Styjun

Duplicate instruments in unison in an orchestra

Is gzip atomic?

Do Bayesian credible intervals treat the estimated parameter as a random variable?

HJM in infinite dimensions

"There were either twelve sexes or none."

Prevent use of CNAME record for untrusted domain

How does encoder decoder network works?

How were medieval castles built in swamps or marshes without draining them?

"fF" letter combination seems to be typeset strangely or incorrectly

Breaker Mapping Questions

Prove your innocence

How do I get toddlers to stop asking for food every hour?

Immediate Smaller Element Time Limit Exceeded

Talk interpreter

When one problem is added to the previous one

Tex Quotes(UVa 272)

Very slow boot time and poor perfomance

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Joining lists with same elements

Does ostensible/specious make sense in this sentence?

Architectural feasibility of a tiered circular stone keep

To get so rich that you are not in need of anymore money

Handling Disruptive Student on the Autism Spectrum

Why do proofs of Bernoulli's equation assume that forces on opposite ends point in different directions?

HSTS redirect sets Origin to 'null'

Are there any browsers that set the origin header to “null” for privacy-sensitive contexts?AJAX call following 302 redirect sets origin to nullHow do I redirect to another webpage?Access-Control-Allow-Origin Multiple Origin Domains?XmlHttpRequest error: Origin null is not allowed by Access-Control-Allow-OriginOrigin is not allowed by Access-Control-Allow-OriginHow does Access-Control-Allow-Origin header work?AngularJS performs an OPTIONS HTTP request for a cross-origin resourceNo 'Access-Control-Allow-Origin' - Node / Apache Port IssueWhy does my JavaScript code get a “No 'Access-Control-Allow-Origin' header is present on the requested resource” error when Postman does not?Font from origin has been blocked from loading by Cross-Origin Resource Sharing policyResponse to preflight request doesn't pass access control check

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

1

Client tries to access http://example.com/token/ but example.com had HSTS header and clients browser redirects (307) to https://example.com/token/ with Origin set to 'null' which is being blocked by CORS, but 'null' cannot be in our allowed cors origin.

The error:

Access to XMLHttpRequest at https://example.com/token/ (redirected from http://example.com/token/) from origin 'null' has been blocked by CORS policy

How can the issue be solved?

redirect cors http-headers hsts

share|improve this question

edited Mar 27 at 20:56

Teodor Scorpan

asked Mar 27 at 18:40

Teodor ScorpanTeodor Scorpan

46411 gold badge55 silver badges1515 bronze badges

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  https://example.com is a different origin than http://example.com. And when a request is redirected across origins, the browser sets the origin of the request to null. That behavior is required by the Fetch spec. The browser marks the origin as “tainted” in that case. See fetch.spec.whatwg.org/… and stackoverflow.com/q/30193851/441757 and stackoverflow.com/a/22625354/441757
  
  – sideshowbarker
  Mar 28 at 1:21
  

  
  
  
  

add a comment | 

1

Client tries to access http://example.com/token/ but example.com had HSTS header and clients browser redirects (307) to https://example.com/token/ with Origin set to 'null' which is being blocked by CORS, but 'null' cannot be in our allowed cors origin.

The error:

Access to XMLHttpRequest at https://example.com/token/ (redirected from http://example.com/token/) from origin 'null' has been blocked by CORS policy

How can the issue be solved?

redirect cors http-headers hsts

share|improve this question

edited Mar 27 at 20:56

Teodor Scorpan

asked Mar 27 at 18:40

Teodor ScorpanTeodor Scorpan

46411 gold badge55 silver badges1515 bronze badges

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  https://example.com is a different origin than http://example.com. And when a request is redirected across origins, the browser sets the origin of the request to null. That behavior is required by the Fetch spec. The browser marks the origin as “tainted” in that case. See fetch.spec.whatwg.org/… and stackoverflow.com/q/30193851/441757 and stackoverflow.com/a/22625354/441757
  
  – sideshowbarker
  Mar 28 at 1:21
  

  
  
  
  

add a comment | 

Client tries to access http://example.com/token/ but example.com had HSTS header and clients browser redirects (307) to https://example.com/token/ with Origin set to 'null' which is being blocked by CORS, but 'null' cannot be in our allowed cors origin.

The error:

Access to XMLHttpRequest at https://example.com/token/ (redirected from http://example.com/token/) from origin 'null' has been blocked by CORS policy

How can the issue be solved?

redirect cors http-headers hsts

share|improve this question

edited Mar 27 at 20:56

Teodor Scorpan

asked Mar 27 at 18:40

Teodor ScorpanTeodor Scorpan

46411 gold badge55 silver badges1515 bronze badges

share|improve this question

edited Mar 27 at 20:56

Teodor Scorpan

asked Mar 27 at 18:40

Teodor ScorpanTeodor Scorpan

46411 gold badge55 silver badges1515 bronze badges

share|improve this question

edited Mar 27 at 20:56

Teodor Scorpan

asked Mar 27 at 18:40

Teodor ScorpanTeodor Scorpan

46411 gold badge55 silver badges1515 bronze badges

asked Mar 27 at 18:40

Teodor ScorpanTeodor Scorpan

46411 gold badge55 silver badges1515 bronze badges

asked Mar 27 at 18:40

Teodor ScorpanTeodor Scorpan

46411 gold badge55 silver badges1515 bronze badges