I develop a web app. When I run the app on Android, origin in the header of a network request is
null. Access-Control-Allow-Origin in the response header is
null too, because the origin of the resource is something like
file://..., which is changed to
null. Since the last update, Chrome blocks this request with the following message:
'Access-Control-Allow-Origin' header has a value 'null' that is not equal to the supplied origin. Origin 'null' is therefore not allowed access. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
I found two possible solutions:
a) Disable CORS
b) Set Access-Control-Allow-Origin to
I didn't have the chance to try these solutions yet. However,
- Is there an advantage in allowing any origin over disabling CORS? There must be one, otherwise this option is nonsense...
- What's the best web server configuration to serve web apps with origin