NUI callbacks return HTTP 403 when ui_page is an external URL

[etrex2k4]

Summary

Environment: FiveM for GTAV Enhanced CitizenFX/1.0.0.93, CEF Chrome/103.0.5060.134,
FXServer Enhanced + txAdmin v9.0.0-beta, Windows 11, 2026-07-22.

What happens

A fetch() from the NUI page to https://<resource>/<callback> returns 403 with an
empty body whenever ui_page points to an external URL. Serving the exact same page
from the resource itself makes the exact same call return 200.

ui_page	page origin	callback
index.html	https://cfx-nui-nui-origin-test	200 {"ok":true}
http://localhost:4200	http://localhost:4200	403, empty body
https://our-domain.example	https://our-domain.example	403, empty body

HTTPS does not help, so this is not about secure contexts. Lua (RegisterNUICallback) and
JS (RegisterNuiCallbackType + on('__cfx_nui:...')) behave identically. The same setup
works on Legacy.

Minimal repro

-- fxmanifest.lua
fx_version 'cerulean'
game 'gta5'
client_script 'client.lua'
files { 'index.html' }
ui_page 'index.html'                -- 200
-- ui_page 'http://localhost:4200'  -- 403 (serve the same index.html there)

-- client.lua
RegisterNUICallback('ping', function(data, cb)
  print('[TEST] ping received')     -- never prints in the 403 case
  cb({ ok = true })
end)

<!-- index.html -->
<script>
  fetch('https://nui-origin-test/ping', { method: 'POST', body: '{}' })
    .then(async r => console.log('status=' + r.status + ' body=' + await r.text()))
    .catch(e => console.log('error ' + e));
</script>

Why it hurts

Pointing ui_page at a dev server is the only way to get hot reload while building a NUI,
and many servers ship their UI from their own domain in production. Both are dead on
Enhanced.

For context on the scale: our NUI is a large Angular 22 workspace (several applications
and shared libraries, hundreds of components). A production build takes over a minute, so
losing ng serve means every UI tweak turns into build + resource restart + reconnect
instead of a sub-second hot reload. Serving it from the resource also requires
--base-href /<subdir>/, otherwise the bundle URLs resolve against the resource root and
the page silently fails to load.

The failure is silent: the request succeeds at the network level, so frontend code that
only catches network errors sees nothing. The 403 has an empty body, so response.json()
throws SyntaxError: Unexpected end of JSON input — that reads like a JSON bug, not a
permission decision. In our case the UI rendered fine but never reached the client, the
player never spawned, and the server dropped us with Timeout, because of no interaction.
We spent hours suspecting natives and spawn code.

What would fix it for us

Any one of these:

1. An opt-in allowlist for NUI origins (manifest entry or convar), ideally gated behind sv_devMode.
2. Keeping the restriction but logging a client-side warning naming the blocked origin.
3. Documenting it on the Legacy-vs-Enhanced page.

Issue type

Client

Repro rate

Always

Server build version

FXServer-early-access b92 win32

OS

No response

CPU

No response

GPU

No response

RAM

No response

Storage type

None

Connection type

None

ISP and bandwidth

No response

DxDiag

No response

Network graph

No response

Platform

None

OS version / distribution

No response

CPU

No response

RAM

No response

Using txAdmin?

None

Hosting provider

None

Machine type

None

/perf endpoint output

No response

DDoS protection

No response

ulimit -n value (Linux only)

No response

Docker Compose file (Docker only)

No response

Steps to Reproduce

frontend server on localhost:4200

Expected Behavior

ui should open and client should not freeze

Actual Behavior

client freeze an i got a disconnect

Evidence

No response

Additional Context

No response

[Mortiforti]

same on my sight

[imp2k20]

Yes, I've noticed that too - I can confirm it

[Leaguedi]

same on my sight

[alfgo2]

same on my sight

[JellyboxAD]

same

[nyxaroo]

I have exactly the same issue, but with ui_page in the resource #132

[etrex2k4]

if i put my angular ui as static files in the ressource for me it works, but not if it is a regular website like in legacy

[nyxaroo]

if i put my angular ui as static files in the ressource for me it works, but not if it is a regular website like in legacy

because I use one resource that's just Lua and another resource that handles the UI, I think

[SaiCode-DEV]

Same issue for my scrips as well.
Would love a fix

[Merec]

Had the same issue but fixed it adding

nui_callback_strict_mode 'false'

to the fxmanifest.lua of the resource.

Solution is taken from #132

[chromium-cfx]

Thanks for the report, I've been able to reproduce this.

[Gogsi]

A fix for this bug has been implemented and is available in the latest patch b95. Please try again and let us know if the issue persists. Thanks for your help!

[etrex2k4]

it works now thanks