1198321 - CORS header 'Access-Control-Allow-Origin' does not match '*'

Status: RESOLVED INCOMPLETE

(Core :: DOM: Security, defect)

Description

[jason.lunn]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36

Steps to reproduce:

Navigate to http://embed.jungroup.com/embedded_videos/catalog_frame?uid=poidhiu&distributorid=1&offer=vast_video-7e53c40e4aaa34d76b250df1ac9c2e2f


Actual results:

Received an error message in the console when a resource was retrieved from a remote server:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=is&c=23&pl=VAST&pli=14569042&PluID=0&pos=837&ord=[timestamp]&cim=1. (Reason: CORS header 'Access-Control-Allow-Origin' does not match '*').


Expected results:

'*' is supposed to match all values, so the request should have been allowed.

Comment 1

[jason.lunn]

For reference, Mozilla's documentation confirms my interpretation of '*' as a valid value for this header:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

Also, this behavior is a regression from FireFox 39.

Comment 2

[ovidiu boca[:Ovidiu]]

Build ID 20151125030231
User Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0

Hi, 
I tested this on Firefox Nightly 45.0a1 and I couldn't reproduce the issue. I navigate to: http://embed.jungroup.com/embedded_videos/catalog_frame?uid=poidhiu&distributorid=1&offer=vast_video-7e53c40e4aaa34d76b250df1ac9c2e2f and in console I didn't receive any error.

If you think I missed something please add some steps that can help me reproduce this.

Please download the Firefox Nightly from here: https://nightly.mozilla.org/ and retest the problem.

Thank you.

Comment 3

[jason.lunn]

ovidiu,

Please retest the issue using the version cited in the original ticket. I concur that the problem is no longer manifesting on the latest build, but it was 100% reproducible on the first release of version 40.

Thanks,

 - Jason

Comment 4

[ovidiu boca[:Ovidiu]]

Hi Jason,

Regarding the issue, if the problem can't be reproduced on latest version it means that the problem is resolved. I retested on the latest version, and the issue can't be reproduced.

Comment 5

[jason.lunn]

I would make sure that there is a regression test in place to address this issue by isolating the commit where this broke and where it was fixed before resolving this ticket.

Comment 6

[Christoph Kerschbaumer [:ckerschb}]

(In reply to jason.lunn from comment #5)
> I would make sure that there is a regression test in place to address this
> issue by isolating the commit where this broke and where it was fixed before
> resolving this ticket.

Ok. One step at a time. Kamil, Matt can you make sure that the problem is fixed by re-testing?

Comment 7

[Loic]

IMHO, the testcase doesn't work anymore because the video embedded in the page has been removed. Bug should be closed as incomplete.

Comment 8

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Loic from comment #7)
> IMHO, the testcase doesn't work anymore because the video embedded in the
> page has been removed. Bug should be closed as incomplete.

Thanks Loic for the update. I agree, let's mark it as incomplete.