CORS Request Fails - Power Automate in Zen

[jedinjapan]

Preliminary Checks

• I have read and understood the important section above.
• I have searched existing issues and avoided creating duplicates.
• I am not filing an enhancement request.
• I have checked that this issue cannot be reproduced on Mozilla Firefox.
• I have checked that this issue can be reproduced once I removed all my Mods and Custom CSS.

What happened?

When attempting to load workflows in Power Automate, Zen Browser is unable to resolve the CORS request correctly.

This issue is not present in Mozilla Firefox, Microsoft Edge, or Google Chrome, and triggers a prompt in Power Automate indicating it cannot access api.powerplatform.com, but viewing the network trace shows the failed CORS request as the trigger for this.

Expected behavior

The CORS request should complete successfully

Actual behavior

The CORS request fails

Steps to reproduce

Visit make.powerautomate.com and attempt to create a workflow, or load an existing workflow.

Screenshots and videos

No response

Version

1.17.6b

What platform are you seeing the problem on?

Windows - x64

What component is this issue related to?

Security

Relevant log output if applicable

[katedickey]

This isn't limited to just Windows, it happens on Mac and Linux too.

[Propheticus]

Do you have more information about the CORS error that shows the failure reason?
Either via the "console" tab in the devtools panel (rightclick page>inspect>console) or the browser console (ctrl+shift+j)
Could be messages looking like Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource ...

I don't have access to that app because I'm not on a corporate MS account, but this scan of the site shows the header's content-security-policy defaults to 'self' and "api.powerplatform.com" is not explicitly listed as allowed source.

[katedickey]

Here's an example of a failure (with the environment id removed):

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://default<environment-id>.ec.environment.api.powerplatform.com/gateway/cluster?api-version=1. (Reason: CORS request did not succeed). Status code: (null).

Interestingly, all requests to a slightly different subdomain are successful:

https://<environment-id>.ec.tenant.api.powerplatform.com/powerautomate/getUserFeatures?api-version=1

I can't see the scan at that link, it says it failed? You can also see the CSP header with this curl command:
curl -s -D- -o/dev/null https://make.powerautomate.com | grep content-security-policy:

The CSP isn't different at deeper urls. And you are correct, it doesn't include that domain.

Let me know if you need any other details.

[katedickey]

oh, so I was just trying to see if the CORS preflight requests were even being sent, so I hooked zen up to mitmproxy (through the default HTTP proxy mode), and now when going through mitmproxy, the CORS requests are all successful. So that's pretty weird.

[Propheticus]

In case of the failure do you actually see any response to the actual request (not the preflight) in the devtools network tab and what are the response's headers?

The fact a mitm proxy works and this explanation of the reason could indicate a network level issue. Which still does not answer why it's an issue in Zen but not in Firefox (according to the OP of this issue).

Suggestion 1, try enabling the unbreak options in enhanced tracking protection (settings > privacy & security) or setting it to standard

If that doesn't help you can add https://make.powerautomate.com to the exceptions

Suggestion 2, turn off DNS over HTTPS (or use your own provider instead of the default cloudflare one)

[jedinjapan]

In my use case DNS of HTTPS was disabled, and I am not using Strict, only Standard Tracking Protection. This was across two network locations on two different ISPs, so I don't believe it to be a network related issue.

Could something hardened in the Standard Tracking Protection on Zen have caused this?

[katedickey]

This issue is now no longer reproducible for me, I assume MS fixed something over the weekend cause everything on my end is identical.
IIRC the actual requests were cancelled due to CORS failing, so there were no response details there.
I am also only using Standard Tracking Protection, and am not using DNS over HTTPS.
I did try to repro the issue in Firefox last week, by changing Firefox to Strict Tracking Protection, without the fix options, to see if it would break but it did not.
So idk, if this is fixed for the OP too, we may never know unless something similar happens again 🙃

[dosubot]

Hi, @jedinjapan. I'm Dosu, and I'm helping the desktop team manage their backlog and am marking this issue as stale.

Issue Summary:

• You reported that Zen Browser 1.17.6b on Windows x64 fails CORS requests when loading Power Automate workflows, unlike other browsers.
• Contributors confirmed the issue across platforms and suspected it related to Zen's tracking protection or network handling.
• Using a mitmproxy bypassed the problem, supporting the network-related theory.
• The issue later became non-reproducible, likely due to a Microsoft-side fix.
• The root cause remains unclear but may be linked to Zen's tracking protection settings.

Next Steps:

• Please let me know if this issue is still occurring with the latest version of Zen Browser by commenting here.
• Otherwise, I will automatically close this issue in 10 days.

Thanks for your understanding and contribution!