Not sure if this belongs to nbinteract or binderhub… I published quiz which uses an nbinteract dropdown widget. If I go to Binder or use this runnable link Binder every seems ok quiz appears but the widgets fail to initialise because github.io has been blocked by the cors policy. it seems that an …

Thanks for posting! We did some work on this aspect of the system today, so maybe this is a side-effect of that (we fixed something but also broke something else :-/). @bitnik when I visit https://paddy10tellys.github.io/q1/quiz.html , click “Init widgets” and the requests end up being routed to Ges…

Yesterday at the end we used this to set Access-Control-Allow-Origin header: add_header Access-Control-Allow-Origin $http_origin; add_header Vary Origin; $http_origin is an nginx variable and it holds value of Origin request header. $http_name arbitrary request header field; the l…

[image] Access-Control-Allow-Origin The Access-Control-Allow-Origin response header indicates whether the response can be shared with requesting code from the given origin. Do you think it’d be better to use * instead of null?

We tried it yesterday for CORS issue on GESIS, but it didn’t work ( https://github.com/jupyterhub/mybinder.org-deploy/issues/1344#issuecomment-587424984 ): okay, that’s back to denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag…

OK. Could perhaps use an Nginx map: use the client’s origin if given, otherwise * if not provided? http://nginx.org/en/docs/http/ngx_http_map_module.html

good idea :slight_smile: i will read the documentation to learn how to do that

ah, but wouldn’t we get the same error (“Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.”) in the end? because that request is also redirected from mybinder.org

I think that would be an invalid client request. In fact I’m pretty sure that if a client doesn’t supply an Origin header there’s no need to return the CORS header at all, i.e. the CORS response is only required if the client asks for it by setting the request header (but with Nginx maps it’s easier…

Using map definitely sounds like the right thing anyway, but unlikely to be the root of the original question. The CORS work we did on gesis shouldn’t be relevant to @paddy10tellys request, which was made to hub.gke.mybinder.org, which was unaffected by those changes. My guess is that a request was…

Access-Control-Allow-Origin' header is missing on mybinder.org

Binder

betatim February 19, 2020, 1:20pm 9

I posted some more in https://github.com/jupyterhub/mybinder.org-deploy/issues/1344

Topic		Replies	Views
Blocking Cross Origin API request JupyterHub help-wanted	1	3065	February 10, 2023
Syntax for adding cors headers when deploying with helm BinderHub	0	639	April 11, 2019
Debugging websocket connection errors BinderHub	1	965	April 11, 2019
Cross origin issue upgrading from 1.5 JupyterHub	5	1416	February 16, 2023
How can I add binderhub as iframe BinderHub	0	716	October 20, 2021

Access-Control-Allow-Origin' header is missing on mybinder.org

Related topics