CODEWITHSUNDEEP
.htaccesscontent-security-policyhttp-referer
Mike Oram
Mike Oram

Reputation: 765

Content Security Policy causing CORS errors

weird one but the referer policy is currently creating issues on my website if the domain has a . on the end, for example: domain.uk - works fine
domain.uk. - has CORS errors
It seems the . on the end os being treated as part of the domain so considered a different origin. Seems to only be a problem in Chrome. Possibly a Chrome bug?

Thought perhaps I could fix this in my .htaccess by setting up a redirect, but the .htaccess cannot do it as it can only match after the domain, and the . is being treated as part of the domain.

Any suggestions?

Upvotes: 1

Views: 1279

Answers (1)

MrWhite
MrWhite

Reputation: 45829

It seems the . on the end os being treated as part of the domain so considered a different origin. Seems to only be a problem in Chrome. Possibly a Chrome bug?

It is part of the domain. The trailing dot indicates a fully qualified domain name. If you are only seeing different behaviour in Chrome then maybe Chrome is just being more strict - it's not a bug.

Try https://stackoverflow.com./ (for instance) - you'll probably appear logged out (as the cookies are not passed).

Thought perhaps I could fix this in my .htaccess by setting up a redirect, but the .htaccess cannot do it as it can only match after the domain, and the . is being treated as part of the domain.

You can do it in .htaccess. The dot is sent as part of the Host header (since it is part of the domain) - which is available in the HTTP_HOST server variable. Ordinarily, you'd do this as part of your canonical (www vs non-www / HTTP to HTTPS) redirect, but you could do something like the following using mod_rewrite to remove the trailing dot on the requested hostname:

RewriteEngine On

RewriteCond %{HTTP_HOST} (.+)\.$
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

The %1 backreference contains the hostname, less the trailing dot, that is captured in the preceding condition.

UPDATE:

I am using Wordpress so it already has some rewrite rules in the htaccess, ... can you advise on how to add your rewrites

You need to place this redirect before the existing WordPress directives (ie. before the # BEGIN WordPress section), near the top of the file.

You do not need to repeat the RewriteEngine On directive since that already occurs later in the WordPress section. (If there are multiple RewriteEngine directives then the last instance wins and controls the entire file.)

Upvotes: 1

Related Questions