CORS blocks https://mozilla.org/.well-known/matrix/client

[ara4n]

If you try to discover a custom server in Riot/Desktop (e.g. by entering @foo:mozilla.org as your mxid), it fails miserably with:

Access to XMLHttpRequest at 'https://mozilla.org/.well-known/matrix/client' from origin 'vector://vector' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

[t3chguy]

That doesn't look like CSP

[t3chguy]

especially as riot/desktop official builds don't have the CSP changes yet

[jryans]

Instead of CSP, it looks like this is a CORS issue on Mozilla's side:

• https://mozilla.org/.well-known/matrix/client replies with a 302 to https://www.mozilla.org/.well-known/matrix/client (adding www prefix) but is missing access-control-allow-origin: *.
• https://www.mozilla.org/.well-known/matrix/client itself replies with a 200 and correct CORS header

So, this seems to be something Mozilla would have to correct on their side.

[Twi1ightSparkle]

https://mozilla.org/.well-known/matrix/server needs the CORS too while you're at it

[ara4n]

That doesn't look like CSP

oops, sorry for misdiagnosing.

https://mozilla.org/.well-known/matrix/server needs the CORS too while you're at it

Strictly speaking, the /server URI shouldn't need CORS, as clients don't check the server URI.

[pmac]

hmm... so https://www.mozilla.org/.well-known/matrix/client is responding with the proper CORS header, but https://mozilla.org/.well-known/matrix/client isn't when it sends the 302. Is that the problem? I'll see about getting the redirect to send the header. Though it might be easier for the team that owns the redirect to just host the file as well.

[pmac]

Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1614615

[jryans]

hmm... so https://www.mozilla.org/.well-known/matrix/client is responding with the proper CORS header, but https://mozilla.org/.well-known/matrix/client isn't when it sends the 302. Is that the problem? I'll see about getting the redirect to send the header. Though it might be easier for the team that owns the redirect to just host the file as well.

Yes, either the redirect needs to also set the access-control-allow-origin: * or serve the file directly (also with access-control-allow-origin: * set).

[jryans]

Since we can't do anything about this on the Riot side and there's an issue tracking it for Mozilla's infrastructure, let's close this one.

[pmac]

Got an update in the bug that this should now be fixed. I do see the proper header on the redirect. Can someone confirm that it works now?

[aaronraimist]

Works for me

[ara4n]

yup, confirmed fixed - thanks!