I use the latest Firefox, Tampermonkey and do some cross site scripting. And this script is working for multiple people just fine. But suddenly for 1 and only 1 person I get this error message:

injected: Refused to connect to "https://...": URL is not permitted

The odd thing is, that this only happens to url.com/?article=123 but works fine for url.com/?article=456

[edit]
Yes, the 1:1 copy of the request with the same article Body works perfectly for me.
[/edit]

The request is just absolutely identical except the article ID.

Okay, I did not use the // @connect directive of Tampermonkey. But I never have done this for every cross site scripting thingy and it always worked like a charm and this only happens for this 1 user for this 1 page. He has basically a 1:1 copy of my firefox profile. Everything is the same. So what is the situation with this error?

Is it indeed related to the @connect directive? But if so, why is it working 99.9999% of the time without that and for exclusively CORS applications?

Does anyone have some good documentation on what causes this error specifically and predictably?