isHubsServer() in media-url-utils.js can cause CORS error in the console if videos are in room

[takahirox]

Description

If videos are placed in a room, CORS error shows up in the console.

But videos play (other than on the current Android Firefox), it means video download seems fine. So maybe a certain non-video download request is accidentally fired by video placement and it causes the CORS error.

This error might or might not be related to Android Firefox video problem #4213

To Reproduce
Steps to reproduce the behavior:

1. Enter a hubs.mozilla.com room
2. Place a video
3. See the CORS error in the console

You can also reproduce the CORS error by entering a room where videos are already placed by someone

Error log

Access to fetch at 'https://hubs.mozilla.com/' (redirected from 'https://uploads-prod.reticulum.io/') from origin 'https://hubs.mozilla.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Expected behavior

No CORS error.

Screenshots

Devtool Network tab screenshot

Hardware

• Device: Desktop, Android phone
• OS: Windows, Android
• Browser: Chrome, Firefox

Additional context

My understanding is if a user places a video in a room, Hubs uploads it to uploads-prod.reticulum.io and then all the users in the room download the video from the upload server.

And the root uploads-prod.reticulum.io access redirects to hubs.mozilla.com but the access to a certain path in uploads-prod.reticulum.io (e.g. uploads-prod.reticulum.io/certain-path.mp4) doesn't redirect but returns the content.

From the error log and Devtool Network tab screenshots, the CORS error seems to be cause by redirecting from the root uploads-prod.reticulum.io to hubs.mozilla.com.

It's weird to access the root uploads-prod.reticulum.io. So I speculate the access is accidentally and unexpectedly fired by placing a video. (bug)

┆Issue is synchronized with this Jira Task

[takahirox]

It seems this access is fired from isHubsServer() in media-url-utils.js.

To check whether a certain url points to Hubs server or not, it gets origin from the url and fetches the origin. The origin can be a root uploads-prod.reticulum.io if url points to a file uploaded to the upload server uploads-prod.reticulum.io.

[takahirox]

I haven't looked into the detail yet but maybe returning false from isHubsServer() if origin points to the upload server origin would be an easy solution? Or can it be problematic depending on Hubs Cloud configuration?