uBlock and CORS error logs in Firefox

[reallyuniquename]

When uBlock blocks requests to some domain Firefox generates error logs in browser console such as

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://manyads.com/metric/58hf91f. (Reason: CORS request did not succeed). Status code: (null).

I understand it is related to uBlock which is confirmed by network tab that explicitly states a request was blocked by uBlock.

The issue is it floods the console in dev tools especially if some ad script keeps requesting a page every second. Most importantly it makes it hard to read genuine CORS errors or any javascript errors at all.

Is there a way to disable these?

[stephenhawk8054]

Maybe disable redirect-rule for XHR?

@@*$xhr,redirect-rule

[reallyuniquename]

@stephenhawk8054 I double checked everything and you are right. Any blocking of a cross domain XHR would generate such errors in the logs. Any ideas how to suppress them if requests are blocked by uBlock?

What initially threw me off is in some cases <script src="..."> also produces same message in the console. It turns out if a page embeds a cross domain script dynamically into the DOM it also counts as XHR. Here's a snippet that emulates that.

          d = window.document;
          h = d.getElementsByTagName('head')[0];
          s = d.createElement('script');
          s.crossOrigin = 'anonymous';
          s.async = 1;
          s.src = 'https://cdn.jetboost.io/jetboost.js';
          h.appendChild(s);

[stephenhawk8054]

Any ideas how to suppress them if requests are blocked by uBlock?

You'll need to use scriptlet filters which trap XMLHttpRequest or fetch like ##+js(prevent-xhr) and ##+js(prevent-fetch)

For example, in https://symless.com/synergy page:

youtube.com##+js(prevent-xhr, play.google.com/log)

will not generate errors in the console.

---

It turns out if a page embeds a cross domain script dynamically into the DOM it also counts as XHR.

I don't remember I've seen a case like this. Can you find a site that has this issue?

[reallyuniquename]

Any way to default to prevent-xhr? Otherwise it would cover just my own filters.

Can you find a site that has this issue?

Open https://github.com/uBlockOrigin/uBlock-issues, block githubassets.com, refresh page. You should see a lot of CORS errors which are not exactly XHR related.

<script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/wp-runtime-e655dbaff571.js"></script>

Notice that blocked scripts are statically embeded with crossOrigin attribute yet they produce the same error. I guess there is no need for extra scripts to reproduce this.

[gorhill]

Any way to default to prevent-xhr?

No, prevent-xhr is scriptlet injection, there is no universal way to do this for all sites.

Best you bring your issue to Firefox, it's where something can be done if they choose to.

[stephenhawk8054]

Also from the MDN documentation, the error is simply CORS request did not succeed so it could simply mean the connection fails to fire when you block them in general, not necessarily related to CORS.

The HTTP request which makes use of CORS failed because the HTTP connection failed at either the network or protocol level. The error is not directly related to CORS, but is a fundamental network error of some kind.

In many cases, it is caused by a browser plugin (e.g. an ad blocker or privacy protector) blocking the request.

It's different to other CORS Errors reasons.