoint.jsp"}],"group":"csp-report-endpoint"}
X-Content-Type-Options: nosniff
Content-Type: text/html;charset=UTF-8
Content-Length: 1768
Date: Fri, 20 Dec 2024 12:30:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Set-Cookie: __Secure-UqZBpD3n3naPU20-9Fvn5i-TSO9Fp8hbYtbA9YCEpg3UXgo_=v1ueoigw__LIK; Expires=Mon, 18-Dec-2034 12:27:47 GMT; Path=/; Secure; SameSite=None
<title> SAML Login Redirection </title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<form name="form1" id="form1" action="https://login.helsinki.fi/idp/profile/SAML2/Redirect/SSO" method="get" class="form"> <input type="hidden" name="SAMLRequest" value="jZJBc9owEIX/ikZ3LFlhSqzBZCiGCTOkpTjJITeNvQZNZMnRyrT99xVmmJIL7UUHad++t592+vCrNeQIHrWzOU0TTgnYytXa7nP68rwa3dOH2RRVazo578PB7uCjBwwk6izK4SGnvbfSKdQorWoBZahkOX/aSJFw2XkXXOUMJXNE8CEaLZzFvgVfgj/qCl52m5weQuhQMnYA866SeKK27zppNGvtnnU1PipbG9i4vbaUFDGCtioMqS9Sc3r7JNV1x6J/ow2wUyDBdlBrD1VgZfmdkpXzFQxj5bRRBoGSdZHTecHTbLniqVhOskU6Xi5XX4tszHl2N+GLLOWqq/mXWItbhaiP8FeN2MPaYlA25FRwMR6lYiT4cyrkHZfpJBmnkzdKXi/EIyF65isHrb8Ce5urutCks9vsBixTduVxNhSd/Ba7routM7r6fWUs/v9LjXE/Fx5UiAyC72Fg2qpwu8HpRtejZiiVwSuLGmygpNyeIv3oldGNBv+vtRhGo2x2nu7zhs7+AA=="><input type="hidden" name="RelayState" value="https://helka.helsinki.fi/discovery/search?vid=358UOH_INST:VU1&lang=en@@358UOH_INST@@primaws"> <input type="submit" name="update" value="Apply" style="position: absolute; height: 0px; width: 0px; border: none; padding: 0px;" hidefocus="true" tabindex="-1"> </form> <script type="text/javascript"> function redirect() { var form = document.getElementById("form1"); form.submit(); } window.onload = redirect; </script>
```
It seems like a pretty normal request.
Yet if I paste that URL into a firefox tab monitored by devtools, it is not recorded.
In the network tab, the request has a line in the history, but when I click on the line for more details, all I get is "No headers for this request" in the Headers tab, "No response data available for this request" in the response tab, etc.. All of the tabs are blank.
I tried disabling the cache, and still I get the same thing.
Why doesn't devtools record this request?
Here's what the request and response look like in curl:
```
> curl --dump-header - 'https://helka.helsinki.fi/primaws/suprimaExtLogin?institution=358UOH_INST&lang=en&target-url=https%3A%2F%2Fhel
ka.helsinki.fi%2Fdiscovery%2Fsearch%3Fvid%3D358UOH_INST%3AVU1%26lang%3Den&authenticationProfile=SAML&idpCode=SAML&auth=SAML&view=358UOH_INST%3AVU1&isSilent=fa
lse'
HTTP/1.1 200
X-Request-ID: 8b4uwmaLlw
Set-Cookie: JSESSIONID=276D251CCF73C509108B337EA736F6A7.apd06.eu03.prod.alma.dc06.hosted.exlibrisgroup.com:1801; Path=/; HttpOnly; SameSite=None; Secure
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Set-Cookie: urm_st=1734697817414; Path=/; SameSite=None; Secure
Set-Cookie: urm_se=1734698717414; Path=/; SameSite=None; Secure
Set-Cookie: institute=358UOH_INST; Path=/; HttpOnly; SameSite=None; Secure
Set-Cookie: digitalDoc=#####----######; Path=/; HttpOnly; SameSite=None; Secure
Set-Cookie: auth=SAML; Path=/; SameSite=None; Secure
Set-Cookie: idpCode=SAML; Path=/; SameSite=None; Secure
Set-Cookie: institute=358UOH_INST; Path=/; HttpOnly; SameSite=None; Secure
Set-Cookie: productCode=alma; Path=/; HttpOnly; SameSite=None; Secure
Set-Cookie: idpCode=SAML; Path=/; SameSite=None; Secure
Content-Security-Policy: frame-ancestors 'self' https://*.exlibrisgroup.com https://*.exlibrisgroup.com.cn helka.helsinki.fi; object-src blob: 'self' *.exlibrisgroup.com *.exlibrisgroup.com.cn www.google-analytics.com stats.g.doubleclick.net s3.amazonaws.com www.youtube.com youtube.com artic.contentdm.oclc.org helka.helsinki.fi ;worker-src blob: 'self' *.exlibrisgroup.com *.exlibrisgroup.com.cn www.google-analytics.com stats.g.doubleclick.net s3.amazonaws.com www.youtube.com youtube.com artic.contentdm.oclc.org helka.helsinki.fi ;upgrade-insecure-requests; report-uri /infra/CSPReportEndpoint.jsp; report-to csp-report-endpoint;
Report-To: {"max_age":10886400,"endpoints":[{"url":"https://eu03.alma.exlibrisgroup.com/infra/CSPReportEndpoint.jsp"}],"group":"csp-report-endpoint"}
X-Content-Type-Options: nosniff
Content-Type: text/html;charset=UTF-8
Content-Length: 1768
Date: Fri, 20 Dec 2024 12:30:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Set-Cookie: __Secure-UqZBpD3n3naPU20-9Fvn5i-TSO9Fp8hbYtbA9YCEpg3UXgo_=v1ueoigw__LIK; Expires=Mon, 18-Dec-2034 12:27:47 GMT; Path=/; Secure; SameSite=None
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><!-- http://il-urm01.corp.exlibrisgroup.com:1807/infra/action/pageAction.do --><!-- This tag makes all form tags validated to XHTML standards --><html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> SAML Login Redirection </title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> </head> <body onload = "redirect" id="pds_alma_login_page" class="bodyLogin"> <form name="form1" id = "form1" action="https://login.helsinki.fi/idp/profile/SAML2/Redirect/SSO" method="get" class="form"> <input type="hidden" name="SAMLRequest" value="jZJBc9owEIX/ikZ3LFlhSqzBZCiGCTOkpTjJITeNvQZNZMnRyrT99xVmmJIL7UUHad++t592+vCrNeQIHrWzOU0TTgnYytXa7nP68rwa3dOH2RRVazo578PB7uCjBwwk6izK4SGnvbfSKdQorWoBZahkOX/aSJFw2XkXXOUMJXNE8CEaLZzFvgVfgj/qCl52m5weQuhQMnYA866SeKK27zppNGvtnnU1PipbG9i4vbaUFDGCtioMqS9Sc3r7JNV1x6J/ow2wUyDBdlBrD1VgZfmdkpXzFQxj5bRRBoGSdZHTecHTbLniqVhOskU6Xi5XX4tszHl2N+GLLOWqq/mXWItbhaiP8FeN2MPaYlA25FRwMR6lYiT4cyrkHZfpJBmnkzdKXi/EIyF65isHrb8Ce5urutCks9vsBixTduVxNhSd/Ba7routM7r6fWUs/v9LjXE/Fx5UiAyC72Fg2qpwu8HpRtejZiiVwSuLGmygpNyeIv3oldGNBv+vtRhGo2x2nu7zhs7+AA==" /><input type="hidden" name="RelayState" value="https://helka.helsinki.fi/discovery/search?vid=358UOH_INST:VU1&lang=en@@358UOH_INST@@primaws" /> <!-- @_SIG_INPUT_@ --> <input type="submit" name="update" value="Apply" style="position: absolute; height: 0px; width: 0px; border: none; padding: 0px;" hidefocus="true" tabindex="-1"/> </form> <script type="text/javascript"> function redirect() { var form = document.getElementById("form1"); form.submit(); } window.onload = redirect; </script> </body> </html>
```
It seems like a pretty normal request.
Yet if I paste that URL into a firefox tab monitored by devtools, it is not recorded.
In the network tab, the request has a line in the history, but when I click on the line for more details, all I get is "No headers for this request" in the Headers tab, "No response data available for this request" in the response tab, etc.. All of the tabs are blank.
I tried disabling the cache, and still I get the same thing.
Why doesn't devtools record this request?
