# Stackpath (Formerly MaxCDN) - Invalid or Unexpected Token

**URL:** https://meta.discourse.org/t/stackpath-formerly-maxcdn-invalid-or-unexpected-token/111589
**Category:** Support
**Created:** [March 14, 2019, 3:02pm UTC](https://meta.discourse.org/t/stackpath-formerly-maxcdn-invalid-or-unexpected-token/111589 "2019-03-14T15:02:05Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [March 14, 2019, 3:55pm UTC](https://meta.discourse.org/t/stackpath-formerly-maxcdn-invalid-or-unexpected-token/111589/4 "2019-03-14T15:55:35Z")

</div>

OK, that’s better.

 ![image](https://global.discourse-cdn.com/meta/original/3X/8/c/8c5278429b9623a93f9346276624555784c63ae0.png)

If we click on one of those we get binary data that indicates the browser doesn’t understand how to decode what’s being sent back:

 ![image](https://global.discourse-cdn.com/meta/original/3X/8/b/8becbb65809da9c114b6fe3d11c516a484be9552.png)

If we look at the actual response headers from the CDN:

```plaintext
○ → curl -I https://b7f7x2b6.stackpathcdn.com/brotli_asset/locales/en-7198f510be5ac202c75f0bb40bbaa99b06947b8590d6ed10bb353c4108efc819.js
HTTP/1.1 200 OK
Date: Thu, 14 Mar 2019 15:49:54 GMT
Accept-Ranges: bytes
ETag: "1552576873"
Content-Type: application/javascript
Last-Modified: Thu, 14 Mar 2019 15:21:13 GMT
Access-Control-Allow-Origin: *
Server: nginx
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
X-Discourse-Route: static/brotli_asset
Content-Transfer-Encoding: binary
Cache-Control: max-age=31556952, public, immutable
X-Request-Id: 08fe3ea9-569b-4eb8-9dc0-3a60ad2f13f3
X-Runtime: 0.009359
Strict-Transport-Security: max-age=31536000
X-HW: 1552578594.cds008.tr2.hn,1552578594.cds002.tr2.c
Connection: keep-alive
Content-Length: 66601

```

and compare it with the non-CDN response:

```plaintext
○ → curl -I https://discuss.360velo.com/brotli_asset/locales/en-7198f510be5ac202c75f0bb40bbaa99b06947b8590d6ed10bb353c4108efc819.js
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 14 Mar 2019 15:52:11 GMT
Content-Type: application/javascript
Content-Length: 66601
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
X-Discourse-Route: static/brotli_asset
Expires: Sat, 14 Mar 2020 15:52:11 GMT
Last-Modified: Thu, 14 Mar 2019 15:21:13 GMT
Content-Encoding: br
Content-Transfer-Encoding: binary
Cache-Control: max-age=31556952, public, immutable
X-Request-Id: 5b139520-2d13-4eb0-83ef-cafc83ba656f
X-Runtime: 0.003118
Strict-Transport-Security: max-age=31536000

```

You’ll note that the CDN has stripped the important header: `Content-Encoding: br` that tells the browser “this response is brotli-encoded”. So it can’t interpret it properly.

You’ll need to change your CDN configuration to not strip this header.

---

_[View the full topic](https://meta.discourse.org/t/stackpath-formerly-maxcdn-invalid-or-unexpected-token/111589)._