I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the resource is something like file://..., which is changed to null. Since the last update, Chrome blocks this request with the following message:

'Access-Control-Allow-Origin' header has a value 'null' that is not equal to the supplied origin. Origin 'null' is therefore not allowed access. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

I found two possible solutions:

a) Disable CORS

b) Set Access-Control-Allow-Origin to *

I didn't have the chance to try these solutions yet. However,

  1. Is there an advantage in allowing any origin over disabling CORS? There must be one, otherwise this option is nonsense...
  2. What's the best web server configuration to serve web apps with origin null?
  • clarify: how does the client affect the Access-Control-Allow-Origin response header? You must be serving the response from some origin, right? also, how do you "disable cors"? – dandavis Mar 28 '18 at 23:52
  • As I understand, Access-Control-Allow-Origin in the header depends on origin in the request header. Origin in request header is null because the web app running on Android has a file:// URL. We're using IIS and I found some manual about how to enable CORS. So I assumed CORS can be disabled. But when I think about it now, it might be better to support CORS but allow all origins. FYI: The webserver is in a private network but there are many devices to access it. I hope I could clarify the situation, althought I don't understand CORS well. I'll edit the question, if this info helps. – nightlyop Mar 29 '18 at 7:24
  • 1
    I think I'll have to solve the problem in the client. The react-native app opens the web app with something like <WebView source={{ uri: 'file:///android_asset/web/index.html }} /> I don't know how to solve this yet, but I'll try to change the client rather than the server. Why is a file URL not mapped to origin: localhost? I wouldn't have any problems than ;-) – nightlyop Mar 29 '18 at 14:47
  • In IIS configuration CORS can be disabled. – nightlyop Apr 3 '18 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.