Cross-Origin Request Blocked: https://lycheeorg.github.io/update.json

[LudovicRousseau]

Detailed description of the problem

When I display the login dialog I get in the Firefox console:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://lycheeorg.github.io/update.json. (Reason: CORS request did not succeed).[Learn More]

I guess the Content-Security-Policy provided in https://github.com/LycheeOrg/Lychee/blob/master/.htaccess is missing something.

If I dump the headers using curl -D I get:

Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self' https://lycheeorg.github.io; form-action 'none'; base-uri 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content;

Steps to reproduce the issue

• Install Lychee
• Open Firefox debug console
• Try to login

Output of the diagnostics (Settings => Diagnostics)

Diagnostics

Warning: Dropbox import not working. No property for dropboxKey.
Warning: You may experience problems when uploading a large amount of photos. Take a look in the FAQ for details.
No critical problems found. Lychee should work without problems!

System Information

Lychee Version (json): 3.2.5
DB Version: update_030205
System: Linux
PHP Version: 7
MySQL Version: 50505
Imagick: 1
Imagick Active: 1
Imagick Version: 1687
GD Version: 2.2.4
Plugins:

Browser and system

Firefox 63.0.3 on macOS Mojave (10.14.1)

I do NOT have the problem with Safari 12.0.1 on the same system.

[d7415]

Seems to be limited to Firefox (NB: Mozilla's help is awful). I don't think it's CSP, but that might be a factor.

Edit to add: Doesn't happen on FF 52 ESR either

[d7415]

It appears to be an addon issue - clean FF 63.0.1 profile doesn't experience this error.

[d7415]

Confirmed playing with my main profile - I suspect the culprit is incorrect/incomplete NoScript configuration for the site.

[bennettscience]

This may be a dumb question, but I only see the CORS error if I'm testing from localhost and not from my live server.

Could it be related to this CORS issue in Chrome and Firefox, specifically when localhost is the server?

[LudovicRousseau]

It is/was a problem with a filter from the plugin uBlock Origin.
https://addons.mozilla.org/fr/firefox/addon/ublock-origin/

It is not a bug in Lychee. Sorry for the noise.

[d7415]

Did you figure out which filter? I wonder whether we could work around it, or at least warn users/administrators in the FAQ.

[LudovicRousseau]

The problematic rule is:

||github.io^$third-party,xmlhttprequest,domain=~facebook.com|~github.com|~github.io|~tumblr.com|~wottactic.com

from "FRA: EasyList Liste FR" list.

I added my website in the uBlock white list and problem solved.