1043545 - Invalid CORS errors on AJAX calls to Elastic Search cluster

Status: RESOLVED WORKSFORME

(Core :: DOM: Security, defect)

Description

[Mark Côté [:mcote]]

I'm not sure how long this has been here, but Nightly (34) is experiencing different behaviour from Release (31) when doing AJAX calls to get data from an Elastic Search cluster.

If you access the above URL *while on the VPN*, you will see these errors in the Web Console (with Security turned on):

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://elasticsearch-private.bugs.scl3.mozilla.com:9200/private_bugs/bug_version/_mapping. This can be fixed by moving the resource to the same domain or enabling CORS.

This does not occur with Firefox 31, which can load the charts without any troubles.

Note that eventually the charts will load, but that is because they fall back to a public instance that is behind a web app that apparently does not trigger this same CORS problem.

Comment 1

[Kyle Lahnakoski [:ekyle]]

It would appear the cluster (http://elasticsearch-private.bugs.scl3.mozilla.com:9200/private_bugs/bug_version/_mapping) does not send the correct CORS header when returning 4xx (and 5xx) responses.  If the first request fails, all subsequent requests will not be sent by the browser.

Please verify the CORS headers are set correctly in the 4xx and 5xx cases.

I will attempt to write an always-failing request.

Comment 2

[Kyle Lahnakoski [:ekyle]]

Finally, I added wrote a page that demonstrates the problem.

Code: https://github.com/klahnakoski/Bug1043545
Live: http://people.mozilla.org/~klahnakoski/Bug1043545/index.html

It is expected the test should pass.  Error responses should not set the CORS policy.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Probably this bug got fixed with our efforts to move CORS into ::AsyncOpen2() [Tracking Bug 1182535], but we should investigate.

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Kamil, Matt, can someone of you have a look and see if that is still an issue?

Comment 5

[Kamil Jozwiak [:kjozwiak]]

Reproduced the original issue using the test case in comment #0 with the following build:
* https://archive.mozilla.org/pub/firefox/nightly/2014/09/2014-09-02-03-02-02-mozilla-central/

STR:
* load the link that was provided via comment #0 while connected to the mozilla vpn
** http://charts.mozilla.org/ffos/blockers.html#responsibility=FxOS_Team&project=1.3,1.3T,1.4,2.0
* click on several "filters" and start sending requests to the server

Received the following CORS error message in the browser console:

* Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://elasticsearch-private.bugs.scl3.mozilla.com:9200/private_bugs/bug_version/_search. This can be fixed by moving the resource to the same domain or enabling CORS.

Went through verification using the following builds:
* https://archive.mozilla.org/pub/firefox/nightly/2016/03/2016-03-17-08-08-00-mozilla-central/
* https://archive.mozilla.org/pub/firefox/nightly/2016/03/2016-03-17-00-40-16-mozilla-aurora/
* https://archive.mozilla.org/pub/firefox/candidates/46.0b2-candidates/build3/mac/en-US/
* https://archive.mozilla.org/pub/firefox/releases/45.0.1/

Results:

* fx48.0a1 - PASSED
** never received a CORS error message via the browser console
* fx47.0a2 - PASSED
** never received a CORS error message via the browser console
* fx46.0b2 - PASSED
** never received a CORS error message via the browser console
* fx45.0.1 - PASSED
** never received a CORS error message via the browser console

Chris, this doesn't seem like it's an issue anymore. I reproduced the original issue using the test case from comment #0 with fx34 m-c but couldn't reproduce it using fx48.0a1, fx47.0a2, fx46.0b2 and fx45.0.1.

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Kamil Jozwiak [:kjozwiak] from comment #5)
> Chris, this doesn't seem like it's an issue anymore. I reproduced the
> original issue using the test case from comment #0 with fx34 m-c but
> couldn't reproduce it using fx48.0a1, fx47.0a2, fx46.0b2 and fx45.0.1.

Thanks Kamil!