CODEWITHSUNDEEP
androidajaxcordovacorscordova-plugins
ov3rfl0w
ov3rfl0w

Reputation: 26

CORS policy applied to cordova hybrid app

In my cordova application I use $.ajax requests to access external api (on my server). I've installed cordova-plugin-whitelist.

But every first run of clean installed application or after cleaning cach + data I recieve one of the next errors:

1: when I enable header('Access-Control-Allow-Origin: *');

Access to XMLHttpRequest at 'https://myapi_adress' from origin 'file://' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

2: with disabled

Access to XMLHttpRequest at 'https://myapi_adress' from origin 'file://' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

After restarting application on device all run perfect. Each request from device contain 

 'Origin' => 'file://'

header

But it blocks only on first run or after clearing cache and data of application.

It's look like whitelist plugin not applying/working on first run or after clearing cache.

Any suggestions?

Upvotes: 0

Views: 648

Answers (1)

ov3rfl0w
ov3rfl0w

Reputation: 26

Ok, so here is answer:

Recent chrome/WebView update causes wrong configuration on first/clear_cache launch (https://bugs.chromium.org/p/chromium/issues/detail?id=991107 ):

[Summary] WebView 76 seems to take a wrong configuration only at the first launch time. As a workaround, once the WebView reboots, it can continue to work correctly. Note: - Please check the star icon at the top-left side to upvote for higher priority (so many "me too" comments hide informative feedback) - The fix was merged to release branch, but update is not scheduled for now (#c21, #c23) - Workaround information (make sure if it's safe for you): #c19, #c37 For WebView beta users: If you are on beta channel, can you help us to confirm if your application can work with WebView 77 beta? We have a plan to enable OOR-CORS on WebView 77. So, that helps very much to reduce a risk to cause regression issue on m77 stable promotion. (Note: WebView 77 beta is not rolled out yet)

Upvotes: 1

Related Questions