Skip to content

Commit 6a1be4d

Browse files
cors-errorscors-errors
committed
Make the related links section a feature of FAQ pages
1 parent 05df869 commit 6a1be4d

31 files changed

+113
-217
lines changed

Diff for: ‎_faq/a8d2.md

+6-10
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
---
22
question: I've tried to implement CORS but it isn't working. What should I do next?
3+
related:
4+
- ea74
5+
- cdc8
6+
- b1b0
7+
- a313
8+
- b56b
39
---
410

511
First make sure you've understood how CORS works. If you aren't clear on that then you'll waste a lot of time trying
@@ -23,13 +29,3 @@ If you're seeing an `OPTIONS` request that you weren't expecting then see {% inc
2329
If you're seeing the warning *'Provisional headers are shown'* then see {% include faq-link.html faq="b56b" %}.
2430

2531
If you think all the headers look correct then you can check them using our [CORS header checker](/header-checker).
26-
27-
---
28-
29-
Related:
30-
31-
* {% include faq-link.html faq="ea74" %}
32-
* {% include faq-link.html faq="cdc8" %}
33-
* {% include faq-link.html faq="b1b0" %}
34-
* {% include faq-link.html faq="a313" %}
35-
* {% include faq-link.html faq="b56b" %}.

Diff for: ‎_faq/abe3.md

+4-8
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
---
22
question: Why am I getting a CORS error when I'm not even using CORS?
3+
related:
4+
- d1a6
5+
- b667
6+
- f173
37
---
48

59
If your website has attempted to make an HTTP request to a different site then the browser will try to use CORS. You
@@ -8,11 +12,3 @@ and the browser will log a CORS error to the console.
812

913
Using the same domain with two different port numbers is not sufficient to avoid CORS. The port number is considered
1014
to be part of the *origin* when the browser decides whether or not to use CORS.
11-
12-
---
13-
14-
Related:
15-
16-
* {% include faq-link.html faq="d1a6" %}
17-
* {% include faq-link.html faq="b667" %}
18-
* {% include faq-link.html faq="f173" %}

Diff for: ‎_faq/b040.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
question: Why am I seeing a preflight OPTIONS request when I'm not setting any custom headers?
3+
related:
4+
- b56b
5+
- b7f6
36
---
47

58
The first step to debugging an unexpected preflight request is to check the request headers on the preflight request.
@@ -32,10 +35,3 @@ If you're using a library it may be automatically setting headers for you. Some
3235

3336
If you still can't find where the custom header is coming from then you may need to step through the code. Put a
3437
breakpoint just before your request and step into the library code to see exactly what is going on.
35-
36-
---
37-
38-
Related:
39-
40-
* {% include faq-link.html faq="b56b" %}
41-
* {% include faq-link.html faq="b7f6" %}

Diff for: ‎_faq/b1b0.md

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
22
question: Why can't I access the response headers in my JavaScript code?
3+
related:
4+
- b56b
35
---
46

57
By default, only the following response headers are exposed to JavaScript code for a CORS request:
@@ -19,9 +21,3 @@ been implemented in some browsers but at the time of writing it still isn't incl
1921
To expose other response headers you need to use `Access-Control-Expose-Headers`. See
2022
{% include external-link.html href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers" %}
2123
for more information.
22-
23-
---
24-
25-
Related:
26-
27-
* {% include faq-link.html faq="b56b" %}

Diff for: ‎_faq/b4d0.md

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
22
question: Why can't I see my request in the Network section of the developer tools?
3+
related:
4+
- b56b
35
---
46

57
First and foremost check for console errors. The simplest explanation for a missing request is that there's a bug in
@@ -32,9 +34,3 @@ were actually received.
3234

3335
It can be useful to check across multiple browsers. Using a new Incognito/Private window can also help to bypass any
3436
caching problems that might be interfering with your requests.
35-
36-
---
37-
38-
Related:
39-
40-
* {% include faq-link.html faq="b56b" %}

Diff for: ‎_faq/b56b.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
question: Why can't I access the response headers in Chrome's developer tools?
3+
related:
4+
- b4d0
5+
- b1b0
36
---
47

58
When you try to access the headers via the *Network* tab of Chrome's developer tools you may see the warning:
@@ -33,10 +36,3 @@ If you want to see the actual requests being made you have 3 options:
3336
3. Use Firefox instead.
3437

3538
Hopefully Chrome will fix the developer tools soon so that this is no longer a problem.
36-
37-
---
38-
39-
Related:
40-
41-
* {% include faq-link.html faq="b4d0" %}
42-
* {% include faq-link.html faq="b1b0" %}

Diff for: ‎_faq/b667.md

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
22
question: What does 'origin' mean?
3+
related:
4+
- fe2a
35
---
46

57
Consider the following URL:
@@ -23,9 +25,3 @@ The port may be omitted if it is the default port for the scheme, so `80` for `h
2325
When the browser makes a CORS request it will include the origin for the current page in the **Origin** request header.
2426

2527
In JavaScript you can access the current page's origin using `location.origin`.
26-
27-
---
28-
29-
Related:
30-
31-
* {% include faq-link.html faq="fe2a" %}

Diff for: ‎_faq/b6b0.md

+5-9
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
---
22
question: How can I use cURL to test a preflight request?
3+
related:
4+
- b7f6
5+
- d1a6
6+
- c7f6
7+
- b56b
38
---
49

510
In Firefox you should be able to isolate the preflight `OPTIONS` request in the *Network* tab of the developer tools.
@@ -35,12 +40,3 @@ Breaking this down:
3540
`Access-Control-Request-Headers` if there are no custom headers.
3641
6. The final line is the URL of the target server. Again this is something you will need to change to match the request
3742
you are trying to make.
38-
39-
---
40-
41-
Related:
42-
43-
* {% include faq-link.html faq="b7f6" %}
44-
* {% include faq-link.html faq="d1a6" %}
45-
* {% include faq-link.html faq="c7f6" %}
46-
* {% include faq-link.html faq="b56b" %}

Diff for: ‎_faq/b7f6.md

+8-12
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
---
22
question: What is a preflight request?
3+
related:
4+
- f173
5+
- b667
6+
- b6b0
7+
- b040
8+
- cd59
9+
- ffcc
10+
- b56b
311
---
412

513
The term is a reference to the preflight checks carried out by pilots.
@@ -76,15 +84,3 @@ No request body will be sent for a preflight request and the response body will
7684
Note that in current versions of Chrome the preflight request is not shown separately in the developer tools by default.
7785
See {% include faq-link.html faq="b56b" %} for more information, especially if you're seeing the message
7886
*'Provisional headers are shown'*.
79-
80-
---
81-
82-
Related:
83-
84-
* {% include faq-link.html faq="f173" %}
85-
* {% include faq-link.html faq="b667" %}
86-
* {% include faq-link.html faq="b6b0" %}
87-
* {% include faq-link.html faq="b040" %}
88-
* {% include faq-link.html faq="cd59" %}
89-
* {% include faq-link.html faq="ffcc" %}
90-
* {% include faq-link.html faq="b56b" %}

Diff for: ‎_faq/c320.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
question: Does CORS support HTTP redirects?
3+
related:
4+
- fe2a
5+
- e21d
36
---
47

58
Yes. CORS requests do support HTTP redirects so long as all the requests include the relevant CORS response headers.
@@ -28,10 +31,3 @@ If not done correctly this can change the request method to `GET`, which can tri
2831
response from the server. Inadvertently changing to a `GET` request will also cause the request body to be dropped.
2932

3033
Often the simplest solution is to use the final URL instead and skip the redirect altogether.
31-
32-
---
33-
34-
Related:
35-
36-
* {% include faq-link.html faq="fe2a" %}
37-
* {% include faq-link.html faq="e21d" %}

Diff for: ‎_faq/c381.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
question: CORS is annoying. Why can't I turn it off?
3+
related:
4+
- c3f4
5+
- b7a4
36
---
47

58
Some browsers have command-line options or similar settings to turn off the cross-origin security restrictions. The
@@ -20,10 +23,3 @@ know that, it just sees two different origins (servers) and has to treat them as
2023

2124
Before CORS existed the *same-origin policy* just blocked cross-origin AJAX requests. Now that was *really* annoying. At
2225
least with CORS the server can choose to allow the request.
23-
24-
---
25-
26-
Related:
27-
28-
* {% include faq-link.html faq="c3f4" %}
29-
* {% include faq-link.html faq="b7a4" %}

Diff for: ‎_faq/c3f4.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
question: Why is CORS so complicated?
3+
related:
4+
- f173
5+
- ffcc
36
---
47

58
How complicated you find CORS depends on your starting point.
@@ -34,10 +37,3 @@ yourself some time to find out how CORS works. If you try to rush it you'll just
3437

3538
Remember that CORS exists because of very real security concerns. You need to make an informed decision about exactly
3639
how much of that security you want to turn off.
37-
38-
---
39-
40-
Related:
41-
42-
* {% include faq-link.html faq="f173" %}
43-
* {% include faq-link.html faq="ffcc" %}

Diff for: ‎_faq/c7f6.md

+4-8
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
---
22
question: Can Postman send a preflight request?
3+
related:
4+
- b7f6
5+
- d1a6
6+
- b6b0
37
---
48

59
A preflight request is just an HTTP request, so it can be sent using Postman.
@@ -78,11 +82,3 @@ drop this code straight into the *Pre-request Script* tab for your target reques
7882
This code requires the original request to have an `Origin` header set. You can see the results of the preflight in the
7983
*Postman Console*. The code makes no attempt to perform a CORS check on the response headers, you'll need to verify the
8084
response yourself.
81-
82-
---
83-
84-
Related:
85-
86-
* {% include faq-link.html faq="b7f6" %}
87-
* {% include faq-link.html faq="d1a6" %}
88-
* {% include faq-link.html faq="b6b0" %}

Diff for: ‎_faq/cd59.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
question: How can I avoid the preflight OPTIONS request?
3+
related:
4+
- b7f6
5+
- b040
36
---
47

58
#### Caching
@@ -48,10 +51,3 @@ requests it should parse.
4851

4952
The `Authorization` header can also be problematic as it is commonly used by third-party libraries. Whether this is a
5053
solvable problem will depend on the library you're using.
51-
52-
---
53-
54-
Related:
55-
56-
* {% include faq-link.html faq="b7f6" %}
57-
* {% include faq-link.html faq="b040" %}

Diff for: ‎_faq/cdc8.md

+4-8
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
---
22
question: Why aren't my cookies working with CORS?
3+
related:
4+
- fdb1
5+
- fcd5
6+
- ffcc
37
---
48

59
There are several questions in one here:
@@ -121,11 +125,3 @@ only be a problem if the cookie was set by some other means.
121125
While Safari has tighter restrictions for setting cookies, the rules for including cookies on subsequent requests are
122126
much the same as for other browsers. So while a same-domain request may be required to set the cookie, it can then be
123127
included on a cross-domain request from a different page.
124-
125-
---
126-
127-
Related:
128-
129-
* {% include faq-link.html faq="fdb1" %}
130-
* {% include faq-link.html faq="fcd5" %}
131-
* {% include faq-link.html faq="ffcc" %}

Diff for: ‎_faq/d1a6.md

+5-9
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
---
22
question: My request works fine in Postman/cURL/etc.. Why do I get a CORS error in the browser?
3+
related:
4+
- e9f4
5+
- f173
6+
- b6b0
7+
- c7f6
38
---
49

510
The *same-origin policy* is a security feature built into web browsers. It doesn't apply if you make requests using
@@ -18,12 +23,3 @@ is possible to send it manually instead:
1823
* {% include faq-link.html faq="c7f6" %}
1924

2025
Within the browser it's usually pretty clear from the error message whether it's the preflight request that's failing.
21-
22-
---
23-
24-
Related:
25-
26-
* {% include faq-link.html faq="e9f4" %}
27-
* {% include faq-link.html faq="f173" %}
28-
* {% include faq-link.html faq="b6b0" %}
29-
* {% include faq-link.html faq="c7f6" %}

Diff for: ‎_faq/d926.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
question: How do the Authorization and WWW-Authenticate headers work with CORS?
3+
related:
4+
- b7f6
5+
- fcd5
36
---
47

58
The `Authorization` request header can be set as a custom header on a request and, just like any other custom header, it
@@ -29,10 +32,3 @@ If a preflight `OPTIONS` request is required then this must succeed without any
2932
Oddly, the `401` response does not need to include the `Access-Control-Allow-Credentials` header for the browser to
3033
prompt for credentials. However, it should be included anyway in case the user declines the credentials prompt. In that
3134
scenario the `401` becomes the exposed response and then `Access-Control-Allow-Credentials` is required.
32-
33-
---
34-
35-
Related:
36-
37-
* {% include faq-link.html faq="b7f6" %}
38-
* {% include faq-link.html faq="fcd5" %}

Diff for: ‎_faq/dfdb.md

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
22
question: What is an opaque response?
3+
related:
4+
- e9b8
35
---
46

57
If you're using the `fetch` API then you might have come across this message in Chrome:
@@ -47,9 +49,3 @@ something but whether or not it succeeds doesn't have any impact on the UI.
4749

4850
Another use case is caching. The requests can be used to pre-populate caches for things like stylesheets where you don't
4951
need to access the response details in JavaScript code.
50-
51-
---
52-
53-
Related:
54-
55-
* {% include faq-link.html faq="e9b8" %}

0 commit comments

Comments
 (0)