# Issue with Relative Path Causing CORS Error on Discourse Sites

**URL:** https://meta.discourse.org/t/issue-with-relative-path-causing-cors-error-on-discourse-sites/333024
**Category:** Bug
**Created:** [October 27, 2024, 6:27am UTC](https://meta.discourse.org/t/issue-with-relative-path-causing-cors-error-on-discourse-sites/333024 "2024-10-27T06:27:11Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![simonk](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simonk/32/247950_2.png) [@simonk](https://meta.discourse.org/u/simonk)
#### Post date: [October 28, 2024, 11:49am UTC](https://meta.discourse.org/t/issue-with-relative-path-causing-cors-error-on-discourse-sites/333024/4 "2024-10-28T11:49:35Z")

</div>

Are you using a CDN on either of these sites? I have noticed that code highlighting is no longer working on my site, and I think it’s because of this:

> [@Code highlighting failed because bunny.net CDN](https://meta.discourse.org/t/code-highlighting-failed-because-bunny-net-cdn/296333/4):
>
> The change which made this noticeable was most likely [DEV: Modernise highlightjs loading (#24197) · discourse/discourse@0878dde · GitHub](https://github.com/discourse/discourse/commit/0878dde2132a34ba2787e702de222bc6dd161895), which switched highlightjs to load via native import(), which requires CORS headers when fetching from a CDN. But even before that change, you likely would have had some issues with things like custom Fonts (which also require CORS headers for cross-origin requests). In theory, Discourse itself should be adding the CORS header to CDN responses. If it’s not, …

In my case, my CDN is **not** returning an `Access-Control-Allow-Origin` header for the highlightjs file. I notice that Meta’s CDN **does** include that header, so I wonder what is different.

```plaintext
$ curl --silent -I https://d3bpeqsaub0i6y.cloudfront.net/highlight-js/meta.discourse.org/9797975efac87d28baa695ae13ca72ccaf5120f5.js | grep -i access-control
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD, OPTIONS

```

However, those headers are **not** being served by the origin server:

```plaintext
$ curl --silent -I https://meta.discourse.org/highlight-js/meta.discourse.org/9797975efac87d28baa695ae13ca72ccaf5120f5.js | grep -i access-control
<no output>

```

As far as I can tell, Discourse is meant to add access-control headers to the highlightjs files:

> <https://github.com/discourse/discourse/blob/27c20eeacd0ac2ae8c69cfb0753abda581357306/app/controllers/highlight_js_controller.rb#L11>

**However** , those headers are only applied if the request is a “CDN request”:

> <https://github.com/discourse/discourse/blob/27c20eeacd0ac2ae8c69cfb0753abda581357306/app/controllers/application_controller.rb#L789>

> <https://github.com/discourse/discourse/blob/27c20eeacd0ac2ae8c69cfb0753abda581357306/lib/discourse.rb#L1187>

This only works if Discourse is configured with a separate host name for “CDN requests”.

---

_[View the full topic](https://meta.discourse.org/t/issue-with-relative-path-causing-cors-error-on-discourse-sites/333024)._