Stackpath (Formerly MaxCDN) - Invalid or Unexpected Token

support
4

OK, that’s better.

image
image.png1123×606 109 KB

If we click on one of those we get binary data that indicates the browser doesn’t understand how to decode what’s being sent back:

image
image.png786×238 62.7 KB

If we look at the actual response headers from the CDN:

○ → curl -I https://b7f7x2b6.stackpathcdn.com/brotli_asset/locales/en-7198f510be5ac202c75f0bb40bbaa99b06947b8590d6ed10bb353c4108efc819.js
HTTP/1.1 200 OK
Date: Thu, 14 Mar 2019 15:49:54 GMT
Accept-Ranges: bytes
ETag: "1552576873"
Content-Type: application/javascript
Last-Modified: Thu, 14 Mar 2019 15:21:13 GMT
Access-Control-Allow-Origin: *
Server: nginx
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
X-Discourse-Route: static/brotli_asset
Content-Transfer-Encoding: binary
Cache-Control: max-age=31556952, public, immutable
X-Request-Id: 08fe3ea9-569b-4eb8-9dc0-3a60ad2f13f3
X-Runtime: 0.009359
Strict-Transport-Security: max-age=31536000
X-HW: 1552578594.cds008.tr2.hn,1552578594.cds002.tr2.c
Connection: keep-alive
Content-Length: 66601

and compare it with the non-CDN response:

○ → curl -I https://discuss.360velo.com/brotli_asset/locales/en-7198f510be5ac202c75f0bb40bbaa99b06947b8590d6ed10bb353c4108efc819.js
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 14 Mar 2019 15:52:11 GMT
Content-Type: application/javascript
Content-Length: 66601
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
X-Discourse-Route: static/brotli_asset
Expires: Sat, 14 Mar 2020 15:52:11 GMT
Last-Modified: Thu, 14 Mar 2019 15:21:13 GMT
Content-Encoding: br
Content-Transfer-Encoding: binary
Cache-Control: max-age=31556952, public, immutable
X-Request-Id: 5b139520-2d13-4eb0-83ef-cafc83ba656f
X-Runtime: 0.003118
Strict-Transport-Security: max-age=31536000

You’ll note that the CDN has stripped the important header: Content-Encoding: br that tells the browser “this response is brotli-encoded”. So it can’t interpret it properly.

You’ll need to change your CDN configuration to not strip this header.

4 Likes