I am facing CORS policy error when I try to access resources between different DNS over http.
Working Model # 1:
- Client machine in domain a1.com
- WebApp in any domain but not in a1.com domain.
- WebService can be in any domain (a1.com, a2.com or a3.com) — POST Method
Non-Working Model # 2:
-
Client machine in domain a1.com
-
WebApp in domain a1.com
-
WebService can be in any other domain (e.g. a2.com or a3.com) — POST Method
-
Preflight Error:
Access to XMLHttpRequest at
‘http://webService1.a3.com/?Action=FetchData’ from origin
‘http://webApp.a1.com’ has been blocked by CORS policy: The request
client is not a secure context and the resource is in more-private
address spaceprivate. -
Please note in this case, the request doesn’t even go to WebService for it to respond, the failure
Https Solution that works:
- If I launch WebApp (any domain) & WebService (any domain) in https, then everything works fine. But currently making everything https is not an option for the project. NOTE: both WebApp & WebService should be in https mode, launching only WebService in https would result in same error.
- When WebApp is launched in https mode (client & webApp on same domain), accessing WebService on different domain, Chrome adds “Access-Control-Request-Private-Network: true” to the Preflight request and everything works fine. Please note I didnt have to add any additional request or response header at Client/WebApp/WebServer end for this to work.
Looking for Http Solution:
- Since I cannot make my webapp https through out, I want to add “Access-Control-Request-Private-Network: true” Request header to Preflight request –> is that possible?
- Note: The WebService request fails at client level due to CORS issue, hence any solution (Response headers, etc.) at WebService end is of not use.
- I am aware of chrome flags to disable this feature but we cannot control chrome on all clients, hence that is not an option as well.
- I own and have full control of the WebApp, Client & WebService are out of my jurisdiction, hence looking for a solution within the WebApp.
Thanks,
RDV