To whom it may concern,
I have an angular application accessing data from a 3rd party data provider.
To get data, POST-requests are sent to the data provider REST API (h… (xle nububuwo)
To whom it may concern,
I have an angular application accessing data from a 3rd party data provider.
To get data, POST-requests are sent to the data provider REST API (https://capzlog.aero).
The application works correctly using Google Chrome and Microsoft Edge.
However, when using Firefox, the following error appears:
"Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://capzlog.aero/api/pel/public/externalsystemflights/GetMissingIDs. (Reason: CORS request did not succeed). Status code: (null)."
As the POST request contains basic authentication, a preflight-request (OPTIONS) is first sent to the data provider. This request fails when using Firefox (but not when using Chrome or Edge), see attached screen-shots.
I have spent 4 days on the internet trying to figure out a solution, but I could not solve the issue.
I tried the following:
1) check the certificates of the 3rd party provider (https://capzlog.aero): There are no issues.
2) start Firefox in safe-mode, disactivating the "Enhanced Tracking Protecting", clearing the cache.
3) changing the following Firefox settings:
security.enterprise_roots.enabled (true<->false)
security.tls.version.min (1<->3)
security.tls.version.max (2<->4)
network.http.network-changed.timeout
I tried sending the "OPTIONS"-request using curl and it worked as expected:
curl --verbose -XOPTIONS -H "Access-Control-Request-Method: POST" -H "Origin: https://projectz.numericalsolutions.ch" https://capzlog.aero/api/pel/public/externalsystemflights/GetMissingIDs
- Host capzlog.aero:443 was resolved.
- IPv6: (none)
- IPv4: 156.67.9.80
- Trying 156.67.9.80:443...
- Connected to capzlog.aero (156.67.9.80) port 443
- ALPN: curl offers h2,http/1.1
- TLSv1.3 (OUT), TLS handshake, Client hello (1):
- TLSv1.3 (IN), TLS handshake, Server hello (2):
- TLSv1.2 (IN), TLS handshake, Certificate (11):
- TLSv1.2 (IN), TLS handshake, Server key exchange (12):
- TLSv1.2 (IN), TLS handshake, Server finished (14):
- TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
- TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
- TLSv1.2 (OUT), TLS handshake, Finished (20):
- TLSv1.2 (IN), TLS handshake, Finished (20):
- SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 / secp384r1 / rsaEncryption
- ALPN: server accepted h2
- Server certificate:
- subject: CN=capzlog.aero
- start date: Dec 31 10:14:59 2024 GMT
- expire date: Mar 31 10:14:58 2025 GMT
- subjectAltName: host "capzlog.aero" matched cert's "capzlog.aero"
- issuer: C=US; O=Let's Encrypt; CN=R10
- SSL certificate verify ok.
- Certificate level 0: Public key type RSA (3072/128 Bits/secBits), signed using sha256WithRSAEncryption
- Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
- Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
- using HTTP/2
- [HTTP/2] [1] OPENED stream for https://capzlog.aero/api/pel/public/externalsystemflights/GetMissingIDs
- [HTTP/2] [1] [:method: OPTIONS]
- [HTTP/2] [1] [:scheme: https]
- [HTTP/2] [1] [:authority: capzlog.aero]
- [HTTP/2] [1] [:path: /api/pel/public/externalsystemflights/GetMissingIDs]
- [HTTP/2] [1] [user-agent: curl/8.6.0]
- [HTTP/2] [1] [accept: */*]
- [HTTP/2] [1] [access-control-request-method: POST]
- [HTTP/2] [1] [origin: https://projectz.numericalsolutions.ch]
> OPTIONS /api/pel/public/externalsystemflights/GetMissingIDs HTTP/2
> Host: capzlog.aero
> User-Agent: curl/8.6.0
> Accept: */*
> Access-Control-Request-Method: POST
> Origin: https://projectz.numericalsolutions.ch
>
< HTTP/2 204
< cache-control: private
< server: Microsoft-IIS/10.0
< access-control-allow-origin: https://projectz.numericalsolutions.ch
< access-control-allow-credentials: true
< x-aspnet-version: 4.0.30319
< x-powered-by: ASP.NET
< date: Thu, 16 Jan 2025 07:12:32 GMT
<
- HTTP/2 stream 1 was not closed cleanly: HTTP_1_1_REQUIRED (err 13)
- Downgrades to HTTP/1.1
- Connection #0 to host capzlog.aero left intact
- Issue another request to this URL: 'https://capzlog.aero/api/pel/public/externalsystemflights/GetMissingIDs'
- Found bundle for host: 0x55ecfa0a46e0 [can multiplex]
- Hostname capzlog.aero was found in DNS cache
- Trying 156.67.9.80:443...
- Connected to capzlog.aero (156.67.9.80) port 443
- ALPN: curl offers http/1.1
- SSL reusing session ID
- TLSv1.3 (OUT), TLS handshake, Client hello (1):
- TLSv1.3 (IN), TLS handshake, Server hello (2):
- TLSv1.2 (IN), TLS handshake, Finished (20):
- TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
- TLSv1.2 (OUT), TLS handshake, Finished (20):
- SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 / secp384r1 / UNDEF
- ALPN: server accepted http/1.1
- Server certificate:
- subject: CN=capzlog.aero
- start date: Dec 31 10:14:59 2024 GMT
- expire date: Mar 31 10:14:58 2025 GMT
- subjectAltName: host "capzlog.aero" matched cert's "capzlog.aero"
- issuer: C=US; O=Let's Encrypt; CN=R10
- SSL certificate verify ok.
- using HTTP/1.x
> OPTIONS /api/pel/public/externalsystemflights/GetMissingIDs HTTP/1.1
> Host: capzlog.aero
> User-Agent: curl/8.6.0
> Accept: */*
> Access-Control-Request-Method: POST
> Origin: https://projectz.numericalsolutions.ch
>
< HTTP/1.1 204 No Content
< Cache-Control: private
< Transfer-Encoding: chunked
< Server: Microsoft-IIS/10.0
< Access-Control-Allow-Origin: https://projectz.numericalsolutions.ch
< Access-Control-Allow-Credentials: true
< X-AspNet-Version: 4.0.30319
< X-Powered-By: ASP.NET
< Date: Thu, 16 Jan 2025 07:12:32 GMT
<
Here, a comparison of the "OPTIONS"-HTTP-request as sent by Chrome and by Firefox:
CHROME
OPTIONS /api/pel/public/externalsystemflights/GetMissingIDs HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9a comparison of the "OPTIONS"-HTTP-request as sent by Chrome and by Firefox:
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Connection: keep-alive
Host: capzlog.aero
Origin: https://projectz.numericalsolutions.ch
Referer: https://projectz.numericalsolutions.ch/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
FIREFOX
OPTIONS /api/pel/public/externalsystemflights/GetMissingIDs undefined
Host: capzlog.aero
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Referer: https://projectz.numericalsolutions.ch/
Origin: https://projectz.numericalsolutions.ch
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Priority: u=4
TE: trailers
And the response header as seen by Chrome:
CHROME
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Language: en
Server: Microsoft-IIS/10.0
Access-Control-Allow-Origin: https://projectz.numericalsolutions.ch
Access-Control-Allow-Credentials: true
Set-Cookie: AppSettings=Culture=en-US&Language=English&CountryAlpha2=CH; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; secure; SameSite=Lax
X-Powered-By: ASP.NET
Date: Thu, 16 Jan 2025 07:19:59 GMT
Content-Length: 2
Here, a comparison of the Network Traffic as seen for Chrome and for Firefox:
CHROME
17:07:46.550256 IP ANYPC.57562 > 156.67.9.80.https: Flags [P.], seq 1480736564:1480737180, ack 2430285572, win 501, length 616
17:07:46.557654 IP 156.67.9.80.https > ANYPC.57562: Flags [P.], seq 1:393, ack 616, win 8212, length 392
17:07:46.557654 IP 156.67.9.80.https > ANYPC.57562: Flags [P.], seq 393:427, ack 616, win 8212, length 34
17:07:46.557683 IP ANYPC.57562 > 156.67.9.80.https: Flags [.], ack 393, win 501, length 0
17:07:46.557688 IP ANYPC.57562 > 156.67.9.80.https: Flags [.], ack 427, win 501, length 0
17:07:46.558334 IP ANYPC.57562 > 156.67.9.80.https: Flags [F.], seq 616, ack 427, win 501, length 0
17:07:46.558741 IP ANYPC.42786 > 156.67.9.80.https: Flags [S], seq 2926210792, win 64240, options [mss 1460,sackOK,TS val 2936933242 ecr 0,nop,wscale 7], length 0
17:07:46.562927 IP 156.67.9.80.https > ANYPC.57562: Flags [F.], seq 427, ack 617, win 8212, length 0
17:07:46.562962 IP ANYPC.57562 > 156.67.9.80.https: Flags [.], ack 428, win 501, length 0
17:07:46.563492 IP 156.67.9.80.https > ANYPC.42786: Flags [S.], seq 1974100572, ack 2926210793, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
17:07:46.563514 IP ANYPC.42786 > 156.67.9.80.https: Flags [.], ack 1, win 502, length 0
17:07:46.565558 IP ANYPC.42786 > 156.67.9.80.https: Flags [P.], seq 1:1743, ack 1, win 502, length 1742
17:07:46.572094 IP 156.67.9.80.https > ANYPC.42786: Flags [.], ack 1743, win 8212, length 0
17:07:46.572094 IP 156.67.9.80.https > ANYPC.42786: Flags [P.], seq 1:161, ack 1743, win 8212, length 160
17:07:46.572133 IP ANYPC.42786 > 156.67.9.80.https: Flags [.], ack 161, win 501, length 0
17:07:46.572276 IP ANYPC.42786 > 156.67.9.80.https: Flags [P.], seq 1743:1794, ack 161, win 501, length 51
17:07:46.572421 IP ANYPC.42786 > 156.67.9.80.https: Flags [P.], seq 1794:3197, ack 161, win 501, length 1403
17:07:46.583942 IP 156.67.9.80.https > ANYPC.42786: Flags [.], ack 3197, win 8206, length 0
17:07:46.710020 IP 156.67.9.80.https > ANYPC.42786: Flags [P.], seq 161:638, ack 3197, win 8206, length 477
17:07:46.751327 IP ANYPC.42786 > 156.67.9.80.https: Flags [.], ack 638, win 501, length 0
17:07:46.754201 IP 156.67.9.80.https > ANYPC.42786: Flags [P.], seq 161:638, ack 3197, win 8206, length 477
17:07:46.754231 IP ANYPC.42786 > 156.67.9.80.https: Flags [.], ack 638, win 501, options [nop,nop,sack 1 {161:638}], length 0$
FIREFOX
17:08:28.962851 IP ANYPC.35980 > 156.67.9.80.https: Flags [S], seq 2319755284, win 64240, options [mss 1460,sackOK,TS val 2936975646 ecr 0,nop,wscale 7], length 0
17:08:28.972248 IP 156.67.9.80.https > ANYPC.35980: Flags [S.], seq 1053801102, ack 2319755285, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
17:08:28.972330 IP ANYPC.35980 > 156.67.9.80.https: Flags [.], ack 1, win 502, length 0
17:08:28.974266 IP ANYPC.35980 > 156.67.9.80.https: Flags [P.], seq 1:1894, ack 1, win 502, length 1893
17:08:28.987389 IP 156.67.9.80.https > ANYPC.35980: Flags [.], ack 1894, win 1026, length 0
17:08:28.987433 IP 156.67.9.80.https > ANYPC.35980: Flags [P.], seq 2921:3937, ack 1894, win 1026, length 1016
17:08:28.987461 IP ANYPC.35980 > 156.67.9.80.https: Flags [.], ack 1, win 502, options [nop,nop,sack 1 {2921:3937}], length 0
17:08:28.987598 IP 156.67.9.80.https > ANYPC.35980: Flags [.], seq 1:1461, ack 1894, win 1026, length 1460
17:08:28.987647 IP ANYPC.35980 > 156.67.9.80.https: Flags [.], ack 1461, win 524, options [nop,nop,sack 1 {2921:3937}], length 0
17:08:28.987682 IP 156.67.9.80.https > ANYPC.35980: Flags [.], seq 1461:2921, ack 1894, win 1026, length 1460
17:08:28.987707 IP ANYPC.35980 > 156.67.9.80.https: Flags [.], ack 3937, win 547, length 0
17:08:28.994553 IP ANYPC.35980 > 156.67.9.80.https: Flags [P.], seq 1894:2052, ack 3937, win 547, length 158
17:08:29.005007 IP 156.67.9.80.https > ANYPC.35980: Flags [P.], seq 3937:3988, ack 2052, win 1025, length 51
17:08:29.005007 IP 156.67.9.80.https > ANYPC.35980: Flags [P.], seq 3988:4057, ack 2052, win 1025, length 69
17:08:29.005700 IP ANYPC.35980 > 156.67.9.80.https: Flags [.], ack 4057, win 547, length 0
17:08:29.006086 IP ANYPC.35980 > 156.67.9.80.https: Flags [P.], seq 2052:2151, ack 4057, win 547, length 99
17:08:29.006123 IP ANYPC.35980 > 156.67.9.80.https: Flags [P.], seq 2151:2577, ack 4057, win 547, length 426
17:08:29.008948 IP ANYPC.35980 > 156.67.9.80.https: Flags [P.], seq 2577:2615, ack 4057, win 547, length 38
17:08:29.018116 IP 156.67.9.80.https > ANYPC.35980: Flags [.], ack 2615, win 1023, length 0
17:08:29.018116 IP 156.67.9.80.https > ANYPC.35980: Flags [P.], seq 4057:4095, ack 2615, win 1023, length 38
17:08:29.024518 IP 156.67.9.80.https > ANYPC.35980: Flags [P.], seq 4095:4322, ack 2615, win 1023, length 227
17:08:29.024518 IP 156.67.9.80.https > ANYPC.35980: Flags [P.], seq 4322:4364, ack 2615, win 1023, length 42
17:08:29.024943 IP ANYPC.35980 > 156.67.9.80.https: Flags [.], ack 4364, win 570, length 0
17:08:35.342337 IP ANYPC.42786 > 156.67.9.80.https: Flags [.], ack 1974101210, win 501, length 0
17:08:35.349317 IP 156.67.9.80.https > ANYPC.42786: Flags [.], ack 1, win 8206, length 0
I really do not know what to do anymore to solve that problem.
As the problem is impacting hundreds of users, I really hope there is a solution.
In advance thanks for your help.