Name is required.
Email address is required.
Invalid email address
Answer is required.
Exceeding max length of 5KB

CORS problem on ssl.p.jwpcdn.com


Hi!

We are getting this error on Chrome:

Font from origin 'http://ssl.p.jwpcdn.com' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://siwi-mediahub-test16.creo.se' is therefore not allowed access.

This causes that the control icons are not shown properly.

It seems that the response at http://ssl.p.jwpcdn.com (with http) is not sending the CORS headers.

However the response at https://ssl.p.jwpcdn.com (with https) is sending the CORS headers correctly, and we do not have any problem.

We need to get the headers also on http response. Are you planning to put the headers also on http responses ?


Thanks in advance!

Isi Ramirez.

9 Community Answers

Donni

JW Player Support Agent  
-1 rated :

You shouldn’t be loading the fonts directly from our CDN, how are you hosting your player?

Isi Ramírez

User  
0 rated :

Hi Donni,

I am not downloading anything from your CDN. It is the player who is trying to do it internally.

We've downloaded the player to our own server using the self-hosted option following the instructions on your website.

Is it possible to send the CORS headers in the http version of the font as the are sent in the https version?

Donni

JW Player Support Agent  
0 rated :

We should have open CORS, can you send me a reproduction page so I can inspect everything? Do you have a plugin that could be interfering?

Isi Ramírez

User  
0 rated :

Hi Donni,

I have tested with several browsers and computers, so I don't think there is any plugin interfering.

If we reproduce the calls made by the player by using the command line, it is quite clear that there is something missing. As you can see when using http the CORS headers (Access-Control-Allow-Origin: *, ...) are not there:


curl -sI -H "Origin: example.com" -H "Access-Control-Request-Method: GET" https://ssl.p.jwpcdn.com/player/download/jwplayer-7.4.0.zip

HTTP/1.1 200 OK
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3000
Content-Type: application/zip
Date: Wed, 17 Aug 2016 07:06:06 GMT
Etag: "b89f1d70a525f5ef1851ab2e1e08ad8c"
Last-Modified: Fri, 22 Apr 2016 20:24:56 GMT
Server: AmazonS3
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Content-Length: 319127


curl -sI -H "Origin: example.com" -H "Access-Control-Request-Method: GET" http://ssl.p.jwpcdn.com/player/download/jwplayer-7.4.0.zip

HTTP/1.1 200 OK
Content-Type: application/zip
Date: Wed, 17 Aug 2016 07:05:57 GMT
Etag: "b89f1d70a525f5ef1851ab2e1e08ad8c"
Last-Modified: Fri, 22 Apr 2016 20:24:56 GMT
Server: AmazonS3
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Content-Length: 319127


JWPlayer seems to select the protocol (http/https) internally depending on the protocol of the main page.

I would say it is a lack configuration on the web server when the protocol is http. If so, could you please tell me if is possible to fix it and when? We would be very happy to get this fixed the sooner the better.


Thanks,
Isi.

Donni

JW Player Support Agent  
0 rated :

Isi, we want to help you but we can’t do that unless we see how you are implementing the player on reproduction page. For example, are you calling the zip of the player on your page?

Isi Ramírez

User  
0 rated :

Reproduction page(s):

1) With http (Does not work as it should!):
http://d1qka67o21nlgb.cloudfront.net/static/test/player.html

* Your exact reproduction steps -> I just loaded the page
* What you are expecting the player to do -> Show the play button correctly
* What the player is actually doing -> The play button is not showing correctly. The following errors are shown in the browser's console:

player.html:1 Font from origin 'http://ssl.p.jwpcdn.com' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://d1qka67o21nlgb.cloudfront.net' is therefore not allowed access.

player.html:1 Font from origin 'http://ssl.p.jwpcdn.com' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://d1qka67o21nlgb.cloudfront.net' is therefore not allowed access.


2) With https (Works as it should!):
https://d1qka67o21nlgb.cloudfront.net/static/test/player.html

* Your exact reproduction steps -> I just loaded the page
* What you are expecting the player to do -> Show the play button correctly
* What the player is actually doing -> Show the play button correctly. No errors in the browser's console.

Donni

JW Player Support Agent  
0 rated :

On the latest Chrome on OS X it appears to be loading as expected. Have you tested this outside of your own dev environment?

Isi Ramírez

User  
0 rated :

Yes, I had tested on several computers (3 Mac OS X El Capitan with Chrome 52). I tested now on even more computers and I found something really weird. It seems to work on some computers and not on others.

I have researched more about the issue. Please check again the reproduction page that I have updated with more information:

http://d1qka67o21nlgb.cloudfront.net/static/test/player.html


P.S: I would suggest you to check the logs in the server to see why the header 'Access-Control-Allow-Origin: *' is not served in those cases.

Donni

JW Player Support Agent  
0 rated :

Ok so what browsers is it happening on? Have you disabled all extensions on that browser? Are all your machines on a managed network? We’ve looked at your page on every major browser we support and we are not experiencing this issue.

This question has received the maximum number of answers.