'request.withCredentials = true' breaks CORS #1802

tomw1808 · 2018-07-27T13:04:13Z

The latest change in httpprovider breaks CORS with ganache and possibly other tools (for me at least), where the CORS-domain cannot be set explicitly.

Chrome comes up with the following error message: "Failed to load http://localhost:7545/: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'null' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute."

Reproduce this issue by using the web3 0.20, e.g. "npm install web3@0.20" and then a simple index.html with the most simplistic content opening in Chrome:

<!doctype html>

<html>

<head>
  <script src="node_modules/web3/dist/web3.js" type="text/javascript"></script>
</head>

<body>

  <div>Here is some content.</div>


  <script>
    var web3;
    if (typeof web3 !== 'undefined') {
      web3 = new Web3(web3.currentProvider);
    } else {
      // set the provider you want from Web3.providers
      web3 = new Web3(new Web3.providers.HttpProvider("http://localhost:7545"));
    }

  </script>
</body>

</html>

Anything I can do on my side?

https://github.com/ethereum/web3.js/blob/b4c1542ddb5284267f6814ba0106bfbbc83fe166/lib/web3/httpprovider.js#L66

The text was updated successfully, but these errors were encountered:

nomoreboredom · 2018-07-27T14:13:17Z

I am also experiencing this after migrating to version 35, following.

H34D · 2018-08-02T12:36:46Z

i can confirm this, after downgrading to 0.20.6 it worked again.

pierreneter · 2018-08-07T11:42:03Z

Related to #1803

angelina999990 · 2018-08-09T09:53:22Z

Encountered the same issue which says 'The value of the 'Access-Control-Allow-Credentials must be true'. I'm using web3.js@0.20.7

angelina999990 · 2018-08-09T09:56:41Z

after downgrading to 0.20.6 it worked again. It works as well

tradzero · 2018-08-15T06:59:41Z

i found safari will add user-agent to Access-Control-Request-Headers, and infura will reject this request. but i dont know how to remove that

edwardfxiao · 2018-08-15T08:47:24Z

@tradzero downgrade to v1.0.0-beta.33 solved my problem

levity · 2018-08-30T00:19:51Z

For users of v1.0.0-beta, downgrading to v1.0.0-beta.34 will also work, because the issue was introduced after it, in this commit.

I had to downgrade in order to use HttpProvider with Infura. Probably the longer-term solution is to allow withCredentials to be turned off by an option in the constructor arguments.

see my comment on web3/web3.js#1802

0xclem · 2018-09-17T02:12:05Z

I can confirm that downgrading to v1.0.0-beta.34 fixes the issue. Both Safari and Firefox were impacted.

karlphillip · 2018-10-04T00:27:21Z

What is the correct command to downgrade to that specific version?

0xclem · 2018-10-04T00:34:16Z

@karlphillip something like yarn remove web3 && yarn add web3@1.0.0-beta.34 should work.

karlphillip · 2018-10-04T00:48:12Z

Thank you, ended up going with:
npm install web3@0.20.6 --save

therightstuff · 2018-10-04T05:49:31Z

#1956 resolves this by removing the credential requirement when there's no user / password supplied,

@frozeman @nivida this seems to be an issue for quite a lot of people, is there another way to work around this or do you have any comments for the PR?

jamesmorgan · 2019-01-05T07:07:41Z

Any ideas on how to solve this - I find it works in most browsers but safari?

aratakokubun · 2019-01-05T07:44:54Z

I have the same issue and can not resolve with Chrome, FireFox and Safari...

todorone · 2019-01-28T08:54:16Z

Unfortunately this is a blocking issue, so all versions above beta.34 are unavailable for React Native platform due to it's cookies headers resulting this error:

Can somebody proficient suggest any temporary workaround until this issue is resolved? Thanks.
@nivida @tomw1808

barrard · 2019-03-21T08:14:31Z

Im getting this error also :(
Fetch API cannot load https://rinkeby.infura.io/v3/xxxxxxxx due to access control checks.

nivida · 2019-03-25T15:29:39Z

This got fixed with PR #2564 and will be released this week.

vanchinathans-git · 2019-04-26T12:11:38Z

I can confirm that downgrading to v1.0.0-beta.34 fixes the issue. Both Safari and Firefox were impacted.

Thank you so much. It saved my day.

glowkeeper · 2019-10-15T12:41:03Z

I think I'm seeing the same issue on a MAC build of Clickz Latest, which is trying to run the following dat:

dat://795f83fa1356cd7d00e5cfe8f1a93f32c55127684c6fc4cb8ff89a32e000016b

That is a frontend to some contracts running on the Ethereum Rinkeby Test Network, so it relies on MetaMask to inject a web3.js instance that points to Rinkeby. Unfortunately, no matter what I do with MetaMask, my app' thinks it's on the Ropsten network, and I get these errors:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:8545/. (Reason: CORS request did not succeed).

I'm assuming that the reference to http://127.0.0.1:8545/ comes from web3.js, since it is not mentioned anywhere else in my code.

Interestingly, the very same dat works seamlessly on vanilla Firefox with the dat P2P protocol extension installed.

Meanwhile, what to do concerning that error using Clickz Latest? I've seen some possibilities involving XMLHttpRequest, but I can't find any docs as to how to use that when setting my web3 provider. Would it help?

nivida · 2019-10-15T12:47:44Z

@glowkeeper This got fixed with #3112 and will be released with 1.2.2.

glowkeeper · 2019-10-15T13:35:12Z

Awesome! When is 1.2.2 due for release?

0xZick · 2019-10-18T03:19:03Z

@nivida When is 1.2.2 due for release ?)

glowkeeper · 2019-10-19T10:00:45Z

@nivida - I appreciate you're probably busy, but I'm trying to work out project plans for some of my dApps, and that 1.2.2 upgrade has become an important ingredient of those plans. Any news on release dates?

nivida · 2019-10-19T10:45:24Z

The release is planned for Monday. I will do the last tests and improvements over the weekend and will release it in the late afternoon on Monday (CEST)

glowkeeper · 2019-10-19T11:01:45Z

Brilliant - thanks, @nivida

glowkeeper · 2019-10-23T11:28:29Z

Problems?

glowkeeper · 2019-10-23T15:58:04Z

Oooo - just seen the new version - awesome - thanks @nivida!

nomoreboredom mentioned this issue Jul 27, 2018

http module breaks tradle/rn-nodeify#71

Closed

rmatil mentioned this issue Jul 31, 2018

Avoid updating Web3 provotum/frontend#11

Open

nivida added the 0.x.x label Aug 10, 2018

nivida self-assigned this Aug 10, 2018

nivida added Bug Addressing a bug and removed 0.x.x labels Aug 10, 2018

yann300 mentioned this issue Aug 23, 2018

Update package.json ethereum/remix#926

Merged

levity added a commit to makerdao/governance-portal that referenced this issue Aug 30, 2018

peg web3 at 1.0.0-beta.34

986a916

see my comment on web3/web3.js#1802

This was referenced Nov 6, 2018

CORS headers issue - Infura does not work on Safari and iOS INFURA/infura#156

Closed

CORS error when calling API INFURA/infura#57

Closed

thair116 added a commit to DoxaNetwork/32Daily that referenced this issue Nov 22, 2018

rollback web3 to avoid web3/web3.js#1802

669e48b

thair116 added a commit to DoxaNetwork/32Daily that referenced this issue Nov 22, 2018

rollback web3 to avoid web3/web3.js#1802

d9c1c61

davidmurdoch mentioned this issue Jan 22, 2019

Access-Control-Allow-Credentials and Access-Control-Allow-Origin trufflesuite/ganache#282

Closed

mikeshultz mentioned this issue Feb 6, 2019

List of pinned packages OriginProtocol/origin#1388

Closed

Chengchcc mentioned this issue Feb 12, 2019

unavailable for React Native aionnetwork/aion_web3#71

Closed

kumavis mentioned this issue Mar 25, 2019

Web3@1.0.0-beta.50 (Webkit, Gecko) CORS Error #2559

Closed

nivida mentioned this issue Mar 25, 2019

XMLHttpRequest options handling improved #2564

Merged

12 tasks

nivida closed this as completed Mar 25, 2019

nivida mentioned this issue Mar 28, 2019

Release - v1.0.0-beta.51 #2598

Merged

12 tasks

alcuadrado mentioned this issue Sep 16, 2019

Proposal to stabilize Web3 1.x #3070

Closed

levity mentioned this issue Oct 18, 2019

bump web3 to 1.2.x makerdao/dai.js#169

Merged

donfrigo mentioned this issue Nov 6, 2019

Try fixing custom network related cors issues SuperblocksHQ/ethereum-studio#96

Merged

jakubgs mentioned this issue Dec 13, 2019

dev.dap.ps is empty on IOS (develop 09.08.2019) dap-ps/discover#16

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

'request.withCredentials = true' breaks CORS #1802

'request.withCredentials = true' breaks CORS #1802

tomw1808 commented Jul 27, 2018

nomoreboredom commented Jul 27, 2018

H34D commented Aug 2, 2018

pierreneter commented Aug 7, 2018

angelina999990 commented Aug 9, 2018

angelina999990 commented Aug 9, 2018

tradzero commented Aug 15, 2018

edwardfxiao commented Aug 15, 2018 •

edited

Loading

levity commented Aug 30, 2018 •

edited

Loading

0xclem commented Sep 17, 2018

karlphillip commented Oct 4, 2018

0xclem commented Oct 4, 2018 •

edited

Loading

karlphillip commented Oct 4, 2018

therightstuff commented Oct 4, 2018

jamesmorgan commented Jan 5, 2019

aratakokubun commented Jan 5, 2019

todorone commented Jan 28, 2019

barrard commented Mar 21, 2019

nivida commented Mar 25, 2019

vanchinathans-git commented Apr 26, 2019

glowkeeper commented Oct 15, 2019 •

edited

Loading

nivida commented Oct 15, 2019

glowkeeper commented Oct 15, 2019 •

edited

Loading

0xZick commented Oct 18, 2019

glowkeeper commented Oct 19, 2019

nivida commented Oct 19, 2019

glowkeeper commented Oct 19, 2019

glowkeeper commented Oct 23, 2019

glowkeeper commented Oct 23, 2019

'request.withCredentials = true' breaks CORS #1802

'request.withCredentials = true' breaks CORS #1802

Comments

tomw1808 commented Jul 27, 2018

nomoreboredom commented Jul 27, 2018

H34D commented Aug 2, 2018

pierreneter commented Aug 7, 2018

angelina999990 commented Aug 9, 2018

angelina999990 commented Aug 9, 2018

tradzero commented Aug 15, 2018

edwardfxiao commented Aug 15, 2018 • edited Loading

levity commented Aug 30, 2018 • edited Loading

0xclem commented Sep 17, 2018

karlphillip commented Oct 4, 2018

0xclem commented Oct 4, 2018 • edited Loading

karlphillip commented Oct 4, 2018

therightstuff commented Oct 4, 2018

jamesmorgan commented Jan 5, 2019

aratakokubun commented Jan 5, 2019

todorone commented Jan 28, 2019

barrard commented Mar 21, 2019

nivida commented Mar 25, 2019

vanchinathans-git commented Apr 26, 2019

glowkeeper commented Oct 15, 2019 • edited Loading

nivida commented Oct 15, 2019

glowkeeper commented Oct 15, 2019 • edited Loading

0xZick commented Oct 18, 2019

glowkeeper commented Oct 19, 2019

nivida commented Oct 19, 2019

glowkeeper commented Oct 19, 2019

glowkeeper commented Oct 23, 2019

glowkeeper commented Oct 23, 2019

edwardfxiao commented Aug 15, 2018 •

edited

Loading

levity commented Aug 30, 2018 •

edited

Loading

0xclem commented Oct 4, 2018 •

edited

Loading

glowkeeper commented Oct 15, 2019 •

edited

Loading

glowkeeper commented Oct 15, 2019 •

edited

Loading