AWS CloudFront Signed Cookies CORS Issue












0















I am getting following error with cloudfront signed cookies implementation




Access to XMLHttpRequest at 'https://a.xyz.com/test.html' from origin
'https://b.xyz.com' has been blocked by CORS policy: No
'Access-Control-Allow-Origin' header is present on the requested
resource.




I am accessing a file at a.xyz.com (Domain 1) from b.xyz.com (Domain 2).
This was working fine before restricting viewer access(using Signed cookie) for cloud front (Domain 1) distribution.



My S3 CORS configuration for bucket having domain 1 assets is



<?xml version="1.0" encoding="UTF-8"?>

<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">

<CORSRule>

    <AllowedOrigin>*</AllowedOrigin>

    <AllowedMethod>GET</AllowedMethod>

    <AllowedMethod>PUT</AllowedMethod>

    <AllowedMethod>POST</AllowedMethod>

    <AllowedMethod>HEAD</AllowedMethod>

    <MaxAgeSeconds>3000</MaxAgeSeconds>

    <AllowedHeader>*</AllowedHeader>

</CORSRule>

</CORSConfiguration>


I have tried setting following whitelist headers in cloudfront behavior settings



Access-Control-Request-Headers

Access-Control-Request-Method

Origin


But I am still getting the above error.



Note: If I open the file https://a.xyz.com/test.html in new tab it is working fine i.e. signed cookies are created successfully.



How can I fix this ?






javascript ajax amazon-web-services amazon-s3 cors







share|improve this question





























    0















    I am getting following error with cloudfront signed cookies implementation




    Access to XMLHttpRequest at 'https://a.xyz.com/test.html' from origin
    'https://b.xyz.com' has been blocked by CORS policy: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource.




    I am accessing a file at a.xyz.com (Domain 1) from b.xyz.com (Domain 2).
    This was working fine before restricting viewer access(using Signed cookie) for cloud front (Domain 1) distribution.



    My S3 CORS configuration for bucket having domain 1 assets is



    <?xml version="1.0" encoding="UTF-8"?>
    
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    
<CORSRule>
    
    <AllowedOrigin>*</AllowedOrigin>
    
    <AllowedMethod>GET</AllowedMethod>
    
    <AllowedMethod>PUT</AllowedMethod>
    
    <AllowedMethod>POST</AllowedMethod>
    
    <AllowedMethod>HEAD</AllowedMethod>
    
    <MaxAgeSeconds>3000</MaxAgeSeconds>
    
    <AllowedHeader>*</AllowedHeader>
    
</CORSRule>
    
</CORSConfiguration>


    I have tried setting following whitelist headers in cloudfront behavior settings



    Access-Control-Request-Headers
    
Access-Control-Request-Method
    
Origin


    But I am still getting the above error.



    Note: If I open the file https://a.xyz.com/test.html in new tab it is working fine i.e. signed cookies are created successfully.



    How can I fix this ?






    javascript ajax amazon-web-services amazon-s3 cors







    share|improve this question



























      0












      0








      0








      I am getting following error with cloudfront signed cookies implementation




      Access to XMLHttpRequest at 'https://a.xyz.com/test.html' from origin
      'https://b.xyz.com' has been blocked by CORS policy: No
      'Access-Control-Allow-Origin' header is present on the requested
      resource.




      I am accessing a file at a.xyz.com (Domain 1) from b.xyz.com (Domain 2).
      This was working fine before restricting viewer access(using Signed cookie) for cloud front (Domain 1) distribution.



      My S3 CORS configuration for bucket having domain 1 assets is



      <?xml version="1.0" encoding="UTF-8"?>
      
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
      
<CORSRule>
      
    <AllowedOrigin>*</AllowedOrigin>
      
    <AllowedMethod>GET</AllowedMethod>
      
    <AllowedMethod>PUT</AllowedMethod>
      
    <AllowedMethod>POST</AllowedMethod>
      
    <AllowedMethod>HEAD</AllowedMethod>
      
    <MaxAgeSeconds>3000</MaxAgeSeconds>
      
    <AllowedHeader>*</AllowedHeader>
      
</CORSRule>
      
</CORSConfiguration>


      I have tried setting following whitelist headers in cloudfront behavior settings



      Access-Control-Request-Headers
      
Access-Control-Request-Method
      
Origin


      But I am still getting the above error.



      Note: If I open the file https://a.xyz.com/test.html in new tab it is working fine i.e. signed cookies are created successfully.



      How can I fix this ?






      javascript ajax amazon-web-services amazon-s3 cors







      share|improve this question
















      I am getting following error with cloudfront signed cookies implementation




      Access to XMLHttpRequest at 'https://a.xyz.com/test.html' from origin
      'https://b.xyz.com' has been blocked by CORS policy: No
      'Access-Control-Allow-Origin' header is present on the requested
      resource.




      I am accessing a file at a.xyz.com (Domain 1) from b.xyz.com (Domain 2).
      This was working fine before restricting viewer access(using Signed cookie) for cloud front (Domain 1) distribution.



      My S3 CORS configuration for bucket having domain 1 assets is



      <?xml version="1.0" encoding="UTF-8"?>
      
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
      
<CORSRule>
      
    <AllowedOrigin>*</AllowedOrigin>
      
    <AllowedMethod>GET</AllowedMethod>
      
    <AllowedMethod>PUT</AllowedMethod>
      
    <AllowedMethod>POST</AllowedMethod>
      
    <AllowedMethod>HEAD</AllowedMethod>
      
    <MaxAgeSeconds>3000</MaxAgeSeconds>
      
    <AllowedHeader>*</AllowedHeader>
      
</CORSRule>
      
</CORSConfiguration>


      I have tried setting following whitelist headers in cloudfront behavior settings



      Access-Control-Request-Headers
      
Access-Control-Request-Method
      
Origin


      But I am still getting the above error.



      Note: If I open the file https://a.xyz.com/test.html in new tab it is working fine i.e. signed cookies are created successfully.



      How can I fix this ?






      javascript ajax amazon-web-services amazon-s3 cors




      javascript ajax amazon-web-services amazon-s3 cors






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Nov 22 '18 at 8:22







      Yamini Chhabra

















      asked Nov 22 '18 at 5:53









      Yamini ChhabraYamini Chhabra

      71116




      71116
























          1 Answer
          1






          active

          oldest

          votes


















          0














          For CORS to be used with cookies, you need to use Access-Control-Allow-Credentials



          https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials



          Also Access-Control-Allow-Origin must not be *, and XHR need to be fired with withCredentials



          https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials






          share|improve this answer























            Your Answer






            StackExchange.ifUsing("editor", function () {
            StackExchange.using("externalEditor", function () {
            StackExchange.using("snippets", function () {
            StackExchange.snippets.init();
            });
            });
            }, "code-snippets");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "1"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53424655%2faws-cloudfront-signed-cookies-cors-issue%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            0














            For CORS to be used with cookies, you need to use Access-Control-Allow-Credentials



            https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials



            Also Access-Control-Allow-Origin must not be *, and XHR need to be fired with withCredentials



            https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials






            share|improve this answer




























              0














              For CORS to be used with cookies, you need to use Access-Control-Allow-Credentials



              https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials



              Also Access-Control-Allow-Origin must not be *, and XHR need to be fired with withCredentials



              https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials






              share|improve this answer


























                0












                0








                0







                For CORS to be used with cookies, you need to use Access-Control-Allow-Credentials



                https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials



                Also Access-Control-Allow-Origin must not be *, and XHR need to be fired with withCredentials



                https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials






                share|improve this answer













                For CORS to be used with cookies, you need to use Access-Control-Allow-Credentials



                https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials



                Also Access-Control-Allow-Origin must not be *, and XHR need to be fired with withCredentials



                https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered Nov 22 '18 at 8:51









                William ChongWilliam Chong

                919416




                919416
































                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Stack Overflow!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid …



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53424655%2faws-cloudfront-signed-cookies-cors-issue%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    MongoDB - Not Authorized To Execute Command

                    Image
                    .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 0 I have successfully enabled authorization on MongoDB and I have created an account on the admin database and then I created an account for my database called test. The following connection string to connect to my test database works successfully: mongo --host 192.168.17.52 --port 27017 -u user1 -p password --authenticationDatabase test Only problem I have now is, I cannot execute commands such as: show dbs. I get the following error when I try to do so: "errmsg" : "not authorized on admin to execute command { listDatabases: 1.0, lsid: { id: UUID("a1d5bc0d-bc58-485e-b232-270758a89455") }, $db: "admin...
                    Read more

                    in spring boot 2.1 many test slices are not allowed anymore due to multiple @BootstrapWith

                    Image
                    1 I tried to upgrade a yummy sandwich made of two test slices (@JsonTest and @JdbcTest in my case, crunchy test code in between) adding spring boot 2.1 flavour to it. But it seems it was not much of a success. I cannot annotate my tests with many @...Test since they are now each bringing their own XxxTestContextBootstrapper. It used to work when they all used same SpringBootTestContextBootstrapper. @RunWith(SpringRunner.class) @JdbcTest @JsonTest public class Test { @Test public void test() { System.out.printn("Hello, World !"); } } The error I get from BootstrapUtils is illegalStateException : Configuration error: found multiple declarations of @BootstrapWith for test class I understand I might be doing something wrong here but is there an easy way I could load both Json and Jdbc contex...
                    Read more

                    Npm cannot find a required file even through it is in the searched directory

                    Image
                    up vote 0 down vote favorite I got that error: users-Air:pdfuploader user$ npm run start client@0.1.0 start /Users/user/Documents/pdfuploader react-scripts start Could not find a required file. Name: index.html Searched in: /Users/user/Documents/pdfuploader/public npm ERR! code ELIFECYCLE npm ERR! errno 1 npm ERR! client@0.1.0 start: `react-scripts start` npm ERR! Exit status 1 npm ERR! npm ERR! Failed at the client@0.1.0 start script. npm ERR! This is probably not a problem with npm. There is likely additional logging output above. npm ERR! A complete log of this run can be found in: npm ERR! /Users/user/.npm/_logs/2018-11-19T10_19_14_555Z-debug.log users-Air:pdfuploader user$ And the file is in /Users/user/Documents/pdfuploader/public as you can see in my github repository: https://github.c...
                    Read more