I am using the Application Insights JavaScript SDK on my website and Firefox is blocking the requests back to Azure. It is however working on Chrome.
The website is running on https and Application Insights works correctly on Chrome.
On the Console in Firefox I see the following warning:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://dc.services.visualstudio.com/v2/track. (Reason: CORS request did not succeed).
Why is Firefox identifying the request as a blocked CORS request, but Chrome doesn't?
I would like the Application Insights request to succeed from Firefox as well.
Did you installed an ad blocker extension (i.e. uBlock origin)?
If yes, try to disable it.
Couple of points to look at:
Which version are you using for AI. Try upgrading your package to latest one:
You can go ahead try adding the site to exception and see if it works, it could be because of the firefox exception too:
Firefox 'Cross-Origin Request Blocked' despite headers
Last and most importantly check the headers as mentioned by #Bergi in the comment to see if headers are same for both browser.
Additional reference: https://github.com/Microsoft/ApplicationInsights-node.js/issues/133
http://testingfreak.com/how-to-fix-cross-origin-request-security-cors-error-in-firefox-chrome-and-ie/
Hope it helps.
Related
I have an addon for Firefox which modifies a page at http://target.com with data from http://data.com. It does this by making an XMLHttpRequest() in the addon javascript and modifying the webpage accordingly. Neither the target nor the source servers are under my control.
This all worked fine until the target.com website changed to using https. As I was loading data from an http: address I got the following error:
Blocked loading mixed active content
Fortunately data.com also supports https, so I changed the data lookup address to https://data.com, and then I got
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://data.com
I read here that I could add the following to my package.json
"permissions": {
"cross-domain-content": ["https://data.com"]
}
And now I don't get any errors, but the Developer Tools Network page doesn't show any connections being made.
Have I hit a dead end? I understand that CORS requires server support but I assumed that as it worked prior to the target server moving to https it would still work now.
Cheers
Rich
That is one of the issues with using libraries (and not Firefox API)
Try using the native Firefox API eg: Connecting to Remote Content
Native Firefox API runs in the browser scope so there is no CORS to consider.
I'm developing a Greasemonkey script that implements a couple of tools onto a webpage. This script makes a request for data from
http://localhost/chess/heartbeat.php
Now currently in Firefox I am getting this console error which totally stops my jQuery AJAX request for data.
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at
http://localhost/chess/heartbeat.php.
This can be fixed by moving the resource to the same domain or enabling CORS.
I am able to work around this using Google Chrome. When I have it as a simple browser extension for chrome, I'm able to have it do the same thing as Greasemonkey and I can add the following permissions to the manifest file for the plugin which allows me to make the same data request which Firefox blocked:
"permissions": [
"<all_urls>"
]
Anyway, this works on chrome, but I want to achieve the same effect on Firefox. I've been researching this issue and I can't find a simple answer.
Normally XMLHttpRquest, and that includes jQuery's higher-level API around it, does not allow unrestricted cross-site requests but is limited by the same-origin policy and CORS.
As #epascarello already pointed out, you may use GM.xmlHttpRequest which allows you to perform any cross-site XHR even when the server does not implement CORS or allows the origin site. It also comes with some other goodies.
You should add a #grant GM.xmlHttpRequest metadata block to your user script or your script may break in the future.
Since you mentioned Chrome extensions: Firefox extensions can perform cross-site XHR as well. e.g. most user scripts should be easily portable to an SDK add-on using PageMod and enabling certain permissions analog to what you'd do in a Chrome extension.
I have added the Content Security Policy header to my web app. The CSP blocks the inline javascript and follows the other flags that I have set. But when I try to send the CSP report to my server the request is shown pending in the networks of the developer tools of Chrome version 33. The request reaches the server but I am not able to change the response as well.
Any help regarding this will be appreciable.
Thanks in advance!
Am using TinyMCE editor in my website. It works well in Chrome but not in Firefox. When i check firefox console it says the following...
Cross-Origin Request Blocked: The Same Origin Policy disallows reading
the remote resource at
http://www.example.com/VisualServe/siteadmin/js/tinymce/skins/lightgray/fonts/tinymce.woff.
This can be fixed by moving the resource to the same domain or
enabling CORS.
But i have the font files in the same domain only. i mean its all there in http://www.example.com/ only.
Can someone tell how to fix it ? Its happening only in Firefox. In chrome its working well.
Thanks,
I'm wondering, in IE & Firefox you're able to setup the browser, to allow
cross-domain calls.
I can't find any option in chrome for that (actually, there are in general not too much options at all...)
are there any about:config like things?
Kind Regards
--Andy
This answer was correct when written, but is longer correct, the switch has been deprecated
Chrome has a command line switch for this:
chrome.exe --disable-web-security
You can view a full list (as of when it was posted!) of command line options for chrome here.
No. Sorry.
Chrome and Firefox, however do support cross-domain requests via the W3C CORS spec (Cross Origin resource sharing) however the remote host has to enable it. If the remote host supports it explicitly then you don't have to make any changes to your XMLHttpRequest to be able to fetch the content.
You can install chrome plugins which enable cross-origin resource sharing .
I use this .