Score:0

Server

CORS access-control headers not visible in the response headers section of Chrome inspector

Steve

5/17/24, 6:44 AM

Using https://cors-test.codehappy.dev/ to test our test server's new CORS policy, we receive:

These are the response headers received when making the request:

access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: https://*.hotjar.com
access-control-max-age: 300
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=63072000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
server: cloudflare

Should we be able to see these headers in the response headers section of the network tab?

All the allow-control headers are not visible:

access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: https://*.hotjar.com
access-control-max-age: 300

Update: in an incognito window, the Last-Modified date/time was about 58 minutes ago.

The CORS access-control headers would not have been adjusted on the testing server since first posting here.

261

1 + 6

http-headers

cors

Jaromanda X

5/17/24, 9:16 AM

is the request in your browser identical to the one made by that cors-test site?

Steve

5/22/24, 12:48 AM

@JaromandaX, yeah, they're both a GET request to the same URL.

Jaromanda X

5/22/24, 12:55 AM

seems you do get one cors header, there's a note to disable cache to see full headers, did you do that?

Steve

5/22/24, 2:33 AM

@JaromandaX that `disable cache` message is for the request headers though, it's the response headers I thought we'd see the allow-control headers in

Jaromanda X

5/22/24, 3:18 AM

ahh, true, didn't read the image properly

HBruijn

5/23/24, 8:45 AM

I see references to two different CDN's in your question: both CloudFlare and CloudFront, which is strange. Are you really looking at the same thing with your tests? - Policies at the CDN level of either/both may override/hide whatever you're attempting to do at your origin/back-end server.

Score:1

Server

Flash

5/22/24, 8:00 AM

There is 2 potential issues I see .

The sites data has not changed since oct 2022 according to your request, try clearing/disabling cache in the browser. Your site may not be triggering a refresh of the cached data in the browser and its showing you old cors data.
You have a load balancer, http/https differences or access control based on connections. Ensure you are doing both tests from the same connection to ensure all is the same there. - I'd probably trust the results from the CORS tester over my own browser here.

+ 1

Steve

5/23/24, 2:36 AM

Thanks. I've added an update to the question; 1) the response headers remain the same in Chrome incognito, and the last modified date/time was 58 minutes ago. 2) The `https://cors-test.codehappy.dev/` was always loaded with the same connection as a manual check, and again today. I'm wondering if Chrome ever shows allow-control headers...

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: CORS access-control headers not visible in the response headers section of Chrome inspector

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.