Hello, a locally hosted application has a web interface which tries to send a data (POST request) to a remote resource (which is under my control) yet the web browser (Fi… (read more)
Hello, a locally hosted application has a web interface which tries to send a data (POST request) to a remote resource (which is under my control) yet the web browser (Firefox ESR 128.9.0esr) blocks this resource request saying in a developer console (F12) this:
- NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_SECURITY, MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT)
- Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://myRemoteServerIP/request.php. (Reason: CORS request did not succeed). Status code: (null).
I suspect that the CORS blocking is a result of the first (SSL) error, AI also told me that I can configure my remote server/resource (e.g., using Apache, Nginx, or PHP) to include the necessary CORS headers in its responses and indeed the remote server of mine has such lines inside a PHP script that is receiving the request:
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: *');
The remote resource (server) is using self-signed SSL certificate and it is referenced using IP instead of a domain name.
When I try to do the same request via Private browsing window (without extensions), there is no NS_ERROR about self-signed cert. but only CORS one.
When I try browser Librewolf 137.0.2-1 (my FF version is older: 128.9.0), the request is NOT blocked, is OK..
My main aim is not to avoid blocking in my browser, but in all main browsers for everyone.
Is it so that this kind of blocking is default behavior in browsers?
Is there please any way to avoid that, beside getting a domain name and CA signed SSL certificate?
