Все плагины не работают из-за ошибки CORS после недавнего обновления

[TomoftheFog (Tom)]

Since last week, all plugins both core and installed have stopped functioning even when enabled on our forum. Initially I thought this was something to do with the previously mentioned bug FIX: Compile missing rollup plugin bundles on demand in development - #8 but we have run multiple updates since and nothing has fixed it. I tried to enable a previously unused plugin, the preinstalled User Notes one, and there’s no options to add notes for any users. Even the docker manager has stopped so all updates have to be run on a server level, allowing only one person to apply them instead of the admin team.

I’ve tried looking around for a solution for this, but all I have come across is plugin disabled automatically or something along those lines, not really as specific as this.

Could anyone please advise any possible solutions or routes we should be looking down, as we’re rather avoid a rollback but so far it looks like it may be the last option.

Thanks as always for everyone here and your ongoing support

[darkpixlz (Pyx)]

Hmm. This looks like it’s an issue with your CDN:

I enabled my CORS ignore plugin and the scripts successfully loaded but I don’t visibly see any changes from plugins. I’d recommend trying that, and if it works you should find what’s causing the error with your CDN.

CORS Unblock – Get this Extension for 🦊 Firefox (en-US)

[TomoftheFog (Tom)]

Thank you so much for taking the time to look into this for us. We’ll run some tests over the weekend and update when we can.

[pfaffman (Jay Pfaffman)]

I’ve got the same problem with a bunnycdn. It was working fine until a recent update.

I tried adding .js to the CORS headers at bunny.net as described here:

Code highlighting failed because bunny.net CDN

Someone compained that code highlighting isn’t working on their site. I’ve replicated the issue on mine. The issue seems to be that the CDN is blocked by CORS policy: [image] I fixed the problem by adding js to the “add cors header” setting on the cors page: [image] If enabled, bunny.net will automatically add CORS headers (Cross-Origin Resource Sharing) to all requests to files with extensions from the list. This post is to document it in case someone else has an issue with a bunny.net CD…

As was the case then, I don’t understand why this problem started when I upgraded to 6800ad3adf3ef9c3caeb9a4d849997c7a3dc98d7 last week.

[TomoftheFog (Tom)]

Thanks Jay, we have Bunny and the fix you mentioned has sorted all the issues out now! Thank you and everyone for the help and support on this one, our forum is back to normal. Well as normal as it can be

[david (David Taylor)]

Glad to hear you got it sorted!

@pfaffman

I don’t understand why this problem started when I upgraded

In the new plugin system, we use script type="module", which requires the correct CORS headers to be set. Old-style script type="text/javascript" do not require those headers.

We’ve been slowly migrating different systems to type="module" over the last few years. Themes were already using it, and so was highlightjs (which was the one in the other topic). Loading fonts from the CDN also has the CORS requirement.

So there were probably some other things subtly broken, even before the recent changes to the plugin system. Now that you’ve set the CORS config, everything should be working again

[pfaffman (Jay Pfaffman)]

@david

We’ve been slowly migrating different systems

Aha. That’s what I would not have guessed.

[tanya_byrne (kukulaka)]

Just a heads up for folks, if you are using Azure Classic CDN this issue has started to occur. I am trying out a fix on the CDN side, but I may need to migrate to proper front door rather than classic CDN

[tanya_byrne (kukulaka)]

@david

In the new plugin system, we use script type="module", which requires the correct CORS headers to be set. Old-style script type="text/javascript" do not require those headers.

Yep, confirmed this issue on Azure Classic CDN too.

You need to add a new rule to the rules engine, example below:

"rules": [

                        {

                            "name": "JSCORS",

                            "order": 1,

                            "conditions": [

                                {

                                    "name": "RequestUri",

                                    "parameters": {

                                        "typeName": "DeliveryRuleRequestUriConditionParameters",

                                        "operator": "Contains",

                                        "negateCondition": false,

                                        "matchValues": [

                                            "/assets/js/plugins/"

                                        ],

                                        "transforms": []

                                    }

                                }

                            ],

                            "actions": [

                                {

                                    "name": "ModifyResponseHeader",

                                    "parameters": {

                                        "typeName": "DeliveryRuleHeaderActionParameters",

                                        "headerAction": "Overwrite",

                                        "headerName": "Access-Control-Allow-Origin",

                                        "value": "https://forums.mycoolforum.com"

                                    }

                                },

                                {

                                    "name": "ModifyResponseHeader",

                                    "parameters": {

                                        "typeName": "DeliveryRuleHeaderActionParameters",

                                        "headerAction": "Overwrite",

                                        "headerName": "Content-Type",

                                        "value": "application/javascript"

                                    }

                                },

                                {

                                    "name": "CacheExpiration",

                                    "parameters": {

                                        "typeName": "DeliveryRuleCacheExpirationActionParameters",

                                        "cacheBehavior": "BypassCache",

                                        "cacheType": "All"

                                    }

                                }

                            ]

[tanya_byrne (kukulaka)]

weirdly this issue hasn’t impacted themes, only plugins for us.

[denvergeeks]

Is there somewhere to find instructions or guidance regarding these recent changes regarding CORS for those of us using Cloudflare?

[david (David Taylor)]

@pfaffman @TomoftheFog @tanya_byrne @denvergeeks please could you confirm how your assets are configured? Do you just have a CDN + the application server? Or do you also store assets on S3/S3-compatible storage?

If you are using S3/S3-compatible storage, then unfortunately the only reliable way is to add some CDN-specific configuration. I assumed this topic was about S3 assets, but now I’m not so sure?

For people using a simple CDN against the application server, there shouldn’t have been any extra configuration work required. It should ‘just work’, exactly the same as theme-javascripts and hightlightjs bundles. But it looks like we were indeed missing the header in our default NGINX configuration. Sorry about that!

This should get things working again:

https://github.com/discourse/discourse/pull/39031

Once this is merged, a ./launcher rebuild app will be required for it to take effect. NGINX config changes are not applied during UI updates.

[david (David Taylor)]

Added this information to the main topic:

@david

CORS / Access-Control-Allow-Origin Errors

If you experience CORS errors after the update, and you use a CDN, then you should run a full CLI rebuild (./launcher rebuild app) to pull in this change to the NGINX configuration.

If you use S3 (or S3 compatible) storage for assets, then you need to configure your CDN to add the Access-Control-Allow-Origin: * response header to all assets.

Sorry for the disruption here! We should’ve done some more extensive testing with different CDN configurations. Please let us know if you’re still experiencing any issues after a rebuild.

[tanya_byrne (kukulaka)]

Подтверждаем, что мы не используем S3

[pfaffman (Jay Pfaffman)]

@david

Также хранить активы в S3 или совместимом с S3 хранилище?

Все сайты, о которых мне известно и на которых наблюдается эта проблема, используют S3. У некоторых CDN JS уже был в списке, у других — нет. Не знаю, почему это могло произойти; возможно, настройки по умолчанию менялись с годами?

[TomoftheFog (Tom)]

Извините за поздний ответ, мы действительно используем S3.

[amiantos (Brad Root)]

У меня возникли трудности с настройкой CORS в Cloudflare R2 для работы с пользовательским доменом. В итоге я решил проблему методом перебора, используя правило трансформации заголовков, чтобы всегда добавлять нужный заголовок для моего CDN-домена. На случай, если это кому-то ещё пригодится.

[TomoftheFog (Tom)]

Мы также обнаружили ещё одну проблему после столкновения с этой: некоторые пользователи не могут видеть изображения аватаров при использовании кнопки «Преформатированный текст» в Markdown. Система пытается загрузить highlight-js и выдаёт ошибку с сообщением о сбое CORS:

Не уверены, что проблема только на нашей стороне, но хотели предупредить всех на случай, если это связано.

[david (David Taylor)]

Я предполагаю, что f.insertcred.it — это ваш S3 CDN? HighlightJS должен загружаться с «CDN приложения», а не с S3 CDN, поэтому эта проблема удивительна. Насколько мне известно, за последние несколько месяцев ничего, связанного с highlightjs, не менялось.

У вас есть CDN приложения? Или только S3 + S3 CDN?