CORS issue because of Brave Shields #2252

SilencerWeb · 2018-11-27T14:10:18Z

Consolidated Test plan from all related issues

Test plan

Open https://eslint-config-development.netlify.com.
Console should not log any CORS erros

Visit chart.js
Ensure chats are not broken
Console should not log any CORS erros

Visit https://www.wikiloc.com/mountain-biking-trails/la-quinta-cove-226486
Ensure maps shows correctly for both Satellite and Map
Console should not log any CORS erros

Open a new issue on Github with default shields settings
Try to upload an image
Should be able to upload image without any issues
Console should not log any CORS erros

Visit www.reddit.com
Locate a posted video hosted by reddit (https://www.reddit.com/r/Seattle/comments/9uhb5h/snoqualmie_falls_with_foliage_thanks_wa/)
Ensure video plays without any issue

Visit https://d.tube and open any video
Video should start streaming
Console should not log any CORS erros

Go to namecheap.com
Search for a domain
Search result should show up
Console should not log any CORS erros

Go to https://www.skill-capped.com/
Login shuold be successful
Console should not log any CORS erros

Original issue Description

I have a website deployed on netlify that makes requests to the server that deployed to heroku, they both are on different domains. I enabled CORS in my server setup but I keep getting error Access to fetch at 'https://eslint-config-api-server.herokuapp.com/' from origin 'https://eslint-config-development.netlify.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.. Works like that only in Brave.

Steps to Reproduce

Open https://eslint-config-development.netlify.com.
Open console.

Brave version (brave://version info)

0.56.15 Chromium: 70.0.3538.110 (Official Build) (64-bit)

Reproducible on current release:

Does it reproduce on brave-browser dev/beta builds? I don't know, I don't use such builds.

Website problems only:

Does the issue resolve itself when disabling Brave Shields? Yes.
Is the issue reproducible on the latest version of Chrome? No.

The text was updated successfully, but these errors were encountered:

charlescrtr · 2018-11-28T15:42:39Z

Can confirm I'm seeing the same issue when trying to log in to https://prisma.io. Issue fixes itself when Shields are disabled.

Brave version
Version 0.56.15 Chromium: 70.0.3538.110 (Official Build) (64-bit)

OrKoN · 2018-11-29T06:34:07Z

I experience the same problem when trying to perform a CORS request with Brave:

Brave | 0.56.15 Chromium: 70.0.3538.110 (Official Build) (64-bit)
-- | --
Revision | ca97ba107095b2a88cf04f9135463301e685cbb0-refs/branch-heads/3538@{#1094}

dwwoelfel · 2018-12-03T22:34:08Z

I think this is because Brave is stripping out the Origin header from the initial OPTIONS request.

JFrankfurt · 2018-12-06T19:25:40Z

I am seeing this all over the place now that I am looking for it. (In fact, I'm seeing it on this github page right now.) It has caused me some problems with calls to non-origin servers in my own work and broken dApp usage with Brave.

LukeDearden · 2018-12-10T08:59:20Z

Azure Portal is unusable in Brave because of this even with Shields down

SilencerWeb · 2018-12-10T10:56:33Z

Some of the charts from chart.js brokes because of this:

Here is the link to this example - https://www.chartjs.org/samples/latest/charts/line/multi-axis.html

bsclifton · 2018-12-13T07:35:28Z

Several +1s from brave/browser-laptop#15319

renschler · 2018-12-13T08:57:15Z

I also have this error but even with shields down.

I am collecting sensitive information within an iframe with a cross-domain src (do I have to manually whitelist the iframe domain from brave shield also?).

The iframe page makes a fetch call to POST the information. I'm noticing the CORS preflight OPTIONS request has the origin set to null as @dwwoelfel mentioned. Not sure if that's why its failing? Things work in Firefox & Chrome.

sudokai · 2018-12-13T20:03:40Z

Same problem here. Gmail 2FA broken because of this.

On our website, https://www.wikiloc.com, we use Apple MapkitJS and all maps are broken as well.

More users reporting the same issue: https://community.brave.com/t/latest-update-broke-cors-for-my-webapp/39135

Breakage on The Guardian, Facebook and Instagram: https://community.brave.com/t/too-many-redirects-fb-ig-the-guardian/39543/2

olibri-us · 2018-12-14T22:32:44Z

Got a similar problem that I described there : brave/browser-laptop#15319

SilencerWeb · 2018-12-16T10:26:24Z

Gosh, these shields block even request from Figma!

jmadkins · 2018-12-17T03:16:41Z

The users profile image doesn't load with Shields Up on the Azure Portal. Shields Down allows the profile image and some panes to load. However, the majority of panes don't load regardless of Shield settings.

Version 0.57.18 Chromium: 71.0.3578.80 (Official Build) (64-bit)

petethompson · 2018-12-17T16:46:08Z

I'm experiencing the same cross-origin issue, with a javascript http request from one of my clients websites; requesting data from the service where they store their content. It seems like the Shield option for blocking cookies is responsible.

iefremov · 2018-12-18T09:48:12Z

This change seems to break all preflight CORS requests and hence all CORS requests that require preflight: https://github.com/brave/brave-core/pull/754/files

Since we always clean referrer for cross-origin requests, all these requests become redirects, and preflight redirects are not allowed by policy.

@bbondy @yrliou

iefremov · 2018-12-18T10:56:05Z

Also affects:
#2034
#1999
#1581

srirambv · 2018-12-25T16:26:49Z

CORS Policy breaks image upload on vistaprint.com. The only way to upload image is to disable shields and use the site.

srirambv · 2018-12-27T09:32:27Z

@iefremov the following issues are all CORS related.

iefremov · 2019-01-09T13:48:24Z

Closed all dupes I could find.
Not sure about #2580, cant test it quickly.
#2286 is not related to this issue.

btlechowski · 2019-01-09T22:03:42Z

Verification passed on

Brave	0.58.20 Chromium: 71.0.3578.98 (Official Build) (64-bit)
Revision	15234034d19b85dcd9a03b164ae89d04145d8368-refs/branch-heads/3578@{#897}
OS	Windows 7

Used test plan from OP.

Verified passed with

Brave	0.58.20 Chromium: 71.0.3578.98 (Official Build) (64-bit)
Revision	15234034d19b85dcd9a03b164ae89d04145d8368-refs/branch-heads/3578@{#897}
OS	Mac OS X

Verified test plan from description

Verification PASSED on Mint 19.3 x64 VM using the following build:

Brave	0.58.20 Chromium: 71.0.3578.98 (Official Build) (64-bit)
Revision	15234034d19b85dcd9a03b164ae89d04145d8368-refs/branch-heads/3578@{#897}
OS	Linux

olibri-us · 2019-01-12T10:36:56Z

Updated to 0.58.21 on Mac OS and it now works perfectly !
I love u guys ;)
Keep the good work up !!!!

m-ret · 2019-05-06T21:38:08Z

I am having this issue right now on Version 0.63.48 Chromium: 74.0.3729.108 (Official Build) (64-bit).

Access to fetch at 'http://some/api/url' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

ghost · 2019-05-09T06:51:28Z

0.63.55 Chromium: 74.0.3729.131 (Official Build) (64-bit)

I'm receiving the same CORS preflight error as others. prevents signing in to medium.com (via email, twitter, google, and fb). Issue persists with 'allow all cookies' enabled and with shields down

michaeltintiuc · 2020-05-15T17:49:48Z

Also happens on https://my.playstation.com/ for me with Brave 1.8.96 on Linux and works fine in Firefox

bbondy added this to the 1.x Backlog milestone Dec 2, 2018

tildelowengrimm added webcompat/shields Shields is breaking a website. priority/P4 Planned work. We expect to get to it "soon". labels Dec 3, 2018

bsclifton mentioned this issue Dec 13, 2018

CORS Redirects to same domain are blocked brave/browser-laptop#15319

Closed

3 tasks

bbondy added priority/P2 A bad problem. We might uplift this to the next planned release. and removed priority/P4 Planned work. We expect to get to it "soon". labels Dec 13, 2018

iefremov self-assigned this Dec 17, 2018

This was referenced Dec 18, 2018

Reddit media is being blocked by Brave Shields #1999

Closed

Shields block uploading images on GitHub #2034

Closed

iefremov mentioned this issue Jan 8, 2019

Issue 2252: Refactor the referrer hiding. brave/brave-core#1240

Merged

18 tasks

bbondy closed this as completed in brave/brave-core#1240 Jan 8, 2019

This was referenced Jan 8, 2019

Issue 2252: Refactor the referrer hiding brave/brave-core#1258

Merged

Issue 2252: Refactor the referrer hiding brave/brave-core#1259

Merged

Issue 2252: Refactor the referrer hiding brave/brave-core#1260

Merged

srirambv added the QA/Test-Plan-Specified label Jan 9, 2019

kjozwiak added the QA/Yes label Jan 9, 2019

btlechowski added the QA Pass-Win64 label Jan 9, 2019

btlechowski mentioned this issue Jan 9, 2019

Infinite loop on behance.net #2864

Closed

This was referenced Jan 9, 2019

Manual test run on OS X for 0.58.x - Release Hotfix 3 (Release Channel) #2879

Closed

Manual test run on Linux for 0.58.x - Release Hotfix 3 (Release Channel) #2881

Closed

LaurenWags added the QA Pass-macOS label Jan 10, 2019

kjozwiak added the QA Pass-Linux label Jan 10, 2019

blurpesec mentioned this issue Jan 10, 2019

When the brave shields are on, the chat popup in reddit goes on a infinite loading loop. #2828

Closed

kjozwiak added the release-notes/include label Jan 11, 2019

kjozwiak mentioned this issue Jan 11, 2019

Release notes for 0.58.x Hotfix 3 (Release Channel) #2918

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CORS issue because of Brave Shields #2252

CORS issue because of Brave Shields #2252

SilencerWeb commented Nov 27, 2018 •

edited by srirambv

Loading

charlescrtr commented Nov 28, 2018

OrKoN commented Nov 29, 2018

dwwoelfel commented Dec 3, 2018

JFrankfurt commented Dec 6, 2018

LukeDearden commented Dec 10, 2018 •

edited

Loading

SilencerWeb commented Dec 10, 2018

bsclifton commented Dec 13, 2018

renschler commented Dec 13, 2018 •

edited

Loading

sudokai commented Dec 13, 2018 •

edited

Loading

olibri-us commented Dec 14, 2018

SilencerWeb commented Dec 16, 2018

jmadkins commented Dec 17, 2018

petethompson commented Dec 17, 2018

iefremov commented Dec 18, 2018

iefremov commented Dec 18, 2018 •

edited by srirambv

Loading

srirambv commented Dec 25, 2018

srirambv commented Dec 27, 2018

iefremov commented Jan 9, 2019

btlechowski commented Jan 9, 2019 •

edited by kjozwiak

Loading

olibri-us commented Jan 12, 2019 •

edited

Loading

m-ret commented May 6, 2019 •

edited

Loading

ghost commented May 9, 2019 •

edited by ghost

Loading

michaeltintiuc commented May 15, 2020 •

edited

Loading

CORS issue because of Brave Shields #2252

CORS issue because of Brave Shields #2252

Comments

SilencerWeb commented Nov 27, 2018 • edited by srirambv Loading

Consolidated Test plan from all related issues

Test plan

Original issue Description

Steps to Reproduce

Brave version (brave://version info)

Reproducible on current release:

Website problems only:

charlescrtr commented Nov 28, 2018

OrKoN commented Nov 29, 2018

dwwoelfel commented Dec 3, 2018

JFrankfurt commented Dec 6, 2018

LukeDearden commented Dec 10, 2018 • edited Loading

SilencerWeb commented Dec 10, 2018

bsclifton commented Dec 13, 2018

renschler commented Dec 13, 2018 • edited Loading

sudokai commented Dec 13, 2018 • edited Loading

olibri-us commented Dec 14, 2018

SilencerWeb commented Dec 16, 2018

jmadkins commented Dec 17, 2018

petethompson commented Dec 17, 2018

iefremov commented Dec 18, 2018

iefremov commented Dec 18, 2018 • edited by srirambv Loading

srirambv commented Dec 25, 2018

srirambv commented Dec 27, 2018

iefremov commented Jan 9, 2019

btlechowski commented Jan 9, 2019 • edited by kjozwiak Loading

olibri-us commented Jan 12, 2019 • edited Loading

m-ret commented May 6, 2019 • edited Loading

ghost commented May 9, 2019 • edited by ghost Loading

michaeltintiuc commented May 15, 2020 • edited Loading

SilencerWeb commented Nov 27, 2018 •

edited by srirambv

Loading

LukeDearden commented Dec 10, 2018 •

edited

Loading

renschler commented Dec 13, 2018 •

edited

Loading

sudokai commented Dec 13, 2018 •

edited

Loading

iefremov commented Dec 18, 2018 •

edited by srirambv

Loading

btlechowski commented Jan 9, 2019 •

edited by kjozwiak

Loading

olibri-us commented Jan 12, 2019 •

edited

Loading

m-ret commented May 6, 2019 •

edited

Loading

ghost commented May 9, 2019 •

edited by ghost

Loading

michaeltintiuc commented May 15, 2020 •

edited

Loading